{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/",
        "slug": "dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/"
        },
        "title": "Keep both GatewaySubnet prefixes after an ExpressRoute gateway migration uses them",
        "summary": "Adding a second prefix does not make the original subnet prefix disposable after migration.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:22:45+00:00",
        "modified_at": "2026-09-10T02:14:30+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 233,
        "potentially_affected": "Eligible guided ExpressRoute gateway migrations that expand GatewaySubnet with an additional prefix.",
        "dse_recommendation": "Treat both prefixes as active gateway dependencies and exclude the original prefix from automatic cleanup.",
        "primary_source": {
            "name": "About migrating to an availability zone-enabled ExpressRoute virtual network gateway - Azure ExpressRoute | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/expressroute/gateway-migration",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft&#8217;s ExpressRoute gateway migration guidance states that the migrated gateway uses both the original and added GatewaySubnet prefixes. It explicitly instructs operators not to delete the old prefix. Multiple prefixes are configured through PowerShell, CLI or Resource Manager templates.</p>\n<p>The guided migration is for ExpressRoute gateways within the same virtual network, not VPN gateways or cross-region moves. The new gateway is a separate resource with its own monitoring metrics. <a href=\"https://learn.microsoft.com/en-us/azure/expressroute/gateway-migration\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Confirm that the actual migration uses an additional subnet prefix and that the gateway meets current eligibility requirements. Do not apply a replace-old-prefix assumption from another network migration to this workflow.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends carrying both prefixes into the post-migration address plan, dependency inventory and change record. Review any infrastructure cleanup script that interprets the older prefix as temporary. Keep old gateway-resource retirement separate from subnet-prefix retention. Have the network owner approve address-plan changes only after examining the migrated gateway&#8217;s documented requirements.</p>\n<h2>Verification</h2>\n<p>Inspect the migrated gateway, GatewaySubnet prefix list and updated ownership record after the approved transition. Confirm that automation preserves both prefixes and that monitoring refers to the new gateway resource. Validate expected connectivity without deleting a prefix as an experiment. Retain any discrepancy between the deployed address plan and the intended retained configuration as an unresolved migration finding.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/expressroute/gateway-migration\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: About migrating to an availability zone-enabled ExpressRoute virtual network gateway</a>. Source retrieved September 9, 2026.</p>",
        "content_text": "Source facts\nMicrosoft’s ExpressRoute gateway migration guidance states that the migrated gateway uses both the original and added GatewaySubnet prefixes. It explicitly instructs operators not to delete the old prefix. Multiple prefixes are configured through PowerShell, CLI or Resource Manager templates.\nThe guided migration is for ExpressRoute gateways within the same virtual network, not VPN gateways or cross-region moves. The new gateway is a separate resource with its own monitoring metrics. Microsoft Learn.\nApplicability\nConfirm that the actual migration uses an additional subnet prefix and that the gateway meets current eligibility requirements. Do not apply a replace-old-prefix assumption from another network migration to this workflow.\nDSE recommendation\nDSE recommends carrying both prefixes into the post-migration address plan, dependency inventory and change record. Review any infrastructure cleanup script that interprets the older prefix as temporary. Keep old gateway-resource retirement separate from subnet-prefix retention. Have the network owner approve address-plan changes only after examining the migrated gateway’s documented requirements.\nVerification\nInspect the migrated gateway, GatewaySubnet prefix list and updated ownership record after the approved transition. Confirm that automation preserves both prefixes and that monitoring refers to the new gateway resource. Validate expected connectivity without deleting a prefix as an experiment. Retain any discrepancy between the deployed address plan and the intended retained configuration as an unresolved migration finding.\nOfficial references\nMicrosoft Learn: About migrating to an availability zone-enabled ExpressRoute virtual network gateway. Source retrieved September 9, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft’s ExpressRoute gateway migration guidance states that the migrated gateway uses both the original and added GatewaySubnet prefixes. It explicitly instructs operators not to delete the old prefix. Multiple prefixes are configured through PowerShell, CLI or Resource Manager templates.\n\nThe guided migration is for ExpressRoute gateways within the same virtual network, not VPN gateways or cross-region moves. The new gateway is a separate resource with its own monitoring metrics. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/expressroute/gateway-migration).\n\n## Applicability\n\nConfirm that the actual migration uses an additional subnet prefix and that the gateway meets current eligibility requirements. Do not apply a replace-old-prefix assumption from another network migration to this workflow.\n\n## DSE recommendation\n\nDSE recommends carrying both prefixes into the post-migration address plan, dependency inventory and change record. Review any infrastructure cleanup script that interprets the older prefix as temporary. Keep old gateway-resource retirement separate from subnet-prefix retention. Have the network owner approve address-plan changes only after examining the migrated gateway’s documented requirements.\n\n## Verification\n\nInspect the migrated gateway, GatewaySubnet prefix list and updated ownership record after the approved transition. Confirm that automation preserves both prefixes and that monitoring refers to the new gateway resource. Validate expected connectivity without deleting a prefix as an experiment. Retain any discrepancy between the deployed address plan and the intended retained configuration as an unresolved migration finding.\n\n## Official references\n\n[Microsoft Learn: About migrating to an availability zone-enabled ExpressRoute virtual network gateway](https://learn.microsoft.com/en-us/azure/expressroute/gateway-migration). Source retrieved September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Keep both GatewaySubnet prefixes after an ExpressRoute gateway migration uses them",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/",
                "headline": "Keep both GatewaySubnet prefixes after an ExpressRoute gateway migration uses them",
                "description": "Adding a second prefix does not make the original subnet prefix disposable after migration.",
                "abstract": "Adding a second prefix does not make the original subnet prefix disposable after migration.",
                "articleBody": "Source facts\nMicrosoft’s ExpressRoute gateway migration guidance states that the migrated gateway uses both the original and added GatewaySubnet prefixes. It explicitly instructs operators not to delete the old prefix. Multiple prefixes are configured through PowerShell, CLI or Resource Manager templates.\nThe guided migration is for ExpressRoute gateways within the same virtual network, not VPN gateways or cross-region moves. The new gateway is a separate resource with its own monitoring metrics. Microsoft Learn.\nApplicability\nConfirm that the actual migration uses an additional subnet prefix and that the gateway meets current eligibility requirements. Do not apply a replace-old-prefix assumption from another network migration to this workflow.\nDSE recommendation\nDSE recommends carrying both prefixes into the post-migration address plan, dependency inventory and change record. Review any infrastructure cleanup script that interprets the older prefix as temporary. Keep old gateway-resource retirement separate from subnet-prefix retention. Have the network owner approve address-plan changes only after examining the migrated gateway’s documented requirements.\nVerification\nInspect the migrated gateway, GatewaySubnet prefix list and updated ownership record after the approved transition. Confirm that automation preserves both prefixes and that monitoring refers to the new gateway resource. Validate expected connectivity without deleting a prefix as an experiment. Retain any discrepancy between the deployed address plan and the intended retained configuration as an unresolved migration finding.\nOfficial references\nMicrosoft Learn: About migrating to an availability zone-enabled ExpressRoute virtual network gateway. Source retrieved September 9, 2026.",
                "datePublished": "2026-09-10T00:22:45+00:00",
                "dateModified": "2026-09-10T02:14:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-551-keep-both-gatewaysubnet-prefixes-after-an-expressroute-gateway-migration-uses-them/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Keep both GatewaySubnet prefixes after an ExpressRoute gateway migration uses them"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 233,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "About migrating to an availability zone-enabled ExpressRoute virtual network gateway - Azure ExpressRoute | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/expressroute/gateway-migration"
                }
            }
        ]
    }
}