{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/", "slug": "dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute", "url": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/" }, "title": "Review AS-path rewriting when Route Server connects dual-homed ExpressRoute networks", "summary": "Check the documented NVA policy before diagnosing missing routes between route servers.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:00+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 2, "word_count": 222, "potentially_affected": "Use this review for the documented hub-and-spoke design with Route Server in both locations and ExpressRoute integration. Identify each BGP session and appliance vendor. Do not apply an AS-path change to an unrelated topology solely because it contains Route Server.", "dse_recommendation": "DSE recommends drawing the expected AS path at every peering boundary before editing the appliance.", "primary_source": { "name": "About dual-homed networks with Azure Route Server | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/route-server/about-dual-homed-network", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

In Microsoft’s dual-homed ExpressRoute design, the route servers share autonomous-system number 65515. BGP loop prevention discards a received path containing the receiving server’s own AS number. The documented design therefore requires the intervening NVA to apply as-override when peering with each route server so routes from the other server are not discarded for that reason. Microsoft Learn.

\n

Applicability

\n

Use this review for the documented hub-and-spoke design with Route Server in both locations and ExpressRoute integration. Identify each BGP session and appliance vendor. Do not apply an AS-path change to an unrelated topology solely because it contains Route Server.

\n

DSE recommendation

\n

DSE recommends drawing the expected AS path at every peering boundary before editing the appliance. Ask the routing owner to map Microsoft’s requirement to the vendor’s supported configuration. Record the intended prefixes and existing policy so a rejected route can be traced through the actual topology. Arrange a controlled change window and an explicit restoration plan.

\n

Verification

\n

Inspect received and advertised paths on both sides of the NVA during the approved test. Confirm the expected prefix reaches the intended route server and workload route table. Exercise representative traffic and its return path separately. Preserve sanitized before-and-after path evidence rather than treating an established BGP session as proof of route propagation.

\n

Official references

\n

Microsoft Learn: About dual-homed networks with Azure Route Server.

", "content_text": "Source facts\nIn Microsoft’s dual-homed ExpressRoute design, the route servers share autonomous-system number 65515. BGP loop prevention discards a received path containing the receiving server’s own AS number. The documented design therefore requires the intervening NVA to apply as-override when peering with each route server so routes from the other server are not discarded for that reason. Microsoft Learn.\nApplicability\nUse this review for the documented hub-and-spoke design with Route Server in both locations and ExpressRoute integration. Identify each BGP session and appliance vendor. Do not apply an AS-path change to an unrelated topology solely because it contains Route Server.\nDSE recommendation\nDSE recommends drawing the expected AS path at every peering boundary before editing the appliance. Ask the routing owner to map Microsoft’s requirement to the vendor’s supported configuration. Record the intended prefixes and existing policy so a rejected route can be traced through the actual topology. Arrange a controlled change window and an explicit restoration plan.\nVerification\nInspect received and advertised paths on both sides of the NVA during the approved test. Confirm the expected prefix reaches the intended route server and workload route table. Exercise representative traffic and its return path separately. Preserve sanitized before-and-after path evidence rather than treating an established BGP session as proof of route propagation.\nOfficial references\nMicrosoft Learn: About dual-homed networks with Azure Route Server.", "content_markdown": "## Source facts\n\nIn Microsoft’s dual-homed ExpressRoute design, the route servers share autonomous-system number 65515. BGP loop prevention discards a received path containing the receiving server’s own AS number. The documented design therefore requires the intervening NVA to apply as-override when peering with each route server so routes from the other server are not discarded for that reason. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/route-server/about-dual-homed-network).\n\n## Applicability\n\nUse this review for the documented hub-and-spoke design with Route Server in both locations and ExpressRoute integration. Identify each BGP session and appliance vendor. Do not apply an AS-path change to an unrelated topology solely because it contains Route Server.\n\n## DSE recommendation\n\nDSE recommends drawing the expected AS path at every peering boundary before editing the appliance. Ask the routing owner to map Microsoft’s requirement to the vendor’s supported configuration. Record the intended prefixes and existing policy so a rejected route can be traced through the actual topology. Arrange a controlled change window and an explicit restoration plan.\n\n## Verification\n\nInspect received and advertised paths on both sides of the NVA during the approved test. Confirm the expected prefix reaches the intended route server and workload route table. Exercise representative traffic and its return path separately. Preserve sanitized before-and-after path evidence rather than treating an established BGP session as proof of route propagation.\n\n## Official references\n\n[Microsoft Learn: About dual-homed networks with Azure Route Server](https://learn.microsoft.com/en-us/azure/route-server/about-dual-homed-network)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/", "url": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Review AS-path rewriting when Route Server connects dual-homed ExpressRoute networks", "item": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/", "url": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/", "headline": "Review AS-path rewriting when Route Server connects dual-homed ExpressRoute networks", "description": "Check the documented NVA policy before diagnosing missing routes between route servers.", "abstract": "Check the documented NVA policy before diagnosing missing routes between route servers.", "articleBody": "Source facts\nIn Microsoft’s dual-homed ExpressRoute design, the route servers share autonomous-system number 65515. BGP loop prevention discards a received path containing the receiving server’s own AS number. The documented design therefore requires the intervening NVA to apply as-override when peering with each route server so routes from the other server are not discarded for that reason. Microsoft Learn.\nApplicability\nUse this review for the documented hub-and-spoke design with Route Server in both locations and ExpressRoute integration. Identify each BGP session and appliance vendor. Do not apply an AS-path change to an unrelated topology solely because it contains Route Server.\nDSE recommendation\nDSE recommends drawing the expected AS path at every peering boundary before editing the appliance. Ask the routing owner to map Microsoft’s requirement to the vendor’s supported configuration. Record the intended prefixes and existing policy so a rejected route can be traced through the actual topology. Arrange a controlled change window and an explicit restoration plan.\nVerification\nInspect received and advertised paths on both sides of the NVA during the approved test. Confirm the expected prefix reaches the intended route server and workload route table. Exercise representative traffic and its return path separately. Preserve sanitized before-and-after path evidence rather than treating an established BGP session as proof of route propagation.\nOfficial references\nMicrosoft Learn: About dual-homed networks with Azure Route Server.", "datePublished": "2026-09-17T16:34:00+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review AS-path rewriting when Route Server connects dual-homed ExpressRoute networks" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 222, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "About dual-homed networks with Azure Route Server | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/route-server/about-dual-homed-network" } } ] } }