{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/",
        "slug": "dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/"
        },
        "title": "Account for Route Server when disabling gateway-route propagation on a spoke",
        "summary": "Review the dynamic routes affected by a subnet route-table setting.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:33:48+00:00",
        "modified_at": "2026-09-17T16:38:45+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 214,
        "potentially_affected": "Use this check before changing a spoke subnet's route table. Identify where Route Server actually runs, which networks peer with it, and which application destinations rely on its learned routes. Do not infer route dependencies from the setting's gateway-oriented name.",
        "dse_recommendation": "DSE recommends listing the dynamic prefixes expected to remain available before changing propagation.",
        "primary_source": {
            "name": "Route injection in spoke virtual networks - Azure Route Server | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/route-server/route-injection-in-spokes",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft&#8217;s Route Server spoke-injection guidance warns that disabling Propagate gateway routes also stops spoke subnets from learning Route Server routes dynamically. For the documented hub-hosted Route Server pattern, spoke peering must use the remote gateway or Route Server. The document distinguishes that arrangement from a dual-homed design where the spoke has its own Route Server. <a href=\"https://learn.microsoft.com/en-us/azure/route-server/route-injection-in-spokes\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this check before changing a spoke subnet&#8217;s route table. Identify where Route Server actually runs, which networks peer with it, and which application destinations rely on its learned routes. Do not infer route dependencies from the setting&#8217;s gateway-oriented name.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends listing the dynamic prefixes expected to remain available before changing propagation. Have the routing owner compare the planned setting with the actual topology and any replacement routes. Preserve the current table, association and peering flags. Include a recovery action for loss of an approved dynamic route, rather than limiting rollback criteria to internet reachability.</p>\n<h2>Verification</h2>\n<p>Compare effective routes before and after an approved test change. Check representative Route Server-learned destinations separately from local and static-route destinations. Record next hops and application outcomes together. If a dynamic route disappears, verify the propagation and peering settings before changing the appliance&#8217;s BGP advertisements.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/route-server/route-injection-in-spokes\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Route injection in spoke virtual networks</a>.</p>",
        "content_text": "Source facts\nMicrosoft’s Route Server spoke-injection guidance warns that disabling Propagate gateway routes also stops spoke subnets from learning Route Server routes dynamically. For the documented hub-hosted Route Server pattern, spoke peering must use the remote gateway or Route Server. The document distinguishes that arrangement from a dual-homed design where the spoke has its own Route Server. Microsoft Learn.\nApplicability\nUse this check before changing a spoke subnet’s route table. Identify where Route Server actually runs, which networks peer with it, and which application destinations rely on its learned routes. Do not infer route dependencies from the setting’s gateway-oriented name.\nDSE recommendation\nDSE recommends listing the dynamic prefixes expected to remain available before changing propagation. Have the routing owner compare the planned setting with the actual topology and any replacement routes. Preserve the current table, association and peering flags. Include a recovery action for loss of an approved dynamic route, rather than limiting rollback criteria to internet reachability.\nVerification\nCompare effective routes before and after an approved test change. Check representative Route Server-learned destinations separately from local and static-route destinations. Record next hops and application outcomes together. If a dynamic route disappears, verify the propagation and peering settings before changing the appliance’s BGP advertisements.\nOfficial references\nMicrosoft Learn: Route injection in spoke virtual networks.",
        "content_markdown": "## Source facts\n\nMicrosoft’s Route Server spoke-injection guidance warns that disabling Propagate gateway routes also stops spoke subnets from learning Route Server routes dynamically. For the documented hub-hosted Route Server pattern, spoke peering must use the remote gateway or Route Server. The document distinguishes that arrangement from a dual-homed design where the spoke has its own Route Server. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/route-server/route-injection-in-spokes).\n\n## Applicability\n\nUse this check before changing a spoke subnet’s route table. Identify where Route Server actually runs, which networks peer with it, and which application destinations rely on its learned routes. Do not infer route dependencies from the setting’s gateway-oriented name.\n\n## DSE recommendation\n\nDSE recommends listing the dynamic prefixes expected to remain available before changing propagation. Have the routing owner compare the planned setting with the actual topology and any replacement routes. Preserve the current table, association and peering flags. Include a recovery action for loss of an approved dynamic route, rather than limiting rollback criteria to internet reachability.\n\n## Verification\n\nCompare effective routes before and after an approved test change. Check representative Route Server-learned destinations separately from local and static-route destinations. Record next hops and application outcomes together. If a dynamic route disappears, verify the propagation and peering settings before changing the appliance’s BGP advertisements.\n\n## Official references\n\n[Microsoft Learn: Route injection in spoke virtual networks](https://learn.microsoft.com/en-us/azure/route-server/route-injection-in-spokes)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Account for Route Server when disabling gateway-route propagation on a spoke",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/",
                "headline": "Account for Route Server when disabling gateway-route propagation on a spoke",
                "description": "Review the dynamic routes affected by a subnet route-table setting.",
                "abstract": "Review the dynamic routes affected by a subnet route-table setting.",
                "articleBody": "Source facts\nMicrosoft’s Route Server spoke-injection guidance warns that disabling Propagate gateway routes also stops spoke subnets from learning Route Server routes dynamically. For the documented hub-hosted Route Server pattern, spoke peering must use the remote gateway or Route Server. The document distinguishes that arrangement from a dual-homed design where the spoke has its own Route Server. Microsoft Learn.\nApplicability\nUse this check before changing a spoke subnet’s route table. Identify where Route Server actually runs, which networks peer with it, and which application destinations rely on its learned routes. Do not infer route dependencies from the setting’s gateway-oriented name.\nDSE recommendation\nDSE recommends listing the dynamic prefixes expected to remain available before changing propagation. Have the routing owner compare the planned setting with the actual topology and any replacement routes. Preserve the current table, association and peering flags. Include a recovery action for loss of an approved dynamic route, rather than limiting rollback criteria to internet reachability.\nVerification\nCompare effective routes before and after an approved test change. Check representative Route Server-learned destinations separately from local and static-route destinations. Record next hops and application outcomes together. If a dynamic route disappears, verify the propagation and peering settings before changing the appliance’s BGP advertisements.\nOfficial references\nMicrosoft Learn: Route injection in spoke virtual networks.",
                "datePublished": "2026-09-17T16:33:48+00:00",
                "dateModified": "2026-09-17T16:38:45+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-072-account-for-route-server-when-disabling-gateway-route-propagation-on-a-spoke/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Account for Route Server when disabling gateway-route propagation on a spoke"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 214,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Route injection in spoke virtual networks - Azure Route Server | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/route-server/route-injection-in-spokes"
                }
            }
        ]
    }
}