{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/", "slug": "dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute", "url": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/" }, "title": "State the traffic selectors when documenting IPsec over ExpressRoute", "summary": "A host policy example does not establish that every flow on a circuit is encrypted.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:26+00:00", "modified_at": "2026-09-17T16:38:46+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 211, "potentially_affected": "Consider this review for a host-based IPsec design over ExpressRoute private peering. Identify the participating Windows hosts, organizational-unit scope, policy assignment and application traffic. Confirm the complete source prerequisites before applying any example configuration.", "dse_recommendation": "DSE recommends documenting the protected source, destination, protocol and port together with the policy owner.", "primary_source": { "name": "Azure ExpressRoute private peering: Configure IPsec transport mode - Windows hosts | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-ipsec-transport-private-windows", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Windows transport-mode example applies IPsec through Group Policy to selected Azure and on-premises hosts. Its illustrated policy targets HTTP traffic with destination port 8080. The source describes filters based on address ranges, protocols and ports, so the example’s protection claim is tied to the selected traffic rather than every flow using ExpressRoute. Microsoft Learn.

\n

Applicability

\n

Consider this review for a host-based IPsec design over ExpressRoute private peering. Identify the participating Windows hosts, organizational-unit scope, policy assignment and application traffic. Confirm the complete source prerequisites before applying any example configuration.

\n

DSE recommendation

\n

DSE recommends documenting the protected source, destination, protocol and port together with the policy owner. Replace example selectors with approved application requirements and review excluded traffic explicitly. Keep a separate statement of what has not been evaluated. Plan the Group Policy rollout and recovery path around the actual hosts affected by the change.

\n

Verification

\n

During an authorized test, inspect policy application and observe the intended traffic using the source’s encryption-verification approach. Include a control flow outside the selected scope to confirm the test distinguishes covered from unreviewed traffic. Retain sanitized selector and observation evidence, without claiming circuit-wide encryption from one successful application transaction.

\n

Official references

\n

Microsoft Learn: Azure ExpressRoute private peering: Configure IPsec transport mode – Windows hosts.

", "content_text": "Source facts\nMicrosoft’s Windows transport-mode example applies IPsec through Group Policy to selected Azure and on-premises hosts. Its illustrated policy targets HTTP traffic with destination port 8080. The source describes filters based on address ranges, protocols and ports, so the example’s protection claim is tied to the selected traffic rather than every flow using ExpressRoute. Microsoft Learn.\nApplicability\nConsider this review for a host-based IPsec design over ExpressRoute private peering. Identify the participating Windows hosts, organizational-unit scope, policy assignment and application traffic. Confirm the complete source prerequisites before applying any example configuration.\nDSE recommendation\nDSE recommends documenting the protected source, destination, protocol and port together with the policy owner. Replace example selectors with approved application requirements and review excluded traffic explicitly. Keep a separate statement of what has not been evaluated. Plan the Group Policy rollout and recovery path around the actual hosts affected by the change.\nVerification\nDuring an authorized test, inspect policy application and observe the intended traffic using the source’s encryption-verification approach. Include a control flow outside the selected scope to confirm the test distinguishes covered from unreviewed traffic. Retain sanitized selector and observation evidence, without claiming circuit-wide encryption from one successful application transaction.\nOfficial references\nMicrosoft Learn: Azure ExpressRoute private peering: Configure IPsec transport mode – Windows hosts.", "content_markdown": "## Source facts\n\nMicrosoft’s Windows transport-mode example applies IPsec through Group Policy to selected Azure and on-premises hosts. Its illustrated policy targets HTTP traffic with destination port 8080. The source describes filters based on address ranges, protocols and ports, so the example’s protection claim is tied to the selected traffic rather than every flow using ExpressRoute. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-ipsec-transport-private-windows).\n\n## Applicability\n\nConsider this review for a host-based IPsec design over ExpressRoute private peering. Identify the participating Windows hosts, organizational-unit scope, policy assignment and application traffic. Confirm the complete source prerequisites before applying any example configuration.\n\n## DSE recommendation\n\nDSE recommends documenting the protected source, destination, protocol and port together with the policy owner. Replace example selectors with approved application requirements and review excluded traffic explicitly. Keep a separate statement of what has not been evaluated. Plan the Group Policy rollout and recovery path around the actual hosts affected by the change.\n\n## Verification\n\nDuring an authorized test, inspect policy application and observe the intended traffic using the source’s encryption-verification approach. Include a control flow outside the selected scope to confirm the test distinguishes covered from unreviewed traffic. Retain sanitized selector and observation evidence, without claiming circuit-wide encryption from one successful application transaction.\n\n## Official references\n\n[Microsoft Learn: Azure ExpressRoute private peering: Configure IPsec transport mode – Windows hosts](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-ipsec-transport-private-windows)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/", "url": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "State the traffic selectors when documenting IPsec over ExpressRoute", "item": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/", "url": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/", "headline": "State the traffic selectors when documenting IPsec over ExpressRoute", "description": "A host policy example does not establish that every flow on a circuit is encrypted.", "abstract": "A host policy example does not establish that every flow on a circuit is encrypted.", "articleBody": "Source facts\nMicrosoft’s Windows transport-mode example applies IPsec through Group Policy to selected Azure and on-premises hosts. Its illustrated policy targets HTTP traffic with destination port 8080. The source describes filters based on address ranges, protocols and ports, so the example’s protection claim is tied to the selected traffic rather than every flow using ExpressRoute. Microsoft Learn.\nApplicability\nConsider this review for a host-based IPsec design over ExpressRoute private peering. Identify the participating Windows hosts, organizational-unit scope, policy assignment and application traffic. Confirm the complete source prerequisites before applying any example configuration.\nDSE recommendation\nDSE recommends documenting the protected source, destination, protocol and port together with the policy owner. Replace example selectors with approved application requirements and review excluded traffic explicitly. Keep a separate statement of what has not been evaluated. Plan the Group Policy rollout and recovery path around the actual hosts affected by the change.\nVerification\nDuring an authorized test, inspect policy application and observe the intended traffic using the source’s encryption-verification approach. Include a control flow outside the selected scope to confirm the test distinguishes covered from unreviewed traffic. Retain sanitized selector and observation evidence, without claiming circuit-wide encryption from one successful application transaction.\nOfficial references\nMicrosoft Learn: Azure ExpressRoute private peering: Configure IPsec transport mode – Windows hosts.", "datePublished": "2026-09-17T16:33:26+00:00", "dateModified": "2026-09-17T16:38:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "State the traffic selectors when documenting IPsec over ExpressRoute" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 211, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure ExpressRoute private peering: Configure IPsec transport mode - Windows hosts | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-ipsec-transport-private-windows" } } ] } }