{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/", "slug": "dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path", "url": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/" }, "title": "Check next-hop selection before troubleshooting the appliance application path", "summary": "Use the selected route to identify where a VM's traffic is being sent.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:17+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 218, "potentially_affected": "Apply the diagnostic approach to an approved VM-to-destination investigation. Identify the actual source interface and destination address, and compare them with the intended routing design. Do not reproduce the tutorial's intentionally broken route on a production subnet.", "dse_recommendation": "DSE recommends capturing route-selection evidence before editing an appliance or application.", "primary_source": { "name": "Tutorial: Diagnose a VM Network Routing Problem - Azure Portal - Azure Network Watcher | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-vm-network-routing-problem", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s routing tutorial uses Network Watcher next hop to report the selected next-hop type, address and route-table identifier. Its example deliberately sends traffic to an appliance VM that has not been configured to forward it, causing the application request to fail. The route-selection result and the appliance’s forwarding capability are therefore separate observations in the tutorial. Microsoft Learn.

\n

Applicability

\n

Apply the diagnostic approach to an approved VM-to-destination investigation. Identify the actual source interface and destination address, and compare them with the intended routing design. Do not reproduce the tutorial’s intentionally broken route on a production subnet.

\n

DSE recommendation

\n

DSE recommends capturing route-selection evidence before editing an appliance or application. Ask the network owner whether the observed next hop is intentional. If it is, investigate forwarding and subsequent policy at that appliance; if it is not, review the route and subnet association. Keep each proposed correction scoped to the observed fault.

\n

Verification

\n

Run next hop for the exact source and destination, inspect the relevant effective route, and correlate the result with an authorized connectivity test. After a correction, repeat the same observations. Record the selected route and the application outcome separately so a correct route alone is not mistaken for successful end-to-end communication.

\n

Official references

\n

Microsoft Learn: Tutorial: Diagnose a VM Network Routing Problem – Azure Portal.

", "content_text": "Source facts\nMicrosoft’s routing tutorial uses Network Watcher next hop to report the selected next-hop type, address and route-table identifier. Its example deliberately sends traffic to an appliance VM that has not been configured to forward it, causing the application request to fail. The route-selection result and the appliance’s forwarding capability are therefore separate observations in the tutorial. Microsoft Learn.\nApplicability\nApply the diagnostic approach to an approved VM-to-destination investigation. Identify the actual source interface and destination address, and compare them with the intended routing design. Do not reproduce the tutorial’s intentionally broken route on a production subnet.\nDSE recommendation\nDSE recommends capturing route-selection evidence before editing an appliance or application. Ask the network owner whether the observed next hop is intentional. If it is, investigate forwarding and subsequent policy at that appliance; if it is not, review the route and subnet association. Keep each proposed correction scoped to the observed fault.\nVerification\nRun next hop for the exact source and destination, inspect the relevant effective route, and correlate the result with an authorized connectivity test. After a correction, repeat the same observations. Record the selected route and the application outcome separately so a correct route alone is not mistaken for successful end-to-end communication.\nOfficial references\nMicrosoft Learn: Tutorial: Diagnose a VM Network Routing Problem – Azure Portal.", "content_markdown": "## Source facts\n\nMicrosoft’s routing tutorial uses Network Watcher next hop to report the selected next-hop type, address and route-table identifier. Its example deliberately sends traffic to an appliance VM that has not been configured to forward it, causing the application request to fail. The route-selection result and the appliance’s forwarding capability are therefore separate observations in the tutorial. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-vm-network-routing-problem).\n\n## Applicability\n\nApply the diagnostic approach to an approved VM-to-destination investigation. Identify the actual source interface and destination address, and compare them with the intended routing design. Do not reproduce the tutorial’s intentionally broken route on a production subnet.\n\n## DSE recommendation\n\nDSE recommends capturing route-selection evidence before editing an appliance or application. Ask the network owner whether the observed next hop is intentional. If it is, investigate forwarding and subsequent policy at that appliance; if it is not, review the route and subnet association. Keep each proposed correction scoped to the observed fault.\n\n## Verification\n\nRun next hop for the exact source and destination, inspect the relevant effective route, and correlate the result with an authorized connectivity test. After a correction, repeat the same observations. Record the selected route and the application outcome separately so a correct route alone is not mistaken for successful end-to-end communication.\n\n## Official references\n\n[Microsoft Learn: Tutorial: Diagnose a VM Network Routing Problem – Azure Portal](https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-vm-network-routing-problem)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/", "url": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check next-hop selection before troubleshooting the appliance application path", "item": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/", "url": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/", "headline": "Check next-hop selection before troubleshooting the appliance application path", "description": "Use the selected route to identify where a VM's traffic is being sent.", "abstract": "Use the selected route to identify where a VM's traffic is being sent.", "articleBody": "Source facts\nMicrosoft’s routing tutorial uses Network Watcher next hop to report the selected next-hop type, address and route-table identifier. Its example deliberately sends traffic to an appliance VM that has not been configured to forward it, causing the application request to fail. The route-selection result and the appliance’s forwarding capability are therefore separate observations in the tutorial. Microsoft Learn.\nApplicability\nApply the diagnostic approach to an approved VM-to-destination investigation. Identify the actual source interface and destination address, and compare them with the intended routing design. Do not reproduce the tutorial’s intentionally broken route on a production subnet.\nDSE recommendation\nDSE recommends capturing route-selection evidence before editing an appliance or application. Ask the network owner whether the observed next hop is intentional. If it is, investigate forwarding and subsequent policy at that appliance; if it is not, review the route and subnet association. Keep each proposed correction scoped to the observed fault.\nVerification\nRun next hop for the exact source and destination, inspect the relevant effective route, and correlate the result with an authorized connectivity test. After a correction, repeat the same observations. Record the selected route and the application outcome separately so a correct route alone is not mistaken for successful end-to-end communication.\nOfficial references\nMicrosoft Learn: Tutorial: Diagnose a VM Network Routing Problem – Azure Portal.", "datePublished": "2026-09-17T16:33:17+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check next-hop selection before troubleshooting the appliance application path" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 218, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Tutorial: Diagnose a VM Network Routing Problem - Azure Portal - Azure Network Watcher | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-vm-network-routing-problem" } } ] } }