{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/", "slug": "dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight", "url": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/" }, "title": "Check prefix specificity before raising an ExpressRoute connection weight", "summary": "A weight comparison should account for the actual prefixes advertised over each circuit.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:02+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 209, "potentially_affected": "Apply this check when the observed Azure-to-on-premises path differs from an intended circuit preference. List the actual prefix lengths and advertisements on every relevant circuit before comparing connection weights.", "dse_recommendation": "DSE recommends explaining the current route choice from the complete prefix set before adjusting weight.", "primary_source": { "name": "Azure ExpressRoute: Designing for disaster recovery | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft lists more-specific route advertisement ahead of connection weight and AS-path prepending when describing ExpressRoute path-selection influence. Its example advertises two /25 prefixes over the preferred circuit and the covering /24 over standby. The more-specific path carries traffic normally; the /24 standby is used when both preferred-circuit connections fail. The guide describes highest connection weight as the preference when the same prefix arrives over multiple circuits. Microsoft Learn.

\n

Applicability

\n

Apply this check when the observed Azure-to-on-premises path differs from an intended circuit preference. List the actual prefix lengths and advertisements on every relevant circuit before comparing connection weights.

\n

DSE recommendation

\n

DSE recommends explaining the current route choice from the complete prefix set before adjusting weight. Identify whether the competing advertisements represent the same prefix or overlapping ranges. Have the routing owner approve any revised advertisement and preserve the prior configuration, including the intended standby coverage.

\n

Verification

\n

Inspect the selected route for representative destinations inside each relevant range. In an approved maintenance test, confirm the expected selection with the preferred path available and under the planned failure condition. Record both the advertised prefixes and selected circuit so the result can be reproduced without assuming the highest displayed weight controls every destination.

\n

Official references

\n

Microsoft Learn: Azure ExpressRoute: Designing for disaster recovery.

", "content_text": "Source facts\nMicrosoft lists more-specific route advertisement ahead of connection weight and AS-path prepending when describing ExpressRoute path-selection influence. Its example advertises two /25 prefixes over the preferred circuit and the covering /24 over standby. The more-specific path carries traffic normally; the /24 standby is used when both preferred-circuit connections fail. The guide describes highest connection weight as the preference when the same prefix arrives over multiple circuits. Microsoft Learn.\nApplicability\nApply this check when the observed Azure-to-on-premises path differs from an intended circuit preference. List the actual prefix lengths and advertisements on every relevant circuit before comparing connection weights.\nDSE recommendation\nDSE recommends explaining the current route choice from the complete prefix set before adjusting weight. Identify whether the competing advertisements represent the same prefix or overlapping ranges. Have the routing owner approve any revised advertisement and preserve the prior configuration, including the intended standby coverage.\nVerification\nInspect the selected route for representative destinations inside each relevant range. In an approved maintenance test, confirm the expected selection with the preferred path available and under the planned failure condition. Record both the advertised prefixes and selected circuit so the result can be reproduced without assuming the highest displayed weight controls every destination.\nOfficial references\nMicrosoft Learn: Azure ExpressRoute: Designing for disaster recovery.", "content_markdown": "## Source facts\n\nMicrosoft lists more-specific route advertisement ahead of connection weight and AS-path prepending when describing ExpressRoute path-selection influence. Its example advertises two /25 prefixes over the preferred circuit and the covering /24 over standby. The more-specific path carries traffic normally; the /24 standby is used when both preferred-circuit connections fail. The guide describes highest connection weight as the preference when the same prefix arrives over multiple circuits. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering).\n\n## Applicability\n\nApply this check when the observed Azure-to-on-premises path differs from an intended circuit preference. List the actual prefix lengths and advertisements on every relevant circuit before comparing connection weights.\n\n## DSE recommendation\n\nDSE recommends explaining the current route choice from the complete prefix set before adjusting weight. Identify whether the competing advertisements represent the same prefix or overlapping ranges. Have the routing owner approve any revised advertisement and preserve the prior configuration, including the intended standby coverage.\n\n## Verification\n\nInspect the selected route for representative destinations inside each relevant range. In an approved maintenance test, confirm the expected selection with the preferred path available and under the planned failure condition. Record both the advertised prefixes and selected circuit so the result can be reproduced without assuming the highest displayed weight controls every destination.\n\n## Official references\n\n[Microsoft Learn: Azure ExpressRoute: Designing for disaster recovery](https://learn.microsoft.com/en-us/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/", "url": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check prefix specificity before raising an ExpressRoute connection weight", "item": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/", "url": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/", "headline": "Check prefix specificity before raising an ExpressRoute connection weight", "description": "A weight comparison should account for the actual prefixes advertised over each circuit.", "abstract": "A weight comparison should account for the actual prefixes advertised over each circuit.", "articleBody": "Source facts\nMicrosoft lists more-specific route advertisement ahead of connection weight and AS-path prepending when describing ExpressRoute path-selection influence. Its example advertises two /25 prefixes over the preferred circuit and the covering /24 over standby. The more-specific path carries traffic normally; the /24 standby is used when both preferred-circuit connections fail. The guide describes highest connection weight as the preference when the same prefix arrives over multiple circuits. Microsoft Learn.\nApplicability\nApply this check when the observed Azure-to-on-premises path differs from an intended circuit preference. List the actual prefix lengths and advertisements on every relevant circuit before comparing connection weights.\nDSE recommendation\nDSE recommends explaining the current route choice from the complete prefix set before adjusting weight. Identify whether the competing advertisements represent the same prefix or overlapping ranges. Have the routing owner approve any revised advertisement and preserve the prior configuration, including the intended standby coverage.\nVerification\nInspect the selected route for representative destinations inside each relevant range. In an approved maintenance test, confirm the expected selection with the preferred path available and under the planned failure condition. Record both the advertised prefixes and selected circuit so the result can be reproduced without assuming the highest displayed weight controls every destination.\nOfficial references\nMicrosoft Learn: Azure ExpressRoute: Designing for disaster recovery.", "datePublished": "2026-09-17T16:33:02+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-118-check-prefix-specificity-before-raising-an-expressroute-connection-weight/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check prefix specificity before raising an ExpressRoute connection weight" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 209, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure ExpressRoute: Designing for disaster recovery | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering" } } ] } }