{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/", "slug": "dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path", "url": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/" }, "title": "Keep Virtual WAN workload routes on the intended IPsec-over-ExpressRoute path", "summary": "Check route advertisements before claiming the workload uses the encrypted overlay.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:09+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 2, "word_count": 223, "potentially_affected": "Use this review for the documented Virtual WAN encrypted-overlay design. Identify tunnel endpoint reachability separately from workload prefixes, and record what is advertised through each connection. Keep the design distinct from Windows host-based transport-mode IPsec or the separate High Bandwidth gateway capability.", "dse_recommendation": "DSE recommends a two-part routing plan covering the VPN underlay and the workloads expected to use its overlay.", "primary_source": { "name": "Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Virtual WAN IPsec-over-ExpressRoute guide warns that when the same prefixes are advertised through ExpressRoute and VPN, Azure uses ExpressRoute directly without the VPN protection. The configuration’s Use Azure Private IP Address option puts the VPN connection on private gateway addresses over ExpressRoute private peering; it does not remove the need to review workload routing. Microsoft Learn.

\n

Applicability

\n

Use this review for the documented Virtual WAN encrypted-overlay design. Identify tunnel endpoint reachability separately from workload prefixes, and record what is advertised through each connection. Keep the design distinct from Windows host-based transport-mode IPsec or the separate High Bandwidth gateway capability.

\n

DSE recommendation

\n

DSE recommends a two-part routing plan covering the VPN underlay and the workloads expected to use its overlay. Have both network owners review duplicate advertisements before authorizing a change. Document the expected selected path and the evidence required to substantiate the encryption claim. Preserve the prior advertisements and an agreed recovery sequence.

\n

Verification

\n

Inspect learned and effective routes for representative workload destinations. Correlate an authorized application test with the intended VPN tunnel’s observations, and examine the reverse path as well. Record any direct ExpressRoute selection as an unresolved requirement. A healthy VPN tunnel by itself should not certify that the intended application traffic traverses it.

\n

Official references

\n

Microsoft Learn: Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN.

", "content_text": "Source facts\nMicrosoft’s Virtual WAN IPsec-over-ExpressRoute guide warns that when the same prefixes are advertised through ExpressRoute and VPN, Azure uses ExpressRoute directly without the VPN protection. The configuration’s Use Azure Private IP Address option puts the VPN connection on private gateway addresses over ExpressRoute private peering; it does not remove the need to review workload routing. Microsoft Learn.\nApplicability\nUse this review for the documented Virtual WAN encrypted-overlay design. Identify tunnel endpoint reachability separately from workload prefixes, and record what is advertised through each connection. Keep the design distinct from Windows host-based transport-mode IPsec or the separate High Bandwidth gateway capability.\nDSE recommendation\nDSE recommends a two-part routing plan covering the VPN underlay and the workloads expected to use its overlay. Have both network owners review duplicate advertisements before authorizing a change. Document the expected selected path and the evidence required to substantiate the encryption claim. Preserve the prior advertisements and an agreed recovery sequence.\nVerification\nInspect learned and effective routes for representative workload destinations. Correlate an authorized application test with the intended VPN tunnel’s observations, and examine the reverse path as well. Record any direct ExpressRoute selection as an unresolved requirement. A healthy VPN tunnel by itself should not certify that the intended application traffic traverses it.\nOfficial references\nMicrosoft Learn: Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN.", "content_markdown": "## Source facts\n\nMicrosoft’s Virtual WAN IPsec-over-ExpressRoute guide warns that when the same prefixes are advertised through ExpressRoute and VPN, Azure uses ExpressRoute directly without the VPN protection. The configuration’s Use Azure Private IP Address option puts the VPN connection on private gateway addresses over ExpressRoute private peering; it does not remove the need to review workload routing. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute).\n\n## Applicability\n\nUse this review for the documented Virtual WAN encrypted-overlay design. Identify tunnel endpoint reachability separately from workload prefixes, and record what is advertised through each connection. Keep the design distinct from Windows host-based transport-mode IPsec or the separate High Bandwidth gateway capability.\n\n## DSE recommendation\n\nDSE recommends a two-part routing plan covering the VPN underlay and the workloads expected to use its overlay. Have both network owners review duplicate advertisements before authorizing a change. Document the expected selected path and the evidence required to substantiate the encryption claim. Preserve the prior advertisements and an agreed recovery sequence.\n\n## Verification\n\nInspect learned and effective routes for representative workload destinations. Correlate an authorized application test with the intended VPN tunnel’s observations, and examine the reverse path as well. Record any direct ExpressRoute selection as an unresolved requirement. A healthy VPN tunnel by itself should not certify that the intended application traffic traverses it.\n\n## Official references\n\n[Microsoft Learn: Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN](https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/", "url": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep Virtual WAN workload routes on the intended IPsec-over-ExpressRoute path", "item": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/", "url": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/", "headline": "Keep Virtual WAN workload routes on the intended IPsec-over-ExpressRoute path", "description": "Check route advertisements before claiming the workload uses the encrypted overlay.", "abstract": "Check route advertisements before claiming the workload uses the encrypted overlay.", "articleBody": "Source facts\nMicrosoft’s Virtual WAN IPsec-over-ExpressRoute guide warns that when the same prefixes are advertised through ExpressRoute and VPN, Azure uses ExpressRoute directly without the VPN protection. The configuration’s Use Azure Private IP Address option puts the VPN connection on private gateway addresses over ExpressRoute private peering; it does not remove the need to review workload routing. Microsoft Learn.\nApplicability\nUse this review for the documented Virtual WAN encrypted-overlay design. Identify tunnel endpoint reachability separately from workload prefixes, and record what is advertised through each connection. Keep the design distinct from Windows host-based transport-mode IPsec or the separate High Bandwidth gateway capability.\nDSE recommendation\nDSE recommends a two-part routing plan covering the VPN underlay and the workloads expected to use its overlay. Have both network owners review duplicate advertisements before authorizing a change. Document the expected selected path and the evidence required to substantiate the encryption claim. Preserve the prior advertisements and an agreed recovery sequence.\nVerification\nInspect learned and effective routes for representative workload destinations. Correlate an authorized application test with the intended VPN tunnel’s observations, and examine the reverse path as well. Record any direct ExpressRoute selection as an unresolved requirement. A healthy VPN tunnel by itself should not certify that the intended application traffic traverses it.\nOfficial references\nMicrosoft Learn: Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN.", "datePublished": "2026-09-17T16:32:09+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep Virtual WAN workload routes on the intended IPsec-over-ExpressRoute path" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 223, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute" } } ] } }