{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/", "slug": "dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route", "url": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/" }, "title": "Complete the rule and circuit association when creating an ExpressRoute route filter", "summary": "A route-filter resource alone does not express the intended service-prefix selection.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:01+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 214, "potentially_affected": "Apply this check when provisioning or changing Microsoft-peering service selection. Identify the intended services, current community values, peering configuration and circuit. Keep the review separate from private-peering application routes and from rules on a network firewall.", "dse_recommendation": "DSE recommends recording the filter resource, Allow rule, community list and circuit association as separate acceptance items.", "primary_source": { "name": "Configure route filters for Microsoft peering | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/expressroute/how-to-routefilter-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft describes a Microsoft-peering route filter as an allowlist of service BGP community values. A filter supports one Allow rule containing the selected values. Its CLI guidance notes that creating the route-filter resource does not create that rule; the rule must be added, and the configured filter attached to the circuit for the selected service prefixes to be advertised. Microsoft Learn.

\n

Applicability

\n

Apply this check when provisioning or changing Microsoft-peering service selection. Identify the intended services, current community values, peering configuration and circuit. Keep the review separate from private-peering application routes and from rules on a network firewall.

\n

DSE recommendation

\n

DSE recommends recording the filter resource, Allow rule, community list and circuit association as separate acceptance items. Have the routing owner confirm the list matches the approved service scope. Preserve the old association before a change and avoid treating an empty resource creation response as completed service connectivity.

\n

Verification

\n

Inspect the deployed rule and circuit attachment, then compare received prefixes with the intended services. Exercise a permitted representative service path and retain the observed routes. Review unexpected missing or additional advertisements before changing unrelated client settings. Record the exact filter association so later circuit work does not silently replace the approved selection.

\n

Official references

\n

Microsoft Learn: Configure route filters for Microsoft peering.

", "content_text": "Source facts\nMicrosoft describes a Microsoft-peering route filter as an allowlist of service BGP community values. A filter supports one Allow rule containing the selected values. Its CLI guidance notes that creating the route-filter resource does not create that rule; the rule must be added, and the configured filter attached to the circuit for the selected service prefixes to be advertised. Microsoft Learn.\nApplicability\nApply this check when provisioning or changing Microsoft-peering service selection. Identify the intended services, current community values, peering configuration and circuit. Keep the review separate from private-peering application routes and from rules on a network firewall.\nDSE recommendation\nDSE recommends recording the filter resource, Allow rule, community list and circuit association as separate acceptance items. Have the routing owner confirm the list matches the approved service scope. Preserve the old association before a change and avoid treating an empty resource creation response as completed service connectivity.\nVerification\nInspect the deployed rule and circuit attachment, then compare received prefixes with the intended services. Exercise a permitted representative service path and retain the observed routes. Review unexpected missing or additional advertisements before changing unrelated client settings. Record the exact filter association so later circuit work does not silently replace the approved selection.\nOfficial references\nMicrosoft Learn: Configure route filters for Microsoft peering.", "content_markdown": "## Source facts\n\nMicrosoft describes a Microsoft-peering route filter as an allowlist of service BGP community values. A filter supports one Allow rule containing the selected values. Its CLI guidance notes that creating the route-filter resource does not create that rule; the rule must be added, and the configured filter attached to the circuit for the selected service prefixes to be advertised. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/expressroute/how-to-routefilter-portal).\n\n## Applicability\n\nApply this check when provisioning or changing Microsoft-peering service selection. Identify the intended services, current community values, peering configuration and circuit. Keep the review separate from private-peering application routes and from rules on a network firewall.\n\n## DSE recommendation\n\nDSE recommends recording the filter resource, Allow rule, community list and circuit association as separate acceptance items. Have the routing owner confirm the list matches the approved service scope. Preserve the old association before a change and avoid treating an empty resource creation response as completed service connectivity.\n\n## Verification\n\nInspect the deployed rule and circuit attachment, then compare received prefixes with the intended services. Exercise a permitted representative service path and retain the observed routes. Review unexpected missing or additional advertisements before changing unrelated client settings. Record the exact filter association so later circuit work does not silently replace the approved selection.\n\n## Official references\n\n[Microsoft Learn: Configure route filters for Microsoft peering](https://learn.microsoft.com/en-us/azure/expressroute/how-to-routefilter-portal)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/", "url": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Complete the rule and circuit association when creating an ExpressRoute route filter", "item": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/", "url": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/", "headline": "Complete the rule and circuit association when creating an ExpressRoute route filter", "description": "A route-filter resource alone does not express the intended service-prefix selection.", "abstract": "A route-filter resource alone does not express the intended service-prefix selection.", "articleBody": "Source facts\nMicrosoft describes a Microsoft-peering route filter as an allowlist of service BGP community values. A filter supports one Allow rule containing the selected values. Its CLI guidance notes that creating the route-filter resource does not create that rule; the rule must be added, and the configured filter attached to the circuit for the selected service prefixes to be advertised. Microsoft Learn.\nApplicability\nApply this check when provisioning or changing Microsoft-peering service selection. Identify the intended services, current community values, peering configuration and circuit. Keep the review separate from private-peering application routes and from rules on a network firewall.\nDSE recommendation\nDSE recommends recording the filter resource, Allow rule, community list and circuit association as separate acceptance items. Have the routing owner confirm the list matches the approved service scope. Preserve the old association before a change and avoid treating an empty resource creation response as completed service connectivity.\nVerification\nInspect the deployed rule and circuit attachment, then compare received prefixes with the intended services. Exercise a permitted representative service path and retain the observed routes. Review unexpected missing or additional advertisements before changing unrelated client settings. Record the exact filter association so later circuit work does not silently replace the approved selection.\nOfficial references\nMicrosoft Learn: Configure route filters for Microsoft peering.", "datePublished": "2026-09-17T16:32:01+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-179-complete-the-rule-and-circuit-association-when-creating-an-expressroute-route/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Complete the rule and circuit association when creating an ExpressRoute route filter" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 214, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure route filters for Microsoft peering | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/expressroute/how-to-routefilter-portal" } } ] } }