{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/", "slug": "dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design", "url": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/" }, "title": "Keep ExpressRoute circuit-to-circuit transit out of a Route Server design", "summary": "Check the documented route-exchange boundary before expecting two circuits to communicate.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:46+00:00", "modified_at": "2026-09-17T16:46:30+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 207, "potentially_affected": "Apply this boundary when designing transit between locations attached through separate ExpressRoute circuits. Identify each circuit, gateway and required destination. Do not infer circuit-to-circuit support from Route Server's documented exchange with VPN gateways or NVAs.", "dse_recommendation": "DSE recommends marking the required transit path explicitly in the architecture before enabling route exchange.", "primary_source": { "name": "Azure Route Server support for ExpressRoute and Azure VPN - Azure Route Server | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/route-server/expressroute-vpn-support", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft explicitly excludes ExpressRoute circuit-to-circuit connectivity through Azure Route Server. Routes from one circuit are not advertised to another circuit connected to the same virtual network gateway. The guidance points to ExpressRoute Global Reach for consideration when ExpressRoute-to-ExpressRoute connectivity is required. Microsoft Learn.

\n

Applicability

\n

Apply this boundary when designing transit between locations attached through separate ExpressRoute circuits. Identify each circuit, gateway and required destination. Do not infer circuit-to-circuit support from Route Server’s documented exchange with VPN gateways or NVAs.

\n

DSE recommendation

\n

DSE recommends marking the required transit path explicitly in the architecture before enabling route exchange. If the requirement crosses the excluded boundary, have the network owner assess an appropriate alternative and its own prerequisites. Keep that assessment separate from granting more permissions or changing BGP filters on a design that does not support the intended exchange.

\n

Verification

\n

Review the actual topology and advertised routes against the chosen design. Test the approved transit path only after its prerequisites and routing controls are established. Preserve the path identity and application observations in the acceptance record. If expected prefixes are absent, check the documented boundary before treating their absence as a Route Server malfunction.

\n

Official references

\n

Microsoft Learn: Azure Route Server support for ExpressRoute and Azure VPN.

", "content_text": "Source facts\nMicrosoft explicitly excludes ExpressRoute circuit-to-circuit connectivity through Azure Route Server. Routes from one circuit are not advertised to another circuit connected to the same virtual network gateway. The guidance points to ExpressRoute Global Reach for consideration when ExpressRoute-to-ExpressRoute connectivity is required. Microsoft Learn.\nApplicability\nApply this boundary when designing transit between locations attached through separate ExpressRoute circuits. Identify each circuit, gateway and required destination. Do not infer circuit-to-circuit support from Route Server’s documented exchange with VPN gateways or NVAs.\nDSE recommendation\nDSE recommends marking the required transit path explicitly in the architecture before enabling route exchange. If the requirement crosses the excluded boundary, have the network owner assess an appropriate alternative and its own prerequisites. Keep that assessment separate from granting more permissions or changing BGP filters on a design that does not support the intended exchange.\nVerification\nReview the actual topology and advertised routes against the chosen design. Test the approved transit path only after its prerequisites and routing controls are established. Preserve the path identity and application observations in the acceptance record. If expected prefixes are absent, check the documented boundary before treating their absence as a Route Server malfunction.\nOfficial references\nMicrosoft Learn: Azure Route Server support for ExpressRoute and Azure VPN.", "content_markdown": "## Source facts\n\nMicrosoft explicitly excludes ExpressRoute circuit-to-circuit connectivity through Azure Route Server. Routes from one circuit are not advertised to another circuit connected to the same virtual network gateway. The guidance points to ExpressRoute Global Reach for consideration when ExpressRoute-to-ExpressRoute connectivity is required. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/route-server/expressroute-vpn-support).\n\n## Applicability\n\nApply this boundary when designing transit between locations attached through separate ExpressRoute circuits. Identify each circuit, gateway and required destination. Do not infer circuit-to-circuit support from Route Server’s documented exchange with VPN gateways or NVAs.\n\n## DSE recommendation\n\nDSE recommends marking the required transit path explicitly in the architecture before enabling route exchange. If the requirement crosses the excluded boundary, have the network owner assess an appropriate alternative and its own prerequisites. Keep that assessment separate from granting more permissions or changing BGP filters on a design that does not support the intended exchange.\n\n## Verification\n\nReview the actual topology and advertised routes against the chosen design. Test the approved transit path only after its prerequisites and routing controls are established. Preserve the path identity and application observations in the acceptance record. If expected prefixes are absent, check the documented boundary before treating their absence as a Route Server malfunction.\n\n## Official references\n\n[Microsoft Learn: Azure Route Server support for ExpressRoute and Azure VPN](https://learn.microsoft.com/en-us/azure/route-server/expressroute-vpn-support)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/", "url": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep ExpressRoute circuit-to-circuit transit out of a Route Server design", "item": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/", "url": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/", "headline": "Keep ExpressRoute circuit-to-circuit transit out of a Route Server design", "description": "Check the documented route-exchange boundary before expecting two circuits to communicate.", "abstract": "Check the documented route-exchange boundary before expecting two circuits to communicate.", "articleBody": "Source facts\nMicrosoft explicitly excludes ExpressRoute circuit-to-circuit connectivity through Azure Route Server. Routes from one circuit are not advertised to another circuit connected to the same virtual network gateway. The guidance points to ExpressRoute Global Reach for consideration when ExpressRoute-to-ExpressRoute connectivity is required. Microsoft Learn.\nApplicability\nApply this boundary when designing transit between locations attached through separate ExpressRoute circuits. Identify each circuit, gateway and required destination. Do not infer circuit-to-circuit support from Route Server’s documented exchange with VPN gateways or NVAs.\nDSE recommendation\nDSE recommends marking the required transit path explicitly in the architecture before enabling route exchange. If the requirement crosses the excluded boundary, have the network owner assess an appropriate alternative and its own prerequisites. Keep that assessment separate from granting more permissions or changing BGP filters on a design that does not support the intended exchange.\nVerification\nReview the actual topology and advertised routes against the chosen design. Test the approved transit path only after its prerequisites and routing controls are established. Preserve the path identity and application observations in the acceptance record. If expected prefixes are absent, check the documented boundary before treating their absence as a Route Server malfunction.\nOfficial references\nMicrosoft Learn: Azure Route Server support for ExpressRoute and Azure VPN.", "datePublished": "2026-09-17T16:31:46+00:00", "dateModified": "2026-09-17T16:46:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-194-keep-expressroute-circuit-to-circuit-transit-out-of-a-route-server-design/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep ExpressRoute circuit-to-circuit transit out of a Route Server design" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 207, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Route Server support for ExpressRoute and Azure VPN - Azure Route Server | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/route-server/expressroute-vpn-support" } } ] } }