Review the routing implications of extending an on-premises subnet into Azure

Source facts

Microsoft describes extending an on-premises subnet so migrated VMs can retain their existing private IP addresses. The documented feature supports extending up to 250 addresses and presents throughput as dependent on appliance CPU performance. Where a firewall lies between the sites, the source requires consideration of asymmetric routing and directs administrators to the firewall vendor’s instructions. Microsoft Learn.

Applicability

Identify the exact address-retention requirement and compare it with an ordinary routed migration. Review appliance placement, subnet planning, and current capacity guidance before selecting the extension. Treat firewall behavior as part of the design rather than a last-minute connectivity exception.

DSE recommendation

Have the network and application owners map the intended traffic paths and list which VMs genuinely need their current addresses. Ask the firewall owner to assess the documented asymmetric-routing requirement and any implications for the existing controls. Pilot a small address set with agreed throughput and recovery expectations. Preserve the original route and security configuration before introducing the appliances.

Verification

Move an approved test workload and confirm its intended address, application reachability, and observed traffic path. Test representative return traffic and the agreed interruption scenario. Measure actual appliance behavior under the pilot load rather than treating an example throughput as a guarantee. Resolve routing or control gaps before extending additional addresses.

Official references

Microsoft Learn: Extend your on-premises subnets into Azure using extended network for Azure. Source reviewed September 8, 2026.