Check Azure UDR next-hop reachability before routing through an appliance

Source facts

Microsoft advises placing a virtual appliance in a different subnet from the resources routed through it. Applying a route back through an appliance in the same subnet can create a loop that prevents traffic from leaving.

The next-hop private address must be directly reachable; a path that first traverses ExpressRoute or Virtual WAN does not satisfy this requirement. Microsoft describes such an indirect next hop as an invalid UDR configuration. Microsoft Learn.

Applicability

Identify the workload subnet, associated route table, destination prefix, appliance subnet, and proposed next-hop address. Review the actual Azure topology rather than treating a reachable address from an administrator’s device as sufficient evidence.

DSE recommendation

DSE recommends drawing the first hop and return path before changing subnet routing. Have the network owner identify any same-subnet loop or gateway dependency explicitly. Preserve the previous route association and define the traffic that must remain available during the change, including appliance management access.

Verification

On an approved test subnet, inspect effective routes and exercise the intended application flow in both directions. Confirm that the observed next hop matches the reviewed topology. Include an excluded destination and investigate looping or unexpected detours before applying the table to additional workloads.

Official references

Microsoft Learn: Azure virtual network traffic routing. Source retrieved September 9, 2026.