Do not assume Route Server VPN preference excludes NVA routes

Source facts

Azure Route Server’s VPN preference prioritizes routes from VPN gateways and NVAs over ExpressRoute routes. It does not distinguish the VPN gateway from the NVA: when both advertise the same route, the shorter BGP AS path is selected.

ExpressRoute preference is the default and prioritizes ExpressRoute routes. AS Path preference instead compares path length regardless of the route’s source. Microsoft Learn.

Applicability

Inventory advertisements for the same destination prefix from each participating source. Do not infer the selected next hop solely from the preference label or from one peer’s established session.

DSE recommendation

DSE recommends documenting the desired primary and fallback route for each important prefix before changing preference. Compare actual VPN and NVA AS paths and coordinate any approved path manipulation with their owners. Avoid a broad preference change intended to fix one prefix without reviewing other overlapping advertisements.

Verification

Inspect learned and selected routes for representative prefixes, then exercise approved failure and recovery scenarios. Confirm the actual next hop matches the intended design while the relevant peers are available and after restoration. Retain advertisements, preference and traffic observations together. An established VPN session is not sufficient evidence that its route wins over an NVA.

Official references

Microsoft Learn: Routing preference with Azure Route Server. Source retrieved September 9, 2026.