# Separate ExpressRoute Microsoft-peering NAT advertisements from internet routes

> Review the public-prefix advertisements that can create asymmetric return paths.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-014-separate-expressroute-microsoft-peering-nat-advertisements-from-internet-routes/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:46+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Review the public-prefix advertisements that can create asymmetric return paths.

## Potentially affected

Apply this check to public NAT prefixes used with Microsoft peering. Identify the circuit, NAT devices, advertised prefix lengths and internet edge. Keep the review distinct from private-peering address allocation or a general circuit-redundancy assessment.

## DSE recommendation

DSE recommends a prefix worksheet showing each NAT range and every place it is advertised.

## Article

## Source facts

For ExpressRoute Microsoft peering, Microsoft warns against advertising an identical public route through both ExpressRoute and the internet. Its preferred arrangement uses NAT addresses from a range absent from internet advertisements. Where that cannot be achieved, the ExpressRoute advertisement should be more specific than the internet advertisement. The warning concerns asymmetric routing from an incorrect configuration. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-routing).

## Applicability

Apply this check to public NAT prefixes used with Microsoft peering. Identify the circuit, NAT devices, advertised prefix lengths and internet edge. Keep the review distinct from private-peering address allocation or a general circuit-redundancy assessment.

## DSE recommendation

DSE recommends a prefix worksheet showing each NAT range and every place it is advertised. Ask the routing owner to explain the intended return path before approving an announcement change. Resolve identical advertisements or document the deliberately more-specific ExpressRoute route. Preserve the previous advertisements and an agreed reversal sequence with the change record.

## Verification

Inspect actual advertised routes at both edges, then exercise a permitted representative transaction. Correlate forward and return observations with the approved prefix plan. Repeat after the routing change has settled, and retain sanitized route evidence so later aggregation work does not silently recreate the conflict.

## Official references

[Microsoft Learn: Azure ExpressRoute: Routing requirements](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-routing).

## Primary reference

- Name: Azure ExpressRoute: Routing requirements | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-routing
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate ExpressRoute Microsoft-peering NAT advertisements from internet routes,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-014-separate-expressroute-microsoft-peering-nat-advertisements-from-internet-routes/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.