Separate ExpressRoute Microsoft-peering NAT advertisements from internet routes

Source facts

For ExpressRoute Microsoft peering, Microsoft warns against advertising an identical public route through both ExpressRoute and the internet. Its preferred arrangement uses NAT addresses from a range absent from internet advertisements. Where that cannot be achieved, the ExpressRoute advertisement should be more specific than the internet advertisement. The warning concerns asymmetric routing from an incorrect configuration. Microsoft Learn.

Applicability

Apply this check to public NAT prefixes used with Microsoft peering. Identify the circuit, NAT devices, advertised prefix lengths and internet edge. Keep the review distinct from private-peering address allocation or a general circuit-redundancy assessment.

DSE recommendation

DSE recommends a prefix worksheet showing each NAT range and every place it is advertised. Ask the routing owner to explain the intended return path before approving an announcement change. Resolve identical advertisements or document the deliberately more-specific ExpressRoute route. Preserve the previous advertisements and an agreed reversal sequence with the change record.

Verification

Inspect actual advertised routes at both edges, then exercise a permitted representative transaction. Correlate forward and return observations with the approved prefix plan. Repeat after the routing change has settled, and retain sanitized route evidence so later aggregation work does not silently recreate the conflict.

Official references

Microsoft Learn: Azure ExpressRoute: Routing requirements.