# Review AS-path rewriting when Route Server connects dual-homed ExpressRoute networks

> Check the documented NVA policy before diagnosing missing routes between route servers.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:00+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Check the documented NVA policy before diagnosing missing routes between route servers.

## Potentially affected

Use this review for the documented hub-and-spoke design with Route Server in both locations and ExpressRoute integration. Identify each BGP session and appliance vendor. Do not apply an AS-path change to an unrelated topology solely because it contains Route Server.

## DSE recommendation

DSE recommends drawing the expected AS path at every peering boundary before editing the appliance.

## Article

## Source facts

In Microsoft’s dual-homed ExpressRoute design, the route servers share autonomous-system number 65515. BGP loop prevention discards a received path containing the receiving server’s own AS number. The documented design therefore requires the intervening NVA to apply as-override when peering with each route server so routes from the other server are not discarded for that reason. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/route-server/about-dual-homed-network).

## Applicability

Use this review for the documented hub-and-spoke design with Route Server in both locations and ExpressRoute integration. Identify each BGP session and appliance vendor. Do not apply an AS-path change to an unrelated topology solely because it contains Route Server.

## DSE recommendation

DSE recommends drawing the expected AS path at every peering boundary before editing the appliance. Ask the routing owner to map Microsoft’s requirement to the vendor’s supported configuration. Record the intended prefixes and existing policy so a rejected route can be traced through the actual topology. Arrange a controlled change window and an explicit restoration plan.

## Verification

Inspect received and advertised paths on both sides of the NVA during the approved test. Confirm the expected prefix reaches the intended route server and workload route table. Exercise representative traffic and its return path separately. Preserve sanitized before-and-after path evidence rather than treating an established BGP session as proof of route propagation.

## Official references

[Microsoft Learn: About dual-homed networks with Azure Route Server](https://learn.microsoft.com/en-us/azure/route-server/about-dual-homed-network).

## Primary reference

- Name: About dual-homed networks with Azure Route Server | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/route-server/about-dual-homed-network
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review AS-path rewriting when Route Server connects dual-homed ExpressRoute networks,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-060-review-as-path-rewriting-when-route-server-connects-dual-homed-expressroute/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.