# Tie Route Server anycast advertisements to application health

> Verify route withdrawal when a regional application becomes unavailable.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-087-tie-route-server-anycast-advertisements-to-application-health/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:33+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Verify route withdrawal when a regional application becomes unavailable.

## Potentially affected

Use this review for an approved anycast design with regional NVAs and Route Server. Identify the application health signal that controls each advertised prefix, the alternate destination and the owner of the routing policy.

## DSE recommendation

DSE recommends writing a withdrawal criterion that reflects application readiness.

## Article

## Source facts

Microsoft’s Route Server anycast guidance requires NVAs to stop advertising a route when the local application instance becomes unavailable. The intent is to avoid sending traffic to a failed instance. The same guidance warns that BGP convergence can delay failover, so route-based recovery must be assessed against the application’s recovery requirements. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/route-server/anycast).

## Applicability

Use this review for an approved anycast design with regional NVAs and Route Server. Identify the application health signal that controls each advertised prefix, the alternate destination and the owner of the routing policy.

## DSE recommendation

DSE recommends writing a withdrawal criterion that reflects application readiness. Have the application and network teams agree what observation should remove the local route and what permits its return. Include recovery behavior and return-path requirements in the test plan. Avoid equating appliance uptime with permission to continue advertising a failed application’s address.

## Verification

In a controlled rehearsal, make the local application unavailable while leaving the NVA running. Observe the health decision, route withdrawal, remote path change and application recovery timestamps. Restore the service and inspect route readvertisement. Record measured interruption and unresolved session behavior rather than promising immediate or lossless failover.

## Official references

[Microsoft Learn: Anycast routing with Azure Route Server](https://learn.microsoft.com/en-us/azure/route-server/anycast).

## Primary reference

- Name: Anycast routing with Azure Route Server - Azure Route Server | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/route-server/anycast
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Tie Route Server anycast advertisements to application health,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-087-tie-route-server-anycast-advertisements-to-application-health/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.