# State the traffic selectors when documenting IPsec over ExpressRoute

> A host policy example does not establish that every flow on a circuit is encrypted.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:26+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

A host policy example does not establish that every flow on a circuit is encrypted.

## Potentially affected

Consider this review for a host-based IPsec design over ExpressRoute private peering. Identify the participating Windows hosts, organizational-unit scope, policy assignment and application traffic. Confirm the complete source prerequisites before applying any example configuration.

## DSE recommendation

DSE recommends documenting the protected source, destination, protocol and port together with the policy owner.

## Article

## Source facts

Microsoft’s Windows transport-mode example applies IPsec through Group Policy to selected Azure and on-premises hosts. Its illustrated policy targets HTTP traffic with destination port 8080. The source describes filters based on address ranges, protocols and ports, so the example’s protection claim is tied to the selected traffic rather than every flow using ExpressRoute. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-ipsec-transport-private-windows).

## Applicability

Consider this review for a host-based IPsec design over ExpressRoute private peering. Identify the participating Windows hosts, organizational-unit scope, policy assignment and application traffic. Confirm the complete source prerequisites before applying any example configuration.

## DSE recommendation

DSE recommends documenting the protected source, destination, protocol and port together with the policy owner. Replace example selectors with approved application requirements and review excluded traffic explicitly. Keep a separate statement of what has not been evaluated. Plan the Group Policy rollout and recovery path around the actual hosts affected by the change.

## Verification

During an authorized test, inspect policy application and observe the intended traffic using the source’s encryption-verification approach. Include a control flow outside the selected scope to confirm the test distinguishes covered from unreviewed traffic. Retain sanitized selector and observation evidence, without claiming circuit-wide encryption from one successful application transaction.

## Official references

[Microsoft Learn: Azure ExpressRoute private peering: Configure IPsec transport mode – Windows hosts](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-ipsec-transport-private-windows).

## Primary reference

- Name: Azure ExpressRoute private peering: Configure IPsec transport mode - Windows hosts | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-ipsec-transport-private-windows
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “State the traffic selectors when documenting IPsec over ExpressRoute,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-094-state-the-traffic-selectors-when-documenting-ipsec-over-expressroute/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.