State the traffic selectors when documenting IPsec over ExpressRoute

Source facts

Microsoft’s Windows transport-mode example applies IPsec through Group Policy to selected Azure and on-premises hosts. Its illustrated policy targets HTTP traffic with destination port 8080. The source describes filters based on address ranges, protocols and ports, so the example’s protection claim is tied to the selected traffic rather than every flow using ExpressRoute. Microsoft Learn.

Applicability

Consider this review for a host-based IPsec design over ExpressRoute private peering. Identify the participating Windows hosts, organizational-unit scope, policy assignment and application traffic. Confirm the complete source prerequisites before applying any example configuration.

DSE recommendation

DSE recommends documenting the protected source, destination, protocol and port together with the policy owner. Replace example selectors with approved application requirements and review excluded traffic explicitly. Keep a separate statement of what has not been evaluated. Plan the Group Policy rollout and recovery path around the actual hosts affected by the change.

Verification

During an authorized test, inspect policy application and observe the intended traffic using the source’s encryption-verification approach. Include a control flow outside the selected scope to confirm the test distinguishes covered from unreviewed traffic. Retain sanitized selector and observation evidence, without claiming circuit-wide encryption from one successful application transaction.

Official references

Microsoft Learn: Azure ExpressRoute private peering: Configure IPsec transport mode – Windows hosts.