# Check Route Server peering locality before using an on-premises NVA address

> Distinguish a reachable BGP endpoint from a documented peering topology.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-121-check-route-server-peering-locality-before-using-an-on-premises-nva-address/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:59+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Distinguish a reachable BGP endpoint from a documented peering topology.

## Potentially affected

Apply this check when selecting the BGP peer endpoint for Route Server. Identify where the appliance is deployed and whether its virtual network is directly peered. Keep laboratory routing demonstrations separate from the production appliance selection.

## DSE recommendation

DSE recommends recording both the peer address and its network placement in the design.

## Article

## Source facts

Microsoft’s Route Server peering tutorial supports NVAs in the same virtual network or a directly peered virtual network. It explicitly excludes BGP peering between Route Server and an on-premises NVA. The tutorial’s FRRouting VM is a demonstration appliance; Microsoft directs production deployments to supported network appliances from Azure Marketplace. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/route-server/peer-route-server-with-virtual-appliance).

## Applicability

Apply this check when selecting the BGP peer endpoint for Route Server. Identify where the appliance is deployed and whether its virtual network is directly peered. Keep laboratory routing demonstrations separate from the production appliance selection.

## DSE recommendation

DSE recommends recording both the peer address and its network placement in the design. Resolve an ineligible on-premises endpoint through an appropriate reviewed architecture rather than repeated firewall exceptions. Confirm the chosen appliance vendor’s guidance for the intended topology and preserve the expected peer and route list before the pilot.

## Verification

Inspect actual VNet placement and peering, then verify the approved BGP session and intended learned prefixes in a test deployment. Check that workload routes reflect the expected advertisements. Record topology eligibility separately from connectivity results; a reachable TCP endpoint or successful laboratory session alone does not establish a supported production design.

## Official references

[Microsoft Learn: Tutorial: Configure BGP peering between Azure Route Server and NVA](https://learn.microsoft.com/en-us/azure/route-server/peer-route-server-with-virtual-appliance).

## Primary reference

- Name: Tutorial: Configure BGP peering between Azure Route Server and NVA | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/route-server/peer-route-server-with-virtual-appliance
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check Route Server peering locality before using an on-premises NVA address,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-121-check-route-server-peering-locality-before-using-an-on-premises-nva-address/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.