# Keep Virtual WAN workload routes on the intended IPsec-over-ExpressRoute path

> Check route advertisements before claiming the workload uses the encrypted overlay.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:09+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Check route advertisements before claiming the workload uses the encrypted overlay.

## Potentially affected

Use this review for the documented Virtual WAN encrypted-overlay design. Identify tunnel endpoint reachability separately from workload prefixes, and record what is advertised through each connection. Keep the design distinct from Windows host-based transport-mode IPsec or the separate High Bandwidth gateway capability.

## DSE recommendation

DSE recommends a two-part routing plan covering the VPN underlay and the workloads expected to use its overlay.

## Article

## Source facts

Microsoft’s Virtual WAN IPsec-over-ExpressRoute guide warns that when the same prefixes are advertised through ExpressRoute and VPN, Azure uses ExpressRoute directly without the VPN protection. The configuration’s Use Azure Private IP Address option puts the VPN connection on private gateway addresses over ExpressRoute private peering; it does not remove the need to review workload routing. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute).

## Applicability

Use this review for the documented Virtual WAN encrypted-overlay design. Identify tunnel endpoint reachability separately from workload prefixes, and record what is advertised through each connection. Keep the design distinct from Windows host-based transport-mode IPsec or the separate High Bandwidth gateway capability.

## DSE recommendation

DSE recommends a two-part routing plan covering the VPN underlay and the workloads expected to use its overlay. Have both network owners review duplicate advertisements before authorizing a change. Document the expected selected path and the evidence required to substantiate the encryption claim. Preserve the prior advertisements and an agreed recovery sequence.

## Verification

Inspect learned and effective routes for representative workload destinations. Correlate an authorized application test with the intended VPN tunnel’s observations, and examine the reverse path as well. Record any direct ExpressRoute selection as an unresolved requirement. A healthy VPN tunnel by itself should not certify that the intended application traffic traverses it.

## Official references

[Microsoft Learn: Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN](https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute).

## Primary reference

- Name: Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-wan/vpn-over-expressroute
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep Virtual WAN workload routes on the intended IPsec-over-ExpressRoute path,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-171-keep-virtual-wan-workload-routes-on-the-intended-ipsec-over-expressroute-path/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.