Keep Virtual WAN workload routes on the intended IPsec-over-ExpressRoute path

Source facts

Microsoft’s Virtual WAN IPsec-over-ExpressRoute guide warns that when the same prefixes are advertised through ExpressRoute and VPN, Azure uses ExpressRoute directly without the VPN protection. The configuration’s Use Azure Private IP Address option puts the VPN connection on private gateway addresses over ExpressRoute private peering; it does not remove the need to review workload routing. Microsoft Learn.

Applicability

Use this review for the documented Virtual WAN encrypted-overlay design. Identify tunnel endpoint reachability separately from workload prefixes, and record what is advertised through each connection. Keep the design distinct from Windows host-based transport-mode IPsec or the separate High Bandwidth gateway capability.

DSE recommendation

DSE recommends a two-part routing plan covering the VPN underlay and the workloads expected to use its overlay. Have both network owners review duplicate advertisements before authorizing a change. Document the expected selected path and the evidence required to substantiate the encryption claim. Preserve the prior advertisements and an agreed recovery sequence.

Verification

Inspect learned and effective routes for representative workload destinations. Correlate an authorized application test with the intended VPN tunnel’s observations, and examine the reverse path as well. Record any direct ExpressRoute selection as an unresolved requirement. A healthy VPN tunnel by itself should not certify that the intended application traffic traverses it.

Official references

Microsoft Learn: Configure ExpressRoute encryption: IPsec over ExpressRoute for Azure Virtual WAN.