Keep ExpressRoute circuit-to-circuit transit out of a Route Server design

Source facts

Microsoft explicitly excludes ExpressRoute circuit-to-circuit connectivity through Azure Route Server. Routes from one circuit are not advertised to another circuit connected to the same virtual network gateway. The guidance points to ExpressRoute Global Reach for consideration when ExpressRoute-to-ExpressRoute connectivity is required. Microsoft Learn.

Applicability

Apply this boundary when designing transit between locations attached through separate ExpressRoute circuits. Identify each circuit, gateway and required destination. Do not infer circuit-to-circuit support from Route Server’s documented exchange with VPN gateways or NVAs.

DSE recommendation

DSE recommends marking the required transit path explicitly in the architecture before enabling route exchange. If the requirement crosses the excluded boundary, have the network owner assess an appropriate alternative and its own prerequisites. Keep that assessment separate from granting more permissions or changing BGP filters on a design that does not support the intended exchange.

Verification

Review the actual topology and advertised routes against the chosen design. Test the approved transit path only after its prerequisites and routing controls are established. Preserve the path identity and application observations in the acceptance record. If expected prefixes are absent, check the documented boundary before treating their absence as a Route Server malfunction.

Official references

Microsoft Learn: Azure Route Server support for ExpressRoute and Azure VPN.