How to advertise routes between two express route connected to the same vnet gateway

Romain 45 Reputation points
2023-09-19T09:12:05.29+00:00

Hello Guys,

We currently have an existing hub with an Express route gateway connected to two different DC from two different express route circuits and i would like to know how to advertise routes learned by one express route circuit to the other one as it seems their is no way to manually add routes in BGP / express route circuit route tables (or i didn't find it yet).

I also implemented an Azure Route Server but if i'm correct ASR only propagate routes from VNA and Express route circuit and not between multiple express route circuit even connected to the same vnet gateway.

I didn't found any revelant information in Microsoft Documentations so if you have some insights i'm interested.

Regards,

Romain

Azure ExpressRoute
Azure ExpressRoute
An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.
342 questions
Accepted answer
  1. GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee
    2023-09-25T10:20:56.06+00:00

    Hello @Romain ,

    You have an existing hub with an Express route gateway connected to two different DC from two different express route circuits and you would like to know how to advertise routes learned by one express route circuit to another to connect both the DCs to each other via Express Route and also perform network filtering between the two express route circuits with an Azure Firewall.

    As mentioned in the Express Route FAQ,

    Can routes from the on-premises network get filtered? The only way to filter or include routes is on the on-premises edge router. User-defined routes can be added in the VNet to affect specific routing but is only static and not part of the BGP advertisement.

    Also, if you want to connect your DC networks via the ExpressRoute service, then you've to enable Global Reach.

    ExpressRoute Global Reach is a connection between 2 ExpressRoute circuits and your cross data-center traffic traverses through Microsoft's network backbone from one Microsoft edge router to the other Microsoft edge router. This traffic will not traverse through the ExpressRoute gateway or the Vnet, so network filtering through Azure Firewall on the Vnet will not be possible.

    https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-global-reach

    https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-faqs#globalreach

    So, the setup you are looking for is not possible using just ExpressRoute circuits.

    The only possible solution to achieve your requirement is via Azure Virtual WAN.

    Azure Virtual WAN has an option called Branch-to-branch which would fit your requirement.

    Branches can be connected to an Azure virtual WAN hub using ExpressRoute circuits and/or site-to-site VPN connections. You can connect the branches to the virtual WAN hub that is in the region closest to the branch.

    Branch-to-branch option lets enterprises leverage the Azure backbone to connect branches.

    The traffic follows the below pattern:

    branch device ->ISP->Microsoft network edge->Microsoft DC (hub VNet)->Microsoft network edge->ISP->branch device

    Refer: https://video2.skills-academy.com/en-us/azure/virtual-wan/virtual-wan-global-transit-network-architecture#branch-to-branch-b-and-branch-to-branch-cross-region-f

    https://video2.skills-academy.com/en-us/azure/virtual-wan/virtual-wan-faq#is-branch-to-branch-connectivity-allowed-in-virtual-wan

    The routing capabilities in a virtual hub are provided by a router that manages all routing between gateways using Border Gateway Protocol (BGP).

    Refer: https://video2.skills-academy.com/en-us/azure/virtual-wan/about-virtual-hub-routing

    Routing Intent and Routing Policies allow you to configure the Virtual WAN hub to forward Internet-bound and Private (Point-to-site VPN, Site-to-site VPN, ExpressRoute, Virtual Network and Network Virtual Appliance) Traffic to an Azure Firewall, Next-Generation Firewall Network Virtual Appliance (NGFW-NVA) or security software-as-a-service (SaaS) solution deployed in the virtual hub.

    There are two types of Routing Policies: Internet Traffic and Private Traffic Routing Policies.

    The one that you need is Private Traffic Routing Policy.

    When a Private Traffic Routing Policy is configured on a Virtual WAN hub, all branch and Virtual Network traffic in and out of the Virtual WAN Hub including inter-hub traffic is forwarded to the Next Hop Azure Firewall, Network Virtual Appliance or SaaS solution resource.

    In other words, when a Private Traffic Routing Policy is configured on the Virtual WAN Hub, all branch-to-branch, branch-to-virtual network, virtual network-to-branch and inter-hub traffic is sent via Azure Firewall, Network Virtual Appliance or SaaS solution deployed in the Virtual WAN Hub.

    Refer: https://video2.skills-academy.com/en-us/azure/virtual-wan/how-to-routing-policies

    Transit connectivity between ExpressRoute circuits within Virtual WAN is provided through two different configurations. Because these two configurations are not compatible, customers should choose one configuration option to support transit connectivity between two ExpressRoute circuits.

    1. ExpressRoute Global Reach: ExpressRoute Global Reach allows two Global Reach-enabled circuits to send traffic between each other directly without transiting the Virtual Hub.
    2. Routing Intent private routing policy: Configuring private routing policies allows two ExpressRoute circuits to send traffic to each other via a security solution deployed in the hub.

    The one which fits your requirement is the second option (Routing Intent private routing policy).

    To enable ExpressRoute to ExpressRoute transit connectivity via a Firewall appliance in the hub with private routing policies, open a support case with Microsoft Support.

    Note that this option is not compatible with Global Reach and requires Global Reach to be disabled to ensure proper transit routing between all ExpressRoute circuits connected to Virtual WAN.

    Refer: https://video2.skills-academy.com/en-us/azure/virtual-wan/how-to-routing-policies#expressroute

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest