How to establish a BGP peering for secondary subnet with a single tag layer 2 link

Hello @Achira Perera ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know if it is possible to establish only a primary ExpressRoute connection with a switched virtual interface and route traffic.

As mentioned in the Azure ExpressRoute high availability document,

If you terminate both the primary and secondary connections of an ExpressRoute circuits on the same Customer Premises Equipment (CPE), you're compromising the high availability within your on-premises network. Additionally, if you configure both the primary and secondary connections using the same port of a CPE, you're forcing the partner to compromise high availability on their network segment as well.

Microsoft network is configured to operate the primary and secondary connections of ExpressRoute circuits in active-active mode. To improve high availability, it's recommended to operate both the connections of an ExpressRoute circuit in active-active mode. If you let the connections operate in active-active mode, Microsoft network loads balance the traffic across the connections on per-flow basis.

Running the primary and secondary connections of an ExpressRoute circuit in active-passive mode face the risk of both the connections failing following a failure in the active path. The common causes for failure on switching over are lack of active management of the passive connection, and passive connection advertising stale routes.

During a maintenance activity or in case of unplanned events impacting one of the connection, Microsoft will prefer to use AS path prepending to drain traffic over to the healthy connection. You will need to ensure the traffic is able to route over the healthy path when path prepend is configure from Microsoft and required route advertisements are configured appropriately to avoid any service disruption.

The recommended configuration is to use one sub interface per peering in every router that you connect to Microsoft. A sub interface can be identified with a VLAN ID or a stacked pair of VLAN IDs and an IP address.

Refer: https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-config-samples-routing#configure-interfaces-and-subinterfaces

Each circuit has two paths (primary and secondary). You can check the ARP table for each path independently.

Refer: https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-troubleshooting-arp-resource-manager#getting-the-arp-tables-for-your-expressroute-circuit

If you're using a layer 2 connection, deploy redundant routers in your on-premises network in an active-active configuration. Connect the primary circuit to one router, and the secondary circuit to the other. This will give you a highly available connection at both ends of the connection.

Refer: https://video2.skills-academy.com/en-us/azure/architecture/reference-architectures/hybrid-networking/expressroute#availability

https://video2.skills-academy.com/en-us/azure/well-architected/service-guides/azure-expressroute

Is it necessary to have a secondary peer established between the secondary subnets? can we still establish a peer to our primary subnet and route traffic?

As mentioned above, it's recommended to operate both the connections of an ExpressRoute circuit in active-active mode to improve high availability. However, you can terminate both the primary and secondary connections of an ExpressRoute circuit on the same Customer Premises Equipment (CPE) or a single router interface for traffic routing. But it may cause issues during maintenance activity or unplanned events as mentioned above.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.