Asymmetric Routing Issue with ExpressRoute – Return Traffic via Internet Instead of ER (Selective Routing Required

Azure uses destination-based routing and standard BGP best-path logic. When both Internet and ExpressRoute paths exist to the same public IP, Microsoft will generally prefer the ExpressRoute path if:

• The same prefix is seen via Internet and ExpressRoute, and
• The prefix length is equal, or the ExpressRoute prefix is more specific.

This is exactly what causes asymmetric routing when a stateful device (like Palo Alto) sees only one side of the flow.

Below are the options that are supported and documented for avoiding asymmetric routing while keeping selective routing.

1. Recommended approach for symmetric routing without 0.0.0.0/0

Use distinct NAT IP ranges and careful route advertisement so that:

• The public IPs used for SIP/IPFX flows that must return via ExpressRoute are only advertised over ExpressRoute, not to the Internet.
• The public IPs used for workloads that should use direct Internet breakout are only advertised to the Internet, not over ExpressRoute.

Key points from the guidance:

• Do not advertise the same public IP route to the Internet and over ExpressRoute. Use a NAT IP range for ExpressRoute that is not advertised to the Internet at all.
• If that is not possible, advertise a more specific range over ExpressRoute than the one advertised to the Internet, so ExpressRoute is the preferred path for those flows.

This lets specific workloads/subnets use symmetric ExpressRoute paths without forcing a global 0.0.0.0/0 default route over ExpressRoute.

2. Use of BGP attributes vs prefix specificity

Within Microsoft, the decisive factor is prefix specificity, not customer-controlled attributes like Local Preference:

• If Microsoft receives multiple advertisements for the same IP, the path with the longer subnet mask (more specific route) is selected.
• Documentation explicitly calls out that more specific prefixes advertised over ExpressRoute will be preferred.

Therefore:

• Rely on more specific prefixes over ExpressRoute to influence return path.
• Do not rely on Local Preference or AS-path prepending to control Microsoft’s choice; those are not the primary knobs in this scenario.

3. How Azure/Microsoft chooses the return path

When both Internet and ExpressRoute paths exist:

• Routing between external networks is based on BGP best path.
• If the same IP is reachable via both, the more specific prefix wins.
• If Microsoft receives the same prefix with the same mask from Internet and ExpressRoute, the ExpressRoute path is preferred.

This is why:

• If the same NAT pool is advertised to both Internet and ExpressRoute, requests that arrive via Internet can have replies sent via ExpressRoute, creating asymmetric routing.

4. Advertising more specific prefixes over ExpressRoute

Yes, advertising more specific prefixes over ExpressRoute is a supported way to ensure return traffic symmetry for selected IP ranges, with constraints:

• For IPs that must return via ExpressRoute, advertise those public IPs (or a more specific block containing them) over ExpressRoute.
• Do not advertise that same block to the Internet, or advertise a less specific block to the Internet.

This ensures:

• Requests from Microsoft to those IPs go via ExpressRoute.
• Replies from those IPs to Microsoft also prefer ExpressRoute.

5. Role of SNAT for selective routing

SNAT is a primary tool for fixing asymmetric routing when selective routing is required:

• For flows that must stay on the Internet (for example, SMTP or SIP flows that should not use ExpressRoute), SNAT at the Internet edge to an internal IP or to a public IP that is not advertised over ExpressRoute.
• For inbound flows from Microsoft over the Internet, SNAT them at the Internet edge before they enter segments that have visibility into ExpressRoute. This forces the return path back to the same edge and avoids asymmetric routing.

Microsoft explicitly recommends SNAT at the Internet edge for Microsoft traffic to prevent asymmetric routing when ExpressRoute is present.

6. Best practices for SIP/media traffic in hybrid environments

From the ExpressRoute/asymmetric routing guidance, the following patterns apply well to SIP/media:

• Avoid advertising the same NAT pool to both Internet and ExpressRoute.
• Use separate NAT pools for:
  • ExpressRoute-facing traffic (advertised only over ExpressRoute), and
  • Internet-facing SIP/media traffic (advertised only to the Internet).
• For inbound SIP/media flows that must remain on the Internet, perform source NAT at the Internet edge before those flows enter any segment that has ExpressRoute routes.
• Ensure that any on-prem SIP/media servers that should use ExpressRoute have their public IPs advertised over ExpressRoute without NAT, so that both directions use ExpressRoute.

In summary:

• Enforce symmetry by controlling which public IPs are advertised where and by using distinct NAT pools for Internet vs ExpressRoute.
• Use more specific prefixes over ExpressRoute to bias return traffic for selected ranges.
• Use SNAT at the Internet edge to keep Internet-only flows symmetric and avoid ExpressRoute on the return path.

References:

• Asymmetric routing with multiple network paths
• Asymmetric routing solutions
• ExpressRoute routing requirements
• ExpressRoute NAT requirements
• Plan an ExpressRoute deployment for use with Power Platform
• Implementing ExpressRoute for Microsoft 365