Hello, I check vm effective routes and i have question why azure add route to subnet 25.48.0.0/12 , 25.4.0.0/14 etc by default?

@Handian Sudianto Apologies on my delayed response. I checked this internally and I was able to confirm with the Product Team that this is an expected behavior and these routes are associated with internal addresses. I shall work with them to get this documented soon. Kindly let us know if this helps or you need further assistance on this issue. Thanks, Kapil Please don’t forget to close the thread by clicking " Accept the answer " wherever the information provided helps you, as this can be beneficial to other community members.

Azure Route - Microsoft Q&A

Accepted answer

KapilAnanth-MSFT 44,131 Reputation points Microsoft Employee

2023-09-25T05:23:03.2666667+00:00

@Handian Sudianto

Apologies on my delayed response.

I checked this internally and I was able to confirm with the Product Team that this is an expected behavior and these routes are associated with internal addresses.

I shall work with them to get this documented soon.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.
Handian Sudianto 4,811 Reputation points

2023-09-25T05:53:59.49+00:00

Hi @KapilAnanth-MSFT

Noted, so we can use that address/subnet if we want restrict internet access from on-prem to Microsoft only?

KapilAnanth-MSFT 44,131 Reputation points Microsoft Employee

2023-09-25T05:58:38.4466667+00:00

@Handian Sudianto ,

I am afraid I did not quite understand your question here.

Internet/OnPrem restriction can be done using NSGs on the subnet.

Can you please provide more info

Cheers,

Kapil

Handian Sudianto 4,811 Reputation points

2023-09-25T06:37:00.1933333+00:00

Hi @KapilAnanth-MSFT

Sorry if my previous question not too clear.

All our on-prem server now have unrestricted internet access such as to access windows update, Microsoft SharePoint and other Microsoft resources.

I believe all subnet listed on my 1st question is owned by Microsoft and on my mind i can make rule on our on-prem firewall to only allowed to that subnet to access only to Microsoft resources. So all server only have limited or specific internet access. Am i right?

KapilAnanth-MSFT 44,131 Reputation points Microsoft Employee

2023-09-26T05:55:50.8766667+00:00

@Handian Sudianto ,

The routes you see would only be implemented for Azure Virtual Machines.

The above displayed routes are internal and not routable via Internet.

So, VMs should have no problem connecting to Internet.

Similarly, you can override the above routes, if you would want.

Either by using UDRs or BGP.

Wrt, "i can make rule on our on-prem firewall to only allowed to that subnet to access only to Microsoft resources. So all server only have limited or specific internet access. Am i right?"

Yes, this is correct.

Since the above displayed routes are internal and not routable via Internet, you can restrict Internet access normally.

Cheers,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Route

1 additional answer

Your answer