AS Path Prepending with Microsoft Peering

Alex Ferentsein 0 Reputation points

Hi Experts!

I've inherited an on-premise firewall that BGP peers with our Azure instance using Microsoft Peering via ExpressRoute. The ExpressRoute Circuit provides two (primary & secondary) BGP sessions links.

Currently, on-premise firewall is configured to ONLY advertise the two BGP session links (ie. /30 subnets), with local BGP peer address as Next Hop - it does NOT advertise default ( nor any Intranet routes, however, all response traffic from Azure resources return via the two BGP sesssions links - I can only conclude that the (a) two on-premise BGP peers becomes de-facto default gateways is a characteristic of Microsoft Peering?

Since on-premise firewall is stateful, I need all (sent and) reply traffic be preferred on primary BGP session link. AS Path Prepending is documented in Path selection for Microsoft and Public peering which I intend to follow, however, since I don't advertise default or Intranet routes, I cannot see how AS Path Prepending on current advertised routes (ie. the two BGP sessions link subnets) would help - unless, (b) it's also a characteristic of Microsoft Peering?

Is the answer to (a) and (b), "yes"?

Azure ExpressRoute
Azure ExpressRoute
An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.
268 questions
{count} votes

1 answer

Sort by: Most helpful
  1. KapilAnanth-MSFT 27,831 Reputation points Microsoft Employee

    @Alex Ferentsein

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    If you are using Microsoft Peering, that means a certain Public IPV4 Range "Advertised public prefixes" is validated by Microsoft.

    Certain IPs would be advertised from your OnPrem into Microsoft.

    • Only then, Microsoft would send the traffic destined to the OnPrem Public IPs via the ExpressRoute.
    • Else, no Traffic flows inside the Microsoft Peering.

    For a)

    • I am not exactly sure what you mean by "default gateways" as I am not sure about the router side configuration.
    • From each the /30 subnet you specify, the first usable IP address is assigned to your router and Microsoft uses the second usable IP for its router.
    • The "Advertised public prefixes" uses this IP to route into Microsoft Routing domain and Microsoft services send the traffic destined to this "Advertised public prefixes" via the Microsoft Peering.
    • Refer : Microsoft peering
    • User's image

    For b)

    Your statement says that you are not "advertise default or Intranet routes".

    • However, for Microsoft peering to work , you should advertise some Public IP prefixes you own as stated above.
    • There are two /30 subnets, one for each Primary Connection and Secondary Connection.
      • If you advertise a lengthier AS path for secondary connection, Microsoft will prefer the primary connection (shorter AS Path).

    Please let us know if we can be of any further assistance here.



    Please Accept an answer if correct.

    Original posters help the community find answers faster by identifying the correct answer.

    0 comments No comments