AS Path Prepending with Microsoft Peering

Question

Hi Experts!

I've inherited an on-premise firewall that BGP peers with our Azure instance using Microsoft Peering via ExpressRoute. The ExpressRoute Circuit provides two (primary & secondary) BGP sessions links.

Currently, on-premise firewall is configured to ONLY advertise the two BGP session links (ie. /30 subnets), with local BGP peer address as Next Hop - it does NOT advertise default (0.0.0.0/0) nor any Intranet routes, however, all response traffic from Azure resources return via the two BGP sesssions links - I can only conclude that the (a) two on-premise BGP peers becomes de-facto default gateways is a characteristic of Microsoft Peering?

Since on-premise firewall is stateful, I need all (sent and) reply traffic be preferred on primary BGP session link. AS Path Prepending is documented in Path selection for Microsoft and Public peering which I intend to follow, however, since I don't advertise default or Intranet routes, I cannot see how AS Path Prepending on current advertised routes (ie. the two BGP sessions link subnets) would help - unless, (b) it's also a characteristic of Microsoft Peering?

Is the answer to (a) and (b), "yes"?

Answer 1

@Alex Ferentsein

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

If you are using Microsoft Peering, that means a certain Public IPV4 Range "Advertised public prefixes" is validated by Microsoft.

Certain IPs would be advertised from your OnPrem into Microsoft.

• Only then, Microsoft would send the traffic destined to the OnPrem Public IPs via the ExpressRoute.
• Else, no Traffic flows inside the Microsoft Peering.

For a)

• I am not exactly sure what you mean by "default gateways" as I am not sure about the router side configuration.
• From each the /30 subnet you specify, the first usable IP address is assigned to your router and Microsoft uses the second usable IP for its router.
• The "Advertised public prefixes" uses this IP to route into Microsoft Routing domain and Microsoft services send the traffic destined to this "Advertised public prefixes" via the Microsoft Peering.
• Refer : Microsoft peering
• 

For b)

Your statement says that you are not "advertise default or Intranet routes".

• However, for Microsoft peering to work , you should advertise some Public IP prefixes you own as stated above.
• There are two /30 subnets, one for each Primary Connection and Secondary Connection.
  • If you advertise a lengthier AS path for secondary connection, Microsoft will prefer the primary connection (shorter AS Path).

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

---

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.