how to control the return traffic into two different express route circuit connecting to same Azure Hub Vnet

Question

how to control the return traffic into two different express route circuit connecting to same Azure Hub Vnet

Mahesh Badgujar 40

We currently have an ExpressRoute circuit connecting the Azure Hub network and the on-premises WAN. We plan to establish an additional ExpressRoute circuit linking the same Hub network and same on-premises WAN.

Our key requirements are as follows:

Both ExpressRoute circuits should function in an Active-Active setup.

Each circuit must have distinct BGP routes published.

We need to control the return traffic from Azure to the on-premises network to ensure that network packets follow the same circuit path for both inbound and outbound traffic.

Please confirm the feasibility of implementing this setup or suggest alternatives for achieving the desired traffic control.

Setup would be like below-
Azure Hub Vnet <---> ExR1 <---> On-premises WAN

||

Azure Hub Vnet <---> ExR2 <---> On-premises WAN

Silvia Wibowo 5,966 Reputation points Microsoft Employee Volunteer Moderator

2025-06-04T06:00:37.3866667+00:00
Hi @Mahesh Badgujar , I understand that you plan to have multiple Express Route circuits for resiliency between Azure and on-premises location. You need to influence the routing, so one Express Route circuit is preferred over the other for specific routes.

You can influence Azure to prefer one ExpressRoute circuit over another one using one of the following techniques (listed in the order of effectiveness):

advertising more specific route over the preferred ExpressRoute circuit compared to other ExpressRoute circuits

configuring higher Connection Weight on the connection that links the virtual network to the preferred ExpressRoute circuit

advertising the routes over less preferred ExpressRoute circuit with longer AS Path (AS Path prepend)

While from on-premises to Azure, you can also influence your router in a similar way so that you get symmetric route. You need to pair address range between on-premises and Azure to use certain Express Route circuit.

For example:

On-premises has IP range of 10.1.0.0/16 and 10.2.0.0/16. Azure has IP range of 172.16.0.0/16 and 172.26.0.0/16.

For 10.1.0.0/16 <-> 172.16.0.0/16, use ExpressRoute_circuit1 by setting higher connection weight and/or shorter AS Path. For 10.2.0.0/16 <-> 172.26.0.0/16, use ExpressRoute_circuit2 by setting higher connection weight and/or shorter AS Path.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Mahesh Badgujar 40 Reputation points

2025-06-04T06:24:53.35+00:00
Hi Silivia,

Thanks for your response.

I am clear on how to control and influence traffic from on-premises to Azure but still not clear on the options suggested by, please see my comments inline and help me with the solution if there is any.

advertising more specific route over the preferred ExpressRoute circuit compared to other ExpressRoute circuits = advertising routes primarily influence traffic flow from on-premises to Azure, but controlling return traffic from Azure back to on-premises requires a different approach. Since the Azure firewall does not support a routing table, one way to manage return traffic effectively is through UDRs (User-Defined Routes) associated with the subnet where the Azure firewall is deployed.

configuring higher Connection Weight on the connection that links the virtual network to the preferred ExpressRoute circuit

= Yes, configuring a higher weight on one ExpressRoute circuit will prioritize that circuit for outbound traffic from on-premises to Azure, making the lower-weight circuit passive. However, this does not necessarily control return traffic from Azure to on-premises.

advertising the routes over less preferred ExpressRoute circuit with longer AS Path (AS Path prepend) = our requirement is to have both the circuits working active-active allowing the dedicated separate inbound and outbound traffic, Use AS Path Prepending on one circuit to make it less preferred for certain traffic flows if needed.
Mahesh Badgujar 40 Reputation points

2025-06-04T06:27:27.5+00:00
advertising more specific route over the preferred ExpressRoute circuit compared to other ExpressRoute circuits =advertising routes primarily influence traffic flow from on-premises to Azure, but controlling return traffic from Azure back to on-premises requires a different approach. Since the Azure firewall does not support a routing table, one way to manage return traffic effectively is through UDRs (User-Defined Routes) associated with the subnet where the Azure firewall is deployed.

configuring higher Connection Weight on the connection that links the virtual network to the preferred ExpressRoute circuit =Yes, configuring a higher weight on one ExpressRoute circuit will prioritize that circuit for outbound traffic from on-premises to Azure, making the lower-weight circuit passive. However, this does not necessarily control return traffic from Azure to on-premises.

advertising the routes over less preferred ExpressRoute circuit with longer AS Path (AS Path prepend) =our requirement is to have both the circuits working active-active allowing the dedicated separate inbound and outbound traffic, Use AS Path Prepending on one circuit to make it less preferred for certain traffic flows if needed.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-06-04T11:06:07.3666667+00:00

Hi @Mahesh Badgujar

As I can see, Silvia Wibowo has suggested the best approach. You have already configured the connection using an individual ExpressRoute circuit with an active-active setup and two physical connections (primary and secondary).

Unfortunately, your setup should be active-passive to avoid asymmetric routing. However, note that the connections within a single ExR Circuit are active-active, Azure ExpressRoute: Designing for high availability | Microsoft Learn.

What's your requirement for active-active circuits? Is it bandwidth?

We need to control the return traffic from Azure to the on-premises network to ensure that network packets follow the same circuit path for both inbound and outbound traffic.

Azure does not support source-based routing or per-circuit return path symmetry by default. Instead, Azure uses destination-based routing, relying on the longest prefix match and BGP attributes such as AS Path and Connection Weight.

Reference: Asymmetric routing with multiple network paths and Autonomous System numbers (ASN)

I hope this is helpful! Do not hesitate to let me know if you have any other questions.
Silvia Wibowo 5,966 Reputation points Microsoft Employee Volunteer Moderator

2025-06-05T04:06:07.5633333+00:00
Hi @Mahesh Badgujar ,

Since the Azure firewall does not support a routing table, one way to manage return traffic effectively is through UDRs (User-Defined Routes) associated with the subnet where the Azure firewall is deployed.

What does this have to do with Azure Firewall? Azure Firewall still needs the Hub and Express Route Gateway to decide which Express Route circuit to choose.

Azure VM -> Azure Firewall (in Hub?) -> Express Route Gateway -> Express Route circuit -> on-premises

Yes, configuring a higher weight on one ExpressRoute circuit will prioritize that circuit for outbound traffic from on-premises to Azure, making the lower-weight circuit passive. However, this does not necessarily control return traffic from Azure to on-premises.

Your statement "this does not necessarily control return traffic from Azure to on-premises" is not true. Azure side can configure connection weight for Express Route connection: Connection weight. You're correct that configuring connection weight will make one Express Route connection preferred over the other, or active-passive.

our requirement is to have both the circuits working active-active allowing the dedicated separate inbound and outbound traffic, Use AS Path Prepending on one circuit to make it less preferred for certain traffic flows if needed.

You can choose to add different AS Path Prepending for different route advertisement, making your 2 Express Route circuits active-active. For example: you have 2 CIDR ranges to advertise from on-premises:

10.1.0.0/16 is advertised to ER-circuit-1 without AS Path Prepend, to ER-circuit-2 with AS Path Prepend. The route from Azure to this CIDR will prefer ER-circuit-1 over ER-circuit-2.

10.2.0.0/16 is advertised to ER-circuit-2 without AS Path Prepend, to ER-circuit-1 with AS Path Prepend. The route from Azure to this CIDR will prefer ER-circuit-2 over ER-circuit-1.

Both ER-circuit-1 and ER-circuit-2 are active.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-06-05T04:38:44.1966667+00:00

Hi @Mahesh Badgujar ,

I just wanted to follow up and see if you had a chance to review Silvia Wibowo and my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

1 answer

Your answer

Silvia Wibowo 5,966 Reputation points Microsoft Employee Volunteer Moderator

2025-06-04T06:00:37.3866667+00:00

Hi @Mahesh Badgujar , I understand that you plan to have multiple Express Route circuits for resiliency between Azure and on-premises location. You need to influence the routing, so one Express Route circuit is preferred over the other for specific routes.

You can influence Azure to prefer one ExpressRoute circuit over another one using one of the following techniques (listed in the order of effectiveness):

advertising more specific route over the preferred ExpressRoute circuit compared to other ExpressRoute circuits

configuring higher Connection Weight on the connection that links the virtual network to the preferred ExpressRoute circuit

advertising the routes over less preferred ExpressRoute circuit with longer AS Path (AS Path prepend)

While from on-premises to Azure, you can also influence your router in a similar way so that you get symmetric route. You need to pair address range between on-premises and Azure to use certain Express Route circuit.

For example:

On-premises has IP range of 10.1.0.0/16 and 10.2.0.0/16. Azure has IP range of 172.16.0.0/16 and 172.26.0.0/16.

For 10.1.0.0/16 <-> 172.16.0.0/16, use ExpressRoute_circuit1 by setting higher connection weight and/or shorter AS Path. For 10.2.0.0/16 <-> 172.26.0.0/16, use ExpressRoute_circuit2 by setting higher connection weight and/or shorter AS Path.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Mahesh Badgujar 40 Reputation points

2025-06-04T06:24:53.35+00:00

Hi Silivia,

Thanks for your response.

I am clear on how to control and influence traffic from on-premises to Azure but still not clear on the options suggested by, please see my comments inline and help me with the solution if there is any.

advertising more specific route over the preferred ExpressRoute circuit compared to other ExpressRoute circuits = advertising routes primarily influence traffic flow from on-premises to Azure, but controlling return traffic from Azure back to on-premises requires a different approach. Since the Azure firewall does not support a routing table, one way to manage return traffic effectively is through UDRs (User-Defined Routes) associated with the subnet where the Azure firewall is deployed.

configuring higher Connection Weight on the connection that links the virtual network to the preferred ExpressRoute circuit

= Yes, configuring a higher weight on one ExpressRoute circuit will prioritize that circuit for outbound traffic from on-premises to Azure, making the lower-weight circuit passive. However, this does not necessarily control return traffic from Azure to on-premises.

advertising the routes over less preferred ExpressRoute circuit with longer AS Path (AS Path prepend) = our requirement is to have both the circuits working active-active allowing the dedicated separate inbound and outbound traffic, Use AS Path Prepending on one circuit to make it less preferred for certain traffic flows if needed.
Mahesh Badgujar 40 Reputation points

2025-06-04T06:27:27.5+00:00

advertising more specific route over the preferred ExpressRoute circuit compared to other ExpressRoute circuits =advertising routes primarily influence traffic flow from on-premises to Azure, but controlling return traffic from Azure back to on-premises requires a different approach. Since the Azure firewall does not support a routing table, one way to manage return traffic effectively is through UDRs (User-Defined Routes) associated with the subnet where the Azure firewall is deployed.

configuring higher Connection Weight on the connection that links the virtual network to the preferred ExpressRoute circuit =Yes, configuring a higher weight on one ExpressRoute circuit will prioritize that circuit for outbound traffic from on-premises to Azure, making the lower-weight circuit passive. However, this does not necessarily control return traffic from Azure to on-premises.

advertising the routes over less preferred ExpressRoute circuit with longer AS Path (AS Path prepend) =our requirement is to have both the circuits working active-active allowing the dedicated separate inbound and outbound traffic, Use AS Path Prepending on one circuit to make it less preferred for certain traffic flows if needed.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-06-04T11:06:07.3666667+00:00

Hi @Mahesh Badgujar

As I can see, Silvia Wibowo has suggested the best approach. You have already configured the connection using an individual ExpressRoute circuit with an active-active setup and two physical connections (primary and secondary).

Unfortunately, your setup should be active-passive to avoid asymmetric routing. However, note that the connections within a single ExR Circuit are active-active, Azure ExpressRoute: Designing for high availability | Microsoft Learn.

What's your requirement for active-active circuits? Is it bandwidth?

We need to control the return traffic from Azure to the on-premises network to ensure that network packets follow the same circuit path for both inbound and outbound traffic.

Azure does not support source-based routing or per-circuit return path symmetry by default. Instead, Azure uses destination-based routing, relying on the longest prefix match and BGP attributes such as AS Path and Connection Weight.

Reference: Asymmetric routing with multiple network paths and Autonomous System numbers (ASN)

I hope this is helpful! Do not hesitate to let me know if you have any other questions.
Venkat V 2,545 Reputation points Microsoft External Staff Moderator

2025-06-05T04:38:44.1966667+00:00

Hi @Mahesh Badgujar ,

I just wanted to follow up and see if you had a chance to review Silvia Wibowo and my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

how to control the return traffic into two different express route circuit connecting to same Azure Hub Vnet

1 answer

Your answer