ExpressRoute Not Advertising VNet CIDRs to AWS

Question

Hello Azure Support Team,

I have an ExpressRoute circuit named btcturk-global-circuit in the West Europe location (Resource Group: Pending). It is linked via Azure Private Peering to an AWS Direct Connect VIF. The BGP session is up and stable, and from the Azure side, I can see that AWS is advertising 172.25.0.0/16.

However, on the AWS side, they never learn my Azure VNet CIDR (10.0.0.0/16). The AWS route table shows no propagated routes from Azure. Our ExpressRoute gateway (btcturk-vnet-gw) is in the same VNet (PendingVNet) that has the address space 10.0.0.0/16, with subnets defined (10.0.0.0/24, 10.0.1.0/24, etc.).

I suspect I need to enable Global Reach or otherwise configure the ExpressRoute circuit to advertise the Azure VNet CIDRs back to AWS. Could you please:

1. Confirm which steps/settings are required so that 10.0.0.0/16 is exported to AWS?
2. Verify if there are any route filters or additional ExpressRoute configurations I must enable to ensure that the VNet CIDRs propagate over the private peering to AWS?
3. Confirm there are no region constraints or SKU limitations that would prevent route advertisement from this West Europe gateway?

I appreciate your assistance troubleshooting why 10.0.0.0/16 is not seen on AWS. Please let me know what else I can provide or configure on my end to resolve this routing issue.

Thank you and kind regards,
Ahmet Yavuz Demir

Answer 1

Hi @Ahmet Yavuz Demir,

Based on the provided information, I would like to share a few information with you.

1. Your configuration on Azure side looks correct.
2. You don't have any route filter option in Azure for Express route private peering, so you don't have to configure this.
3. I also understand you have only one VNET with one address space. So, it will not hit the maximum prefix limit on Azure side.
4. There might be possibility of having any route filter on AWS side which is restricting it to learn the route from Azure.
5. As you have already shared the prefixes, is it possible to share below screenshot.
   Go to EXPRESSROUTE--->Peerings--->Azure Private --->View route table summary
6. There is no option in the portal/Az cli to get the advertised routes from ER but if you see any route learnt from different AS than AWS , it should be advertised to that ideally.

Please let me know if this helps.

Answer 2

@Ahmet Yavuz Demir ,

Greetings.

I see Sai Prasanna Sinde and Vallepu Venkateswarlu has shared their observations.

Ideally,

• No additional step is required by the customer to make the Circuit advertise the routes from the Gateway's VNET it is connected to
• It should be automatic

As next steps,

• Can you verify if the MSEE (Circuit) is advertising the routes from Azure end?
• You can use the Get-AzExpressRouteCircuitRouteTable command
  • You can also use Get-AzExpressRouteCircuitRouteTableSummary command for BGP neighbor information
• While the above command fetches the information from ExpressRoute Circuit, you should also check for the ExR Gateway - whether or not it is advertising the routes from the VNET
• You can use Get-AzVirtualNetworkGatewayAdvertisedRoute command for this

Can you please share the results for Get-AzExpressRouteCircuitRouteTable and Get-AzVirtualNetworkGatewayAdvertisedRoute ?

Additionally, you can use Get-AzVirtualNetworkGatewayLearnedRoute to check if the Gateway learns the route from AWS or not as well.

Cheers,

Kapil