ExpressRoute sites not receiving BGP updates except from VPN connected sites

Chuck Davidson 5

Hi ..

I have a WAN consisting of Virtual hubs and each hub has one ExpressRoute and some L2L VPN connections.

I have BGP set up on the ExpressRoute endpoints, but they are only getting updates with the routes to the VPN connected sites (regardless of which hub the VPNs are connected to) but are NOT getting any routing information for the other two ExpressRoute connected sites.

Each hub's effective routes include all the addresses and correct connection info, but some of that is not making it to the ExpressRoute endpoint's router.

I appreciate any suggestions.

Ganesh Patapati 4,320 Reputation points Microsoft External Staff

2025-03-06T17:40:07.9466667+00:00
Hi Chuck Davidson

Greetings!

I understand that ExpressRoute connections aren't propagating routes from other ExpressRoute sites in your Azure Virtual WAN and this issue could happen if ExpressRoute connections in the virtual hubs are not configured to propagate the hub's default route table (which contains all learned routes, including those from other ExpressRoute sites).

Can you please check Route Propagation Settings for each ExpressRoute Connection:

Navigate to Virtual Hub >> Under Connectivity >> ExpressRoute >> select each ExpressRoute connection. - Ensure Propagate route table is set to Default (or the route table containing all routes). - If it is set to None or a custom table, routes from other ExpressRoute sites won't be advertised.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-expressroute-about#expressroute-connection-concepts

Also, please verify BGP Peering Configuration and confirm that Azure Private Peering is enabled on all ExpressRoute circuits.

If not,

Could you please verify ExpressRoute connectivity using this troubleshooting documentation

Validate ARP: ARP tables can help validate layer 2 configuration

Validate BGP and routes on the MSEE

Can you please update us if the action plan provided by was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.
Chuck Davidson 5 Reputation points

2025-03-06T18:50:22.62+00:00

Yes, only using Azure private peering on each ExpressRoute. BGP peering is working as "show bgp" on endpoint router shows the learned networks (the incomplete list).

ARP records only shows a single record, attached. ARP Records.png

1 answer

Chuck Davidson 5 Reputation points

2025-03-06T18:23:33.6266667+00:00
Regarding your advice, editing the ExpressRoute connection shows the "Propagate Default Route" slide switch set to Enable. Routing weight is at default of 0. I don't see where in the ExpressRoute configuration that you have the option to choose a routing table, but if I look at Properties ->Routing Configuration the JSON for the Associated route table and Propagate route tables both end with

hubRouteTables/defaultRouteTable"
Please sign in to rate this answer.
Chuck Davidson 5 Reputation points

2025-03-06T18:52:08.0766667+00:00

Yes, using (only) Azure Private Peering. BGP is working as (some) networks are being received by the endpoint's router.

Ganesh Patapati 4,320 Reputation points Microsoft External Staff

2025-03-07T09:40:45.6366667+00:00

Hello Chuck Davidson

Since some networks are being received, BGP is up and running, indicating that the BGP session is established. However, only some networks are being advertised, which may indicate issues with route advertisement. Please check the BGP configuration from On-Premises to ensure all required prefixes are advertised to Azure.

Azure has a maximum limit of 1000 IPv4 prefixes advertised on a single ExpressRoute connection. If the on-premises router is advertising more than that, some routes might be dropped.

Refer: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-faqs#how-many-prefixes-can-be-advertised-from-a-virtual-network-to-on-premises-on-expressroute-private-peering

Verify if both BGP sessions (primary and secondary) are up. Even if one is up, some routes might be missing if there's asymmetry in route advertisements between the two sessions.

Use PowerShell command Get-AzExpressRouteCircuitRouteTable to view the advertised and learned routes.

Refer: https://learn.microsoft.com/en-us/powershell/module/az.network/get-azexpressroutecircuitroutetablesummary?view=azps-13.3.0#description

And also, please go through this document to understand the Route selection algorithm for virtual hub

Can you please update us if the action plan provided by was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

Chuck Davidson 5 Reputation points

2025-03-09T03:54:48.7466667+00:00

Thanks much for the reply!

I only need to advertise one route per location and only 10 locations, so the 1000 route limit is not an issue. Routes must be advertising as the hubs have complete routing information. As all hubs know all routes, BGP is surely working. Only the ExpressRoute's routing table is missing routes - which should be supplied by the hub.

I will check the BGP sessions to see if both are up and update my comments.

Ganesh Patapati 4,320 Reputation points Microsoft External Staff

2025-03-10T17:30:58.2166667+00:00

Hello Chuck Davidson
Can you please update us, should there be any follow-up questions or concerns, please let us know and we shall try to address them.

Ganesh Patapati 4,320 Reputation points Microsoft External Staff

2025-03-11T10:20:55.0266667+00:00

Hello Chuck Davidson
Can you please update us, should there be any follow-up questions or concerns, please let us know and we shall try to address them.

Chuck Davidson 5 Reputation points

2025-03-12T14:23:40.04+00:00

I think I have found the issue, but have not solved it yet. Peering is out of sync!?

If I click the Sync button, I get a login request which then fails, saying I don't have access (which is strange because I created all of this!)

Ganesh Patapati 4,320 Reputation points Microsoft External Staff

2025-03-12T19:37:13.9833333+00:00

@Chuck Davidson

I can see in the above screenshot that you don't have contributor access to sync the virtual network.

Please ensure you have a contributor role to make any changes to the VNet peering.

Can you please update us, should there be any follow-up questions or concerns, please let us know and we shall try to address them.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

ExpressRoute sites not receiving BGP updates except from VPN connected sites

1 answer

Your answer