Express route and effective routes on VM

RL 20

HI Everybody,

I've setup an express route circuit with his own virtual network gateway etc. Route propagation works as expecte in both directions.

For testing, i've create another vnet and peered vnet3 (new one) with vnet2 where there is the virtual network gateway. Peering is ok i've enable all options to allow the communication and transit between those two vnets.

I've advertise one ip on my onprem (/32), the ip is correctly propagate via express route, and i can see the route on my route table on azure.

The thing is, on my new vm on vnet3, when i check "effective routes" i can see the route to my ip onprem on the route table, but when i check with route print on the vm, i can't see the route to my onprem.

There is something that i miss ?

Thanks for your help.

Timmy Malmgren 1,521 Reputation points

2024-10-29T10:54:07.2533333+00:00

Hi

I am not completely sure if you are having a connectivity issue or just unsure why you cant se the routes in route print.

But lets start with route print!

In Azure you can kind of see the NIC resource as both the network card and a "mini router", in a simplified way it kind of works like this.

VM asks the NIC ("mini router") about the routes and the NIC decides the next hop. With that in mind the “route print” command will not give justice to what is actually routed for your VM. Instead you should focus on the “Effective routes” part on the NIC.

An example from the same VM to show just how “route print” command doesn’t show the correct information (this is working as intended though so don’t worry).

Now if there is a connection issue, even if you have the effective routes correctly you could start by checking the firewall logs se if the traffic is even reaching you on-premise. Enabling VNET flog logs is also a good way to troubleshoot the network traffic.

Hope this is helpful and remember shared knowledge is the best knowledge 😊

Best Regards,

Timmy Malmgren

If the Answer is helpful, please click "Accept Answer" and upvote it as it helps others to find what they are looking for faster!

1 answer

KapilAnanth-MSFT 47,206 Reputation points Microsoft Employee

2024-10-29T11:01:20.6266667+00:00
@RL ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are not able to see the route advertised via ExpressRoute within the OS of an Azure VM.

May I ask why you would like to verify the Route Table within the OS Level?

Is there any requirement for this?

Ideally, I believe this should be an expected behavior

The BGP/System/User Defined routes are applied at the platform level and I doubt they will be imprinted into the OS level.

Are you actually facing problem reaching this /32 address?

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

1 person found this answer helpful.
RL 20 Reputation points

2024-10-29T12:27:39.1533333+00:00

Hi @KapilAnanth-MSFT , @Timmy Malmgren ,

If i resume the that fact i don't see all effective routes on the OS level (route print) is an expected behavior.

Indeed, i can't reach my onprem device this is indeed a /32 which is advised via BGP, could this be an issue ?

From the Azure VM when i made a tracert to my onprem server (/32), my first hop is an ip of my subnet on myvnet 2 (where my AZ ER Virtual Network Gateway is located) and i can't see my trafic arriving on my onprem firewall.

KapilAnanth-MSFT 47,206 Reputation points Microsoft Employee

2024-10-29T16:56:45.8166667+00:00

@RL ,

From your test, you mentioned that the tracert shows an IP from GatewaySubnet

This means that the routing is correct

Can you share what the nextHop for this /32 range is in NIC effective routes

Are you sure the OnPrem firewall is not blocking?

Can you please test this across a wider range

Can you please check the Firewall logs (packet captures)

What about to OnPrem to Azure traffic?

From this /32 IP Server, are you able to Ping/SSH/RDP or TCPPing to any of the Azure VMs?

Is this getting blocked too

Cheers,

Kapil

RL 20 Reputation points

2024-10-30T07:02:17.0866667+00:00

Hi @KapilAnanth-MSFT ,

I've found the issue it was on my onprem firewall.

So this confirm the statement that all effective routes are not shown on route print output but it does't mean that your routing is not working as expected :)

Thanks for your help.

KapilAnanth-MSFT 47,206 Reputation points Microsoft Employee

2024-10-30T07:08:25.5033333+00:00

@RL ,

You are most welcome. Glad we could be of service

I would greatly appreciate if you could Accept the answer and close this thread

Original posters help the community find answers faster by identifying the correct answer.

Thanks,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Express route and effective routes on VM

1 answer

Your answer