What's changed: Deepened AZ-700 Chapter 3 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
3.3BGP and Route Propagation
Understand BGP for dynamically exchanging routes between on-prem and Azure, route propagation over VPN/ExpressRoute, and route-selection precedence. Dynamic routing reduces manual route configuration.
Managing routes manually across many sites is hard. With BGP, on-prem and Azure dynamically learn and exchange routes, reducing manual effort and errors.
3.3.1Dynamic routing and precedence
- BGP: the standard protocol to dynamically exchange routes between on-prem and the Azure gateway.
- Route propagation: routes learned via VPN/ExpressRoute are propagated into the VNet through the gateway.
- Selection precedence: for the same destination, UDR > BGP > system route; longest-prefix match filters first.
- Disable propagation: disabling gateway route propagation on a route table helps enforce forced tunneling, etc.
Common on AZ-700: dynamic route exchange = BGP, learned routes into the VNet = route propagation, same-destination precedence = UDR > BGP > system (longest-prefix match first). Distinguish designs that prefer manual UDRs vs those using BGP for scalability.
BGP identifies peers by Autonomous System Number (ASN). Azure’s VPN/ExpressRoute gateways use default ASN 65515, while on-prem sets its own ASN (some reserved ASNs are disallowed). Enabling BGP on a VPN exchanges routes over the tunnel via BGP peer IPs, so added on-prem subnets are learned automatically without editing UDRs. ExpressRoute always exchanges routes via BGP—private peering advertises VNet prefixes, Microsoft peering advertises public prefixes. When both an ExpressRoute and a VPN route exist for the same destination, Azure by default prefers ExpressRoute (the basis for backup-VPN designs). For segments where you want to ignore learned routes, disable gateway route propagation on the route table so only UDRs apply. Summarizing advertised prefixes to stay under route-count limits is another practical point. BGP governs route reachability and is distinct from allow/deny (NSG) and inspection (NVA/Firewall).
| Aspect | Static (UDR) | Dynamic (BGP) |
|---|---|---|
| Route management | Manually define dest → next hop | Auto-exchanged between gateways |
| Adding sites | Edit UDRs by hand | Learned/propagated automatically |
| Precedence | Highest (UDR > BGP at equal length) | Above system, below UDR |
Scenario: on-prem sites change often and editing UDRs each time is burdensome. → Enable BGP on the VPN/ExpressRoute, set the on-prem router’s ASN, and exchange routes dynamically. Subnet changes propagate to Azure automatically, removing UDR edits; keep UDRs only for must-win exceptions.
FAQ: Q. If both ExpressRoute and VPN learn the same destination, which is used? → A. ExpressRoute is preferred by default (VPN suits backup). Q. What ASN does the Azure gateway use? → A. 65515 by default; set your own ASN on-prem and avoid reserved ASNs.
Trap: “BGP routes always beat UDRs” is wrong—at equal prefix length the order is UDR > BGP > system, so the UDR wins. Also “using BGP removes the need for NSG allow rules” is wrong—BGP is about reachability (routing); allow/deny still requires an NSG.
3.3.2Section summary
- BGP = dynamic route exchange; route propagation over VPN/ExpressRoute
- Precedence = UDR > BGP > system (longest-prefix match first)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which standard protocol dynamically exchanges routes between on-prem and the Azure gateway?
Q2. When a UDR, a BGP route, and a system route exist for the same destination, which wins?
Q3. What is the mechanism that reflects routes learned via VPN/ExpressRoute into VNet subnets called?