Configure dual-stack route maps in Azure Route Server by using the Azure portal

In this article, you use the Azure portal to configure route maps on an existing dual-stack Azure Route Server. You filter an IPv6 prefix, summarize IPv4 and IPv6 prefixes, replace an autonomous system (AS) path, and add a BGP community. You apply the route maps in the outbound direction to an ExpressRoute connection, two VPN connections, and a BGP peering with a network virtual appliance (NVA).

Route maps control route advertisements, not data packets. The verification steps in this article show the resulting advertisements; they don't verify end-to-end packet delivery. For route-map concepts and limitations, see About route maps for Azure Route Server.

Regional availability

Azure Route Server IPv4/IPv6 dual-stack mode is available in preview only in the following Azure regions:

Prerequisites

• An Azure account with an active subscription where Route Server dual-stack preview access is enabled. Use a region listed in Regional availability.
• Permissions to configure Route Server and route maps. For more information, see Roles and permissions.
• An existing dual-stack virtual network with the following resources:
  • Azure Route Server with dual-stack mode enabled.
  • An ExpressRoute gateway and a VPN gateway in the same virtual network as Route Server.
  • An ExpressRoute connection and two site-to-site VPN connections that exchange the example routes.
  • An NVA in the hub virtual network with established BGP peering to Route Server and the example route advertisements configured.
• Route exchange with virtual network gateways enabled on Route Server.
• Familiarity with BGP peers, autonomous system numbers (ASNs), route advertisements, and BGP communities.

To prepare Route Server, see Enable IPv4/IPv6 dual-stack mode. For an example deployment and NVA peering, see Configure dual-stack Azure Route Server with PowerShell. That tutorial doesn't deploy the ExpressRoute or VPN gateways required for this example.

Review the route-map considerations and limitations, including charges and the restriction on point-to-site VPN configurations. Record existing route-map associations and expected routes before you make changes. Use an isolated test environment to evaluate these example policies before applying them to production connections.

Understand the example

The following diagram shows the dual-stack hub virtual network, gateways, and NVA. The dashed green lines represent BGP sessions. The solid green arrow shows the routes that the NVA advertises to Route Server.

Resources and address spaces

Replace these example names and prefixes with the values for your environment.

Route advertisements before applying route maps

Confirm these routes are available before you apply the example policies. If your baseline differs, the verification results also differ.

Route-map policies

Each connection supports one route map per direction. The example changes only outbound associations. Preserve the existing inbound association when you save each connection. If an outbound route map already exists, review its rules before replacing it.

Configure the ExpressRoute route map

Create a route map that filters one IPv6 prefix from the routes advertised toward ExpressRoute.

1. In the Azure portal, open your Azure Route Server resource.

2. Under Routing, select Route Maps, and then select Add Route-map.

3. Enter rmap-er for the route-map name, and then select Add rule.

4. Configure the rule with the following settings:

   Setting	Value
   Name	discard-ipv6
   Next step	Continue
   Match conditions: Property	Route prefix
   Match conditions: Criterion	Equals
   Match conditions: Value	fd00:0:91::/48
   Action on matched routes	Drop

   

5. Select Add to add the rule, and then select Save to save the route map.

6. Wait until Provisioning state shows Succeeded. Select Refresh if needed.

   The first route-map creation can trigger a Route Server upgrade. Wait for provisioning to complete before applying the map.

   

Apply the route map to ExpressRoute

1. On Route Maps, select Apply Route-maps to connections.

2. For Outbound Route-map, select rmap-er. Preserve the existing Inbound Route-map selection. If no inbound policy is configured, leave it set to None.

3. Select er-conn100. The Connection type column identifies ExpressRoute connections as Exr.

   

4. Select Save. After the operation completes, select Refresh and confirm that rmap-er has one outbound connection.

   

Configure the VPN route map

Create a route map with two rules: one for IPv6 summarization and one for IPv4 summarization.

1. On Route Maps, select Add Route-map, enter rmap-vpn, and then select Add rule.

2. Configure the IPv6 rule:

   Setting	Value
   Name	summ-ipv6
   Next step	Continue
   Match conditions: Property	Route prefix
   Match conditions: Criterion	Equals
   Match conditions: Value	fd00:0:90::/48,fd00:0:91::/48
   Action on matched routes	Modify
   Route modifications: Property	Route prefix
   Route modifications: Action	Replace
   Route modifications: Value	fd00:0:90::/47

   

3. Select Add, and then select Add rule to configure the IPv4 rule:

   Setting	Value
   Name	summ-ipv4
   Next step	Continue
   Match conditions: Property	Route prefix
   Match conditions: Criterion	Equals
   Match conditions: Value	10.90.0.0/24,10.91.0.0/24
   Action on matched routes	Modify
   Route modifications: Property	Route prefix
   Route modifications: Action	Replace
   Route modifications: Value	10.90.0.0/15

   

4. Select Add. Confirm that summ-ipv6 is the first rule and summ-ipv4 is the second rule.

5. Select Save, and then wait until Provisioning state shows Succeeded.

Apply the route map to both VPN connections

1. Select Apply Route-maps to connections.

2. For Outbound Route-map, select rmap-vpn. Preserve the existing inbound policy.

3. Select vpn-gw-to-site20-1 and vpn-gw-to-site20-2. Their Connection type is VPN.

   

4. Select Save. After saving finishes, select Refresh and confirm that both VPN connections use rmap-vpn in the outbound direction.

Configure the NVA route map

Create a route map with two rules. The first rule replaces the AS path for routes learned from site20. The second rule adds a community to an IPv6 prefix learned through ExpressRoute.

1. On Route Maps, select Add Route-map, enter rmap-hub100-nva, and then select Add rule.

2. Configure the AS-path rule:

   Setting	Value
   Name	as-replace
   Next step	Continue
   Match conditions: Property	AS Path
   Match conditions: Criterion	Equals
   Match conditions: Value	65020
   Action on matched routes	Modify
   Route modifications: Property	AS Path
   Route modifications: Action	Replace
   Route modifications: Value	9001

   

   This rule matches routes whose complete AS path is 65020 and sets that path to 9001. Routes with a longer AS path don't match this rule.

3. Select Add, and then select Add rule to configure the community rule:

   Setting	Value
   Name	set-bgp-community
   Next step	Continue
   Match conditions: Property	Route prefix
   Match conditions: Criterion	Equals
   Match conditions: Value	fd00:0:200::/48
   Action on matched routes	Modify
   Route modifications: Property	Community
   Route modifications: Action	Add
   Route modifications: Value	100:100

   

4. Select Add, and then select Save. Wait until Provisioning state shows Succeeded.

Apply the route map to the NVA peering

The NVA is in the same virtual network as Route Server, so apply the route map to the existing BGP peering. You don't need to create a virtual network connection.

1. Select Apply Route-maps to connections.

2. For Outbound Route-map, select rmap-hub100-nva. Preserve the existing inbound policy.

3. Select rs1/hub100-nva. Its Connection type is Hub BGP Peering.

   

4. Select Save. After the operation completes, refresh the page and confirm the outbound association.

Verify the route advertisements

Under Routing, open Connections Dashboard. For each connection, select In the outbound direction under View routes for Route-maps applied. Display both IP versions, and compare the results with the baseline routes.

ExpressRoute connection

Select ExpressRoute for the connection type and er-conn100 for the connection.

VPN connections

Select VPN for the connection type. Select vpn-gw-to-site20-1, and then repeat the checks for vpn-gw-to-site20-2.

The following example shows the first VPN connection. Other routes, such as the hub virtual network prefixes, can also appear.

NVA BGP peering

Select the hub BGP peering connection type, shown as Hub Bgp Peers in the dashboard, and then select hub100-nva.

If a result differs, check the selected connection and direction, provisioning state, rule order, and baseline route advertisements. For more information, see Troubleshoot route maps. Check routes at the receiving peer when you need to verify propagation beyond Route Server.

Restore the previous route-map associations

If you applied these policies only for testing, restore the outbound route-map association you recorded for each connection. On Apply Route-maps to connections, select the previous outbound route map, or None if there was no previous association. Preserve the inbound policy, select the intended connection, and save. Repeat for connections with different previous policies.

Verify the resulting advertisements after restoring the associations. Don't delete the existing gateways, NVA, or Route Server to remove an example policy.

Related content

• Enable IPv4/IPv6 dual-stack mode on Azure Route Server
• Configure dual-stack Azure Route Server with PowerShell
• About route maps for Azure Route Server
• Configure route maps for Azure Route Server
• View effective routes