About route maps for Azure Route Server

Route maps for Azure Route Server give you control over route advertisements and routing behavior. You can apply route maps to BGP peerings with network virtual appliances (NVAs), ExpressRoute and VPN gateway connections in the same virtual network, and virtual network connections for peered spokes. Route maps process routing information, not data packets.

You can create route maps and apply them to BGP peerings by using the Azure portal or Azure PowerShell. To apply route maps to gateway and virtual network connections, use the Azure portal. For configuration steps, see How to configure route maps.

The following diagram shows how inbound and outbound route maps process routes as they enter and leave Azure Route Server. Each route map evaluates match conditions, and then either drops a matched route or permits it with optional attribute modifications. Routes that no rule matches are permitted unchanged.

Why use route maps?

Route maps provide the following key benefits:

• Route summarization: Summarize routes when your on-premises networks connect to your virtual network through ExpressRoute or VPN, and you're limited by the number of routes that can be advertised to or from Azure Route Server.
• Route control: Control routes entering and leaving your Azure Route Server deployment between on-premises networks, NVAs, and virtual networks.
• Path selection: Modify BGP attributes such as the AS path to make a route more or less preferable. When destination prefixes are reachable through multiple paths, you can use the AS path to control best path selection.
• Route tagging: Tag routes by using the BGP community attribute to manage routes more easily.

Where you can apply route maps

Azure Route Server acts as a routing engine that manages route distribution between NVAs, virtual network gateways, and Azure's routing infrastructure. Route maps let you perform route aggregation, route filtering, and BGP attribute modification (AS path and community) to manage routes and routing decisions.

You can configure route maps for the following resources:

• BGP peerings: A route map can be applied to BGP peerings between Azure Route Server and your network virtual appliances (NVAs).
• ExpressRoute gateway connection: The route server's connection to the ExpressRoute gateway in the same virtual network.
• VPN gateway connection: The route server's connection to the VPN gateway in the same virtual network.
• Virtual network connection: The route server's connection to a peered spoke virtual network, subject to the virtual network peering requirements.

When Route Server is in a hub virtual network and an NVA is in a peered spoke, create a virtual network connection for that spoke to associate a route map with the routes exchanged with the spoke NVA. The connection doesn't create or replace virtual network peering or BGP peering. Create a route map before you create this connection. For an NVA in the same virtual network as Route Server, apply the route map to the existing BGP peering instead; a separate virtual network connection isn't required.

For a worked example, see Apply route maps to an NVA in a spoke virtual network.

You can apply a route map in the inbound or outbound direction on any of these connections:

• Inbound route map: Applied to routes received by Azure Route Server from a BGP peering, ExpressRoute gateway, VPN gateway, or virtual network connection.
• Outbound route map: Applied to routes sent from Azure Route Server to a BGP peering, ExpressRoute gateway, VPN gateway, or virtual network connection.

For a virtual network connection, inbound route-map processing includes the spoke's configured address prefixes and BGP routes advertised by an NVA in that spoke. This inbound scope is different from the limitation on modifying or filtering the Route Server's own virtual network address space when Route Server advertises it to BGP peers.

Route maps support the following route manipulation capabilities:

• Route aggregation: Reduce the number of routes coming in or out of a connection by summarizing them. For example, 10.2.1.0/24, 10.2.2.0/24, and 10.2.3.0/24 can be summarized as 10.2.0.0/16.
• Route filtering: Exclude routes advertised or received from BGP peerings, ExpressRoute gateway connections, VPN gateway connections, and virtual network connections.
• BGP attribute modification: Modify the AS path and BGP communities. You can add or set autonomous system numbers (ASNs).

What are route-map rules?

A route map is an ordered sequence of one or more route-map rules that Azure Route Server applies to routes it receives or sends. Route-map rules consist of match conditions and actions.

When you configure a route-map rule, use the Next step setting to specify whether routes that match this rule continue to be processed by subsequent rules in the route map, or stop (terminate). After you configure route-map rules for the route map, you can apply the route map to BGP peerings and gateway connections.

Consider the following points:

• You can configure any number of route modifications in a route-map rule. It's possible to have a route map without any rules.
• If a route map rule has no actions, the routes remain unaltered.
• If a route map rule has multiple modifications, Azure applies all configured actions to the route. The order of the actions isn't relevant.
• If a route doesn't match all the match conditions in a rule, the route isn't considered a match for that rule. The route passes to the next rule in the route map, regardless of the Next step setting.
• To avoid unintended traffic flows, configure rules to match only the routes you intend.

Match conditions

Route maps let you match routes by using route prefix, BGP community, and AS path. Match conditions are the conditions that a processed route must meet to be considered a match for the rule.

• You can configure any number of match conditions in a route-map rule.

• If you create a route map without a match condition, all routes from the applied connection are matched.

  For example, a BGP peering has routes 10.2.1.0/24, 10.2.2.0/24, and 10.2.3.0/24 being advertised from an NVA to Azure Route Server. A route map without a match condition matches 10.2.1.0/24, 10.2.2.0/24, and 10.2.3.0/24.

• If a route map has multiple match conditions, a route must meet all the match conditions to be considered a match for the rule. The order of the match conditions isn't relevant.

  For example, a BGP peering has routes 10.2.1.0/24 with an AS path of 65535 and a BGP community of 65535:100 being advertised from an NVA to Azure Route Server. If you create a route-map rule with a match condition for prefix 10.2.1.0/24, and another match condition for AS path 65535, both conditions need to be met to be considered a match.

• Azure Route Server supports multiple rules. If the first rule isn't matched, then the second rule is evaluated. Select Terminate in the Next step field to end the list of rules in the route map. When no rule is matched, the default is to allow, not to deny.

Actions

Match conditions select a set of routes. After the routes are selected, you can drop or modify them. Each rule has one Action on matched routes setting: Drop or Modify. When you select Drop, the rule's Route modifications table is unavailable. You can configure the following actions:

• Drop: Drop all the matched routes (filter them out) from the route advertisement. For example, a BGP peering advertises routes 10.2.1.0/24, 10.2.2.0/24, and 10.2.3.0/24 from an NVA to Azure Route Server. You can configure a route map to drop 10.2.1.0/24 and 10.2.2.0/24, so only 10.2.3.0/24 is advertised.
• Modify: Modify routes by aggregating route prefixes or changing route BGP attributes. For example, a BGP peering has routes 10.2.1.0/24 with an AS path of 65535 and a BGP community of 65535:100. You can configure a route map to add the AS path [64510, 64511].

Supported configurations for route-map rules

The following tables show the match conditions and actions that route maps support.

Match conditions

Route modifications

Considerations and limitations

Before you use route maps, consider the following limitations:

• Route summarization strips the BGP community and AS path attributes from summarized routes. This limitation applies to both inbound and outbound routes.

• Don't use private ASNs for AS prepending when you apply route maps in either direction on ExpressRoute connections, because ExpressRoute strips private ASNs.

• Don't use ASNs reserved by Azure for AS prepending:

  • Public ASNs: 8074, 8075, 12076
  • Private ASNs: 65515, 65517, 65518, 65519, 65520

• Don't remove the Azure BGP communities:

  • 65517:12001, 65517:12002, 65517:12003, 65517:12005, 65517:12006, 65518:65518, 65517:65517, 65517:12076, 65518:12076, 65515:10000, 65515:20000

• Route maps only supports 2-byte ASN numbers.

• You can modify the default route only when the default route comes from on-premises or an NVA.
• You can't use route maps to modify or filter the virtual network address space that Azure Route Server advertises.
• Route maps support only route summarization. Don't use route maps to create more specific routes.
• You can't apply route maps on the Microsoft Enterprise Edge (MSEE) for ExpressRoute connections.
• Azure Route Server doesn't support point-to-site (P2S) configurations on Azure VPN Gateway. If the Azure VPN gateway has a P2S configuration, route map creation on Route Server fails.
• The first time you create a route map on an Azure Route Server, the route server undergoes an upgrade that can take up to 30 minutes.
• Using route maps incurs extra charges. For more information, see Azure Route Server pricing.

Related content

• View effective routes
• How to configure route maps
• Prepend routes by using route maps
• Tag routes with BGP communities by using route maps
• Drop inbound routes by using route maps
• Apply route maps to an NVA in a spoke virtual network
• What is Azure Route Server?
• Azure Route Server FAQ
• Configure and manage Azure Route Server