Azure Route Server not exchanging routes with VPN Gateway peer in another vnet

Hi Indi Lotey

Thanks for sharing the detailed configurations on your routing issue.

According to Microsoft documentation, BGP route propagation across peered VNets does not occur automatically. For BGP routes learned via a VPN Gateway (or ExpressRoute) in one VNet to be visible in another peered VNet, specific peering settings must be configured:

• "Allow Gateway Transit" must be enabled on the VNet that contains the VPN Gateway (in this case, VNet C).
• "Use Remote Gateway" must be enabled on the peered VNet that needs to consume the propagated routes (in this case, VNet B).

In the current setup, VNet B is peered with VNet C, but the "Use Remote Gateway" option is not enabled. As a result, BGP routes from the VPN gateway in VNet C are not being propagated to VNet B. This is why the azure route server and azure firewall in VNet B are not learning any routes from the VPN connection in VNet C.

To resolve this, we recommend updating the VNet peering configuration between VNet B and VNet C to enable both "Allow Gateway Transit" on VNet C and "Use Remote Gateway" on VNet B. This will allow BGP routes from the VPN gateway to propagate correctly and be learned by the route Server and firewall in VNet B.

Please refer the MS document: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

Sharing similar threads which confirms that the option 'use remote gateways' is intended to allow communication from a peered network to on-premises through the S2S tunnel... This option is allowed only for one peered network." https://learn.microsoft.com/en-us/answers/questions/802735/azure-vnet-peering-and-use-remote-gateways

If the above recommendations are not feasible, here are the alternative solutions and verifications.

1. Option A: Move the VPN gateway to VNet B to allow direct BGP peering with the route Server.
2. Option B: Deploy a second route server in VNet C and use UDRs to route traffic via the azure firewall in VNet B.
3. Option C: Use a network virtual appliance (NVA) or manually configure UDRs to route traffic through the firewall.

• Check that "Allow forwarded traffic" is enabled in the VNet peering settings.
• Review effective routes on a VM in VNet B to confirm whether any routes from VNet C are visible.
• Inspect firewall logs to verify if traffic from VNet C is reaching the firewall.

I hope this information is helpful! If my answer helped you resolve your issue, please consider marking it as the correct answer or Upvote. This helps others in the community find solutions more easily. Thanks!

hi Indi Lotey! thanks for posting this, its a tricky one but we all with u will figure it out ))

let's tackle the microsoft side of things. since u have 'use remote gateway' enabled between vnet A and B but not between B and C, that might be the snag. the vpn gateway in vnet C needs to know about the route server in vnet B. try enabling 'use remote gateway' on the vnet B to C peering as well. microsoft peering config.

check the bgp peering status between the route server and vpn gateway. if it's stuck in 'provisioned', give it a kick by deleting and recreating the peering. sometimes azure just needs a little nudge ):)

now for the general stuff that works, bgp can be picky about routes, so make sure u dont have any overlapping ip ranges between vnets. aha, and check the firewall logs again after making these changes. if traffic still ghosts u, maybe the firewall rules need a tweak. this might help in other tools too, always worth looking into.

and one more thing..... the route tables u set up sound good, but just in case, verify the next hop is correctly pointing to the firewall's private ip. sometimes its the small things that trip us up )

keep us posted if this doesnt do the trick, yeah? happy troubleshooting :)

Best regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment

https://ctrlaltdel.blog/

hi there Indi Lotey, and thanks for posting this detailed question, its super helpful for debugging ))

Make sure the bgp peering between route server and vpn gateway is actually established. sometimes it shows 'provisioned' but still needs a nudge. try resetting the bgp sessions on both sides. check that the vpn gateway in vnet C has 'bgp enabled' turned on (sounds obvious but we've all missed it before lol).

as well check the route server logs in vnet B, they often tell u exactly why it's not accepting routes. u might see something like 'as path loop detected' or 'invalid next hop' that gives u the clue.

now for stuff that works across any cloud platform... make 100% sure the firewall isn't blocking the bgp port 179 traffic between vnets. even if rules say 'allow', sometimes security policies override quietly. worth running a quick packet capture on the firewall to confirm bgp packets are actually making it through. this might help in other tools too when u hit similar issues.

when vnet peering gets complicated, try simplifying the topology temporarily. maybe test with just vnet B and C connected directly without the firewall first. if that works, u know where to focus troubleshooting ))

and pls pls dont forget the basic but crucial step, verify all private IPs u configured for bgp peers are actually correct. one typo in an IP and nothing talks )) we've all been there.

microsoft really did a good job with route server diagnostics btw, their new troubleshooting guide covers exactly this scenario [microsoft route server vpn integration]. give it a look when u have a minute.

keep us posted :)

Best regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment

https://ctrlaltdel.blog/

Hi G Sree - unfortunaetly i cannot enable the "use remote gateway" option on the peering from vnet B to C because I already have that option selected in the peering from vnet B to A (you cant have 2 gateways in a vnet).

Could you please give me some more details around option 2 in your response?:
Option B: Deploy a second route server in VNet C and use UDRs to route traffic via the azure firewall in VNet B.
Would the second route server have direct BGP peering with the first route server and also BGP peering with the VPN Gateway private IP in vnet C?***

Many thanks

Thanks Alex - unfortunaetly i cannot enable the "use remote gateway" option on the peering from vnet B to C because I already have that option selected in the peering from vnet B to A (you cant have 2 gateways in a vnet).

Will check youre other suggestions ...