Peer Azure Route Server with the Azure VPN Gateway failed (using the VPN Gateway BGP ASN and BGP Peering IP).

Question

Peer Azure Route Server with the Azure VPN Gateway failed (using the VPN Gateway BGP ASN and BGP Peering IP).

Kaushal, Pravesh 125

Hi team,

While an Expressroute circuit is recommended, connecting to AVS from on-premises with IPsec using a transit hub VNET in Azure is also possible and this scenario requires a VPN gateway and Azure Route Server.

I am trying to follow the recommended approach outlined below, but I’m getting stuck at one step. Could you please help take a look?

My Recommended Approach with Azure Route Server

Deploy Azure Route Server into a dedicated /26 subnet (RouteServerSubnet) within the same Hub VNet.
Enable branch-to-branch traffic on Route Server to support transitive routing between the VPN Gateway and AVS ExpressRoute.
Create BGP peering relationships:
Peer Azure Route Server with the Azure VPN Gateway (using the VPN Gateway BGP ASN and BGP Peering IP).
Peer Azure Route Server with the AVS ExpressRoute (using the AVS BGP ASN and BGP Peering IP).

However, when I attempted to create the BGP peering relationship(Step 4) the operation failed.

Specifically, I was trying to peer the Azure Route Server with the Azure VPN Gateway using the VPN Gateway’s BGP ASN and BGP Peering IP.

Could you please advise what might be causing the issue or what I should check next?

Kaushal, Pravesh 125 Reputation points

2025-11-24T22:06:53.14+00:00

Everytime BGP peering attempt on azure route server with the VPN Gateway was made but was unsuccessful.

Error : Failed to add Peer 'connection-CH'. Error: HubBgpConnection rg-conn/providers/Microsoft.Network/virtualHubs/rs-conn-uks/bgpConnections/connection-CH'>rs-conn-uk/connection-CH peer ip x.x.x.x conflicts with internal Virtual Hub peer ip.

It is possible that route propagation may occur automatically on the backend?
Kaushal, Pravesh 125 Reputation points

2025-11-26T10:09:30.5933333+00:00

@Ganesh Patapati Thanks a lot for the information. I just need to confirm whether I should add a BGP peer to the Route Server when an Azure Firewall is in place?
Kaushal, Pravesh 125 Reputation points

2025-12-02T15:31:12.7066667+00:00

@Ganesh Patapati I am not able to access the AVS vCenter. It should be connected now since we are connected via VPN, right? Is a jump box still required?
Ganesh Patapati 12,170 Reputation points Microsoft External Staff Moderator

2025-12-03T13:03:54.7666667+00:00

Hello Kaushal, Pravesh

Thanks for the reply!

I have Initiated a private message with you. Kindly provide the necessary details in the private chat.

Answer accepted by question author

0 additional answers

Your answer

Kaushal, Pravesh 125 Reputation points

2025-11-24T22:06:53.14+00:00

Everytime BGP peering attempt on azure route server with the VPN Gateway was made but was unsuccessful.

Error : Failed to add Peer 'connection-CH'. Error: HubBgpConnection rg-conn/providers/Microsoft.Network/virtualHubs/rs-conn-uks/bgpConnections/connection-CH'>rs-conn-uk/connection-CH peer ip x.x.x.x conflicts with internal Virtual Hub peer ip.

It is possible that route propagation may occur automatically on the backend?
Kaushal, Pravesh 125 Reputation points

2025-11-26T10:09:30.5933333+00:00

@Ganesh Patapati Thanks a lot for the information. I just need to confirm whether I should add a BGP peer to the Route Server when an Azure Firewall is in place?
Kaushal, Pravesh 125 Reputation points

2025-12-02T15:31:12.7066667+00:00

@Ganesh Patapati I am not able to access the AVS vCenter. It should be connected now since we are connected via VPN, right? Is a jump box still required?
Ganesh Patapati 12,170 Reputation points Microsoft External Staff Moderator

2025-12-03T13:03:54.7666667+00:00

Hello Kaushal, Pravesh

Thanks for the reply!

I have Initiated a private message with you. Kindly provide the necessary details in the private chat.

Answer 1

Hello Kaushal, Pravesh

When you trying to “peer the hub to the VPN Gateway” manually. In Virtual WAN, the hub already exchanges routes with the VPN Gateway; adding an extra Hub BGP Connection to the gateway’s BGP IP duplicates/overlaps the built‑in peering and hits the conflicts.

In a Hub VNet design, Azure Route Server (ARS) does not use manual BGP peering to Azure VPN Gateway or ExpressRoute Gateway. The peering with those Azure‑managed gateways is created and managed automatically by the platform once ARS is deployed in the same VNet and route exchange (“branch‑to‑branch”) is enabled. Trying to “add a BGP peer” from ARS to the VPN Gateway will fail.

Instead of manual peering,

deploy ARS in RouteServerSubnet (/26) in the Hub VNet and enable Route exchange. ARS will then automatically exchange routes with the VPN Gateway and (if present) the AVS ExpressRoute gateway—allowing transitive routing among on‑prem ↔ AVS ↔ NVAs.

User's image

Refer this article: https://learn.microsoft.com/en-us/azure/route-server/expressroute-vpn-support

How route exchange works

When you deploy Azure Route Server in a virtual network alongside virtual network gateways and NVAs, route exchange enables these components to share routing information dynamically.

Default Behavior

By default, Azure Route Server doesn't propagate routes between different types of network components. Each component (NVA, ExpressRoute gateway, VPN gateway) only exchanges routes directly with the route server.

NOTE: Attempting to manually add a BGP peer between ARS and Azure VPN Gateway (using the gateway’s BGP ASN/IP) will fail because those sessions are service‑managed, not user‑defined.

Do not try to peer ARS with Azure VPN Gateway—that combination isn’t supported. ARS is for peering with NVAs in your VNet; VPN Gateway does BGP with your on‑premises device via the VPN connection itself. Use vWAN if you need hub‑managed transit between spokes/gateways, or keep ARS for NVA scenarios only.

Does route propagation happen automatically?

Yes—in Virtual WAN hubs, route propagation between hub connections (e.g., VPN sites, ER circuits, spoke VNets) is managed by the service. You don’t need (and must not attempt) an extra Hub BGP Connection to the Azure‑managed gateways

I hope this has been helpful!

If above is unclear and/or you are unsure about something add a comment below.