Viewing BGP sessions on VGW & RouteServer

Question

Viewing BGP sessions on VGW & RouteServer

Robert Adams 0

I didn't set this up, just trying to understand it.

I have a Virtual Network Gateway that has BGP peering sessions with my RouteServer.

In VNG --> Configuration, the "Configure BGP" box is NOT checked, unsure why
In VNG --> Monitoring --> BGP Peering, I can see the peers in 65515 but am unable to configure or modify any peering.

"enableBgp": false,
"enableHighBandwidthVpnGateway": false,
"activeActive": true,
"bgpSettings": {
  "asn": 65515,
  "bgpPeeringAddress": "0.0.0.0,0.0.0.0",
Peer Addr	Local Addr	Status	Routes Received

		Conn	34	

		Conn	34

		Conn	31

		Conn	31

On my Route server I have:  
Route Server IP addresses: PII

In Settings --> Peers, I can see 1 BGP peer but it's to a different device.  I **am able** configure BGP peering here but I don't see the endpoint of the BGP sessions to my VNG, even though they are connected on the VNG.

What am I missing?

Removed PII

Ravi Varma Mudduluru 12,625 Reputation points Microsoft External Staff Moderator

2026-04-20T15:01:24.8166667+00:00
Hello @ Robert Adams,

Thank you for reaching out to Microsoft Q&A.

Azure Route Server uses automated BGP peering with your Virtual Network Gateway (VPN or ExpressRoute).

The "Configure BGP" box is unchecked and enableBgp is false on the gateway (those settings only apply to manual S2S/VNet-to-VNet VPN tunnels, not Route Server).

You can see the active sessions in the gateway's BGP Peering blade (to the Route Server IPs) and routes are being exchanged.

The VNG doesn't appear as a manual peer under Route Server → Peers (you only add NVAs there).

No configuration is missing on your side the peering is handled automatically once the Route Server is deployed in the same VNet as the gateway.

Just double-check that Branch-to-branch is enabled on the Route Server (this is the only setting that actually turns on the route exchange).

Go to your Route Server → Configuration → set Branch-to-branch to Enabled and save.

If everything looks good after that, you're all set no further changes needed on the gateway.

Here are the official docs:

Azure Route Server support for ExpressRoute and Azure VPN

Configure and manage Azure Route Server

If the answer is helpful, please click "Accept answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

1 answer

Your answer

Ravi Varma Mudduluru 12,625 Reputation points Microsoft External Staff Moderator

2026-04-20T15:01:24.8166667+00:00

Hello @ Robert Adams,

Thank you for reaching out to Microsoft Q&A.

Azure Route Server uses automated BGP peering with your Virtual Network Gateway (VPN or ExpressRoute).

The "Configure BGP" box is unchecked and enableBgp is false on the gateway (those settings only apply to manual S2S/VNet-to-VNet VPN tunnels, not Route Server).

You can see the active sessions in the gateway's BGP Peering blade (to the Route Server IPs) and routes are being exchanged.

The VNG doesn't appear as a manual peer under Route Server → Peers (you only add NVAs there).

No configuration is missing on your side the peering is handled automatically once the Route Server is deployed in the same VNet as the gateway.

Just double-check that Branch-to-branch is enabled on the Route Server (this is the only setting that actually turns on the route exchange).

Go to your Route Server → Configuration → set Branch-to-branch to Enabled and save.

If everything looks good after that, you're all set no further changes needed on the gateway.

Here are the official docs:

Azure Route Server support for ExpressRoute and Azure VPN

Configure and manage Azure Route Server

If the answer is helpful, please click "Accept answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 1

The behavior comes from how Azure Route Server integrates with Azure VPN Gateway and how BGP is surfaced in each resource.

Why BGP shows as “disabled” on the VPN gateway, but sessions exist
For Azure Route Server integration, the VPN gateway must:

Be active-active, and
Use ASN 65515.

The Route Server FAQ states that for this scenario:

“Azure VPN gateway must be configured in active-active mode and have the ASN set to 65515.”
“It’s not a requirement to have BGP enabled on the VPN gateway to communicate with the Route Server.”

So the enableBgp: false flag and the unchecked “Configure BGP” box refer to customer‑configurable BGP for on‑premises/site‑to‑site. The Route Server–to–VPN gateway control-plane relationship is handled by the platform and does not require that checkbox to be enabled. That’s why BGP sessions to ASN 65515 (Route Server) are visible in Monitoring → BGP Peering even though “Configure BGP” is off.

Why BGP peers to Route Server are visible but not configurable on the VPN gateway
The BGP peering between Route Server and VPN Gateway is not user-configurable. It is a managed, internal eBGP relationship used by Route Server to learn and advertise routes via the VPN gateway. Because of that:

The VPN gateway shows BGP peer status (for observability) via Get-AzVirtualNetworkGatewayBGPPeerStatus and the portal BGP Peering blade.
The peers to Route Server cannot be edited or removed from the VPN gateway UI.

This matches the monitoring guidance for VPN Gateway, where BGP peers and learned/advertised routes are observable via:

Get-AzVirtualNetworkGatewayBGPPeerStatus (peer status),
Get-AzVirtualNetworkGatewayLearnedRoute (learned routes),
Get-AzVirtualNetworkGatewayAdvertisedRoute (advertised routes).

Why Route Server “Peers” blade doesn’t show the VPN gateway
In Route Server:

Settings → Peers is for user-defined BGP peers, typically NVAs or SD‑WAN devices.
The VPN gateway is not configured there as a normal peer; instead, it appears as a VPN next hop in Route Server’s effective routes.

The Route Server configuration article explains that Route Server learns routes from:

ExpressRoute connections,
VPN connections,
NVA BGP peers,
Spoke VNets.

In the Effective Routes view, routes learned via VPN show:

Next hop type = VPN,
Next hop = VPN gateway IP,
Origin = resource ID of the VPN gateway/connection,
AS Path = branch AS path.

So:

The Route Server–VPN Gateway BGP relationship is reflected in Effective Routes (Next hop type = VPN), not in the Peers list.
The single peer visible under Settings → Peers is your manually configured NVA/SD‑WAN/etc., not the VPN gateway.

How to “see” the relationship end-to-end

On the VPN Gateway:
- Use Monitoring → BGP Peering or Get-AzVirtualNetworkGatewayBGPPeerStatus to see the Route Server peer IPs (10.31.80.68, 10.31.80.69) and session state.
- Use Get-AzVirtualNetworkGatewayLearnedRoute / Get-AzVirtualNetworkGatewayAdvertisedRoute to see what is exchanged.
On the Route Server:
- Use Routing → Effective Routes to see prefixes whose Next hop type is VPN and Next hop is the VPN gateway IP. Those are the routes learned via the VPN gateway BGP relationship.

In summary, nothing is missing:

The VPN gateway–Route Server BGP sessions are platform-managed, visible but not configurable on the VPN gateway.
Route Server shows that relationship through effective routes (Next hop type = VPN), not as a user-configured peer in the Peers blade.

References: