Can we advertise default route from on-prem to azure vnet over express route

Pawan Raut 0 Reputation points
2026-06-15T17:52:29.6133333+00:00

We have Hub and Spoke Virtaul Networks setup. We have a requirement that all internet destination traffic should go to on-prem over Azure expess route, Can we advertise the default route (0.0.0.0/0) from on-prem to azure over express route

Azure ExpressRoute
Azure ExpressRoute

An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. SUNOJ KUMAR YELURU 18,736 Reputation points MVP Volunteer Moderator
    2026-06-18T14:41:57.9766667+00:00

    Hello @Pawan Raut,

    Thank you for reaching out Q&A forum.

    Yes, you can advertise a default route (0.0.0.0/0) from on-premises to Azure VNets over ExpressRoute Private Peering

    It Works — Hub & Spoke Topology

    On-Prem Router
  └── Advertises 0.0.0.0/0 via BGP
        └── ExpressRoute Circuit
              └── ExpressRoute Gateway (Hub VNet)
                    ├── Hub VNet (route propagated)
                    └── Spoke VNets (requires UDR or peering propagation)

    Recommended Configuration Steps

    1. On-prem CE router: Advertise 0.0.0.0/0 on the BGP session toward the ExpressRoute Private Peering.
    2. Hub VNet Gateway Subnet: Ensure route table on GatewaySubnet does not have conflicting UDRs (avoid putting UDRs on GatewaySubnet unless absolutely necessary).
    3. Hub VNet other subnets: Enable BGP route propagation OR add explicit UDR for 0.0.0.0/0 → Virtual Network Gateway.
    4. VNet Peerings (Hub ↔ Spoke):
      • Hub: Allow Gateway Transit = ON
      • Spoke: Use Remote Gateways = ON
    5. Spoke Subnets: Apply UDR with 0.0.0.0/0 → Virtual Network Gateway (or NVA IP in hub) to ensure internet traffic takes the correct path.
    6. Verify with Effective Routes: Use the Azure portal → NIC → Effective Routes to confirm the default route shows up as learned from the ExpressRoute gateway.

    If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

    Was this answer helpful?

    0 comments
  2. Venkatesan S 10,830 Reputation points Microsoft External Staff Moderator
    2026-06-15T18:15:46.01+00:00

    Hi Pawan Raut,

    Thanks for reaching out in Microsoft Q&A forum,

    Yes, you can advertise the default route (0.0.0.0/0) from your on-premises network to Azure over ExpressRoute private peering to implement forced tunneling for internet-bound traffic. This is a supported Azure networking design.

    You advertise 0.0.0.0/0 via BGP from your on-premises edge routers to Azure through the ExpressRoute private peering. Azure workloads that learn this route will send internet-bound traffic to on-premises over ExpressRoute instead of using Azure's default internet route.

    • GatewaySubnet limitation: User-defined routes (UDRs) with 0.0.0.0/0 are not supported on the GatewaySubnet, Azure ignores them. However, a BGP-advertised default route over ExpressRoute is fully supported and is the recommended method for forced tunneling.
    • Hub-and-spoke route propagation: In your Hub-and-Spoke topology, routes learned through the ExpressRoute gateway in the hub will propagate to spoke VNets when you configure VNet peering with:
      • Hub: Allow gateway transit = true
      • Spokes: Use remote gateways = true
    • On-premises route advertisement: While not strictly required, it's highly recommended to advertise your specific on-premises network prefixes alongside 0.0.0.0/0 so Azure resources can properly reach on-premises destinations.
    • Failover consideration: If the default route is withdrawn (due to outage or misconfiguration), Azure may revert to the system internet route. If you must completely prevent internet access during such events, consider additional controls like NSGs, Azure Firewall, custom route tables, or route propagation controls based on your design.

    Configuration:

    1. Configure your on-premises BGP routers to advertise 0.0.0.0/0 and your required on-premises prefixes over ExpressRoute private peering.
    2. Deploy an ExpressRoute gateway in the Hub VNet.
    3. Configure VNet peering with allow gateway transit on the hub and use remote gateways on the spokes.
    4. (Optional) If traffic must pass through an Azure Firewall or NVA before reaching on premises, configure UDRs on workload subnets to direct traffic to the firewall/NVA.

    This design is commonly referred to as forced tunneling and is officially supported by Azure ExpressRoute.

    References:

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please do not forget to 210246-screenshot-2021-12-10-121802.pngand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    Was this answer helpful?

    0 comments

  3. AI answer

    2026-06-15T17:52:44.34+00:00

    Yes, advertising a default route (0.0.0.0/0) from on-premises to Azure over ExpressRoute is supported and is the standard way to force all internet-bound traffic from Azure virtual networks back to on-premises.

    Key points:

    1. Supported over ExpressRoute
      ExpressRoute supports advertising a default route (0.0.0.0/0) via BGP from on-premises. When this route is received by Azure, all traffic to destinations not otherwise matched by more specific prefixes will be sent over the ExpressRoute circuit to on-premises.
    2. Effect on internet access from Azure
      When 0.0.0.0/0 is advertised from on-premises:
      • Internet connectivity from VMs in virtual networks linked to the ExpressRoute circuit is effectively blocked directly from Azure.
      • All such traffic is forced over ExpressRoute to on-premises, where it must be routed/NATed out to the internet by on-premises infrastructure.
    3. Fallback behavior if the default route is withdrawn
      If the advertised 0.0.0.0/0 route is withdrawn (for example, due to outage or misconfiguration), Azure automatically falls back to its system route to the internet for those virtual networks. To ensure internet egress remains blocked in such a failure scenario, outbound deny rules should be configured using Network Security Groups on the relevant subnets.
    4. Impact on Microsoft peering traffic
      When a default route is advertised over ExpressRoute, traffic to services offered over Microsoft peering (for example, Azure Storage, Azure SQL Database) is also forced back to on-premises unless service endpoints or other Azure-native mechanisms are used to keep that traffic within the Azure backbone.

    In summary, advertising 0.0.0.0/0 from on-premises to Azure over ExpressRoute is supported and is the correct approach to send all internet-bound traffic from Azure VNets to on-premises for egress and inspection.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.