ExpressRoute connectivity issues. BGP up. Routes are not propagated

Hello **maapinho,
**
From what you’re describing, this looks like a routing/route-programming issue on the Azure side (or an Azure gateway/pairing configuration mismatch), not a “VM subnet route table” problem—because:

• You have BGP up on the ExpressRoute connection but 0 prefixes are received.
• The VM can’t even ping the ExpressRoute point-to-point IPs (including the Microsoft-side IP).
• On-prem can ping the ExpressRoute point-to-point IPs, but you don’t see/receive routes from on-prem into Azure.

Below are the first Azure-side checks that commonly explain “BGP up but no prefixes / no traffic back to Azure edge”.

1) Confirm the ExpressRoute circuit + peering provisioning/state

In the Azure portal, validate:

• CircuitProvisioningState: Enabled
• ServiceProviderProvisioningState: Provisioned

If the circuit is not enabled or the provider peering isn’t provisioned correctly, you can see BGP state inconsistencies and route programming failures. Also confirm the private peering context is provisioned and shows the primary/secondary point-to-point subnets.

2) Run the Azure portal ExpressRoute diagnostic for Private peering

Azure provides a guided test for this exact scenario.

Path:

• Go to your ExpressRoute circuit resource
• Diagnose and solve problems
• Connectivity & Performance issues
• Issues with Private peering
• Test private-peering connectivity

This diagnostic uses a PsPing-style approach. The important part is how it reports sent/received matches across the MSEE devices. In particular:

• If you see traffic leaving but not returning, it indicates return-path/routing problems or Azure-side routing overrides.
• If you see no received matches, it usually points to routing reachability or programming issues.

3) Validate MSEE/CE/PE-A side pairing parameters (VLAN/ASNs/subnets)

Even with “BGP up”, a mismatch in the peering-facing configuration can prevent proper route programming.

Check that the MSEE-side configuration matches your CE/PE:

• VlanId
• AzureASN
• PeerASN
• Primary and secondary point-to-point subnet ranges
• If MD5 hashing is used: the shared key must match (and mismatches can cause instability, flaps, or unexpected behavior)

If any of these don’t match, the MSEE may not learn/program prefixes correctly.

4) Check whether NSGs / ACLs are blocking the traffic to the gateway/peering path

Because your VM can’t ping even the ExpressRoute point-to-point IPs, make sure nothing is blocking the required traffic. Per Azure guidance, inspect:

• NSGs applied to the VM subnet and/or NIC
• Any firewall/ACL equivalents on the VM subnet path

(When routing tests fail, NSG misconfiguration is still a frequent cause.)

5) Check Azure-side effective routes and whether a UDR/NVA overrides ExpressRoute preference

Even though you said route propagation is enabled and there are no static/UDR routes configured, double-check:

• The route table(s) that apply to the VM subnet (including any inherited/implicit associations)
• Whether there’s any UDR or NVA impact that could override the ExpressRoute-learned next hop

Azure guidance explicitly notes that effective routes can be overridden by UDRs/NVAs, which can result in missing on-prem routes on the VM.

6) Confirm what the MSEE actually learned (route table on MSEE)

If the issue is “BGP up but 0 prefixes received”, validate directly what Azure’s MSEE has for the private peering.

Use:

Get-AzExpressRouteCircuitRouteTable `
  -DevicePath Primary `
  -ExpressRouteCircuitName <CircuitName> `
  -PeeringType AzurePrivatePeering `
  -ResourceGroupName <ResourceGroupName>

If the MSEE has no matching prefixes despite on-prem advertising them, you’ll want to focus on:

• peering/pairing parameters (Step 3)
• private peering return-path checks (Step 2)
• any policy/filtering on the provider/CE side that could be advertising but not being accepted on the peering (still consistent with “BGP up” depending on local behavior).

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.