Using Azure Advertised Gateway Prefixes for Route Management

Managing large Azure hub-and-spoke structures often involves advertising numerous routes to on-premises networks. By standard practice, Azure VPN Gateway and ExpressRoute Gateway will broadcast the address ranges of both the hub virtual network and any connected spoke virtual networks utilising gateway transit. As you add more spokes and address spaces, the BGP (Border Gateway Protocol) route table can become quite extensive.

To simplify this, Azure offers a feature called Advertised Gateway Prefixes. This allows you to consolidate multiple Azure routes into a more manageable format. You can set this feature from the hub virtual network using the summarizedGatewayPrefixes property, which appears in the Azure portal as Advertised Gateway Prefixes.

Advantages of Using Advertised Gateway Prefixes

• Reduced BGP Prefixes: Combine numerous individual networks into one or more aggregated CIDR blocks.
• Improved Scalability: Keep large hub-and-spoke designs within the advertised-prefix limits.
• Clearer Route Visibility: Make it easier to identify the intended Azure address plan in both provider and on-premises route views.

In this blog post, we’ll guide you through how to leverage Advertised Gateway Prefixes to summarise your Azure advertised prefixes into a single entry.

Understanding Advertised Gateway Prefixes

Advertised gateway prefixes are summarised CIDR blocks that your Azure hybrid gateway shares with your on-premises network, rather than sending all individual hub and spoke address spaces. This configuration is managed on the gateway virtual network, typically the hub VNet that includes the GatewaySubnet and either an ExpressRoute or VPN gateway.

Default Behaviour vs. With Advertised Gateway Prefixes

Consider the following example:

Hub: 10.27.0.0/24

Spoke 1: 10.27.1.0/24

Spoke 2: 10.27.2.0/24

Spoke 3: 10.27.3.0/24

Summary: 10.27.0.0/22

Without summarisation, four individual prefixes are advertised. With summarisation, only one prefix is shown, while any spoke that isn’t included in the summary remains advertised separately, such as 172.16.1.0/24.

When to Use Advertised Gateway Prefixes

• If you employ a hub-and-spoke model with gateway transit and have multiple spoke address spaces.
• If you prefer to advertise a broader prefix, like a /16, in lieu of numerous smaller /24 networks.
• If you are nearing ExpressRoute advertised-prefix limits or wish to manage route-table expansion proactively.
• If your Azure address plan is structured well enough to create safe and intentional summarised ranges.

Note: According to Microsoft documentation, the maximum limit for advertised prefixes is 1,000 for IPv4 and 100 for IPv6 on a single ExpressRoute connection via private peering. Exceeding these limits may lead to a disconnection of the circuit and gateway until you reduce the prefix count.

Requirements for Implementation

• A hub virtual network configured with a GatewaySubnet.
• Deployment of either an ExpressRoute gateway or VPN gateway within your hub virtual network.
• One or more peered spoke virtual networks if you want to demonstrate route summarisation across these spokes.
• A planned summary in IPv4 and, if necessary, IPv6 that encompasses the intended hub and spoke address ranges.
• Access to the BGP route view on your provider or on-premises for validation purposes. In this tutorial, we will use Megaport for external verification.

Configuration Steps in Azure Portal

It’s important to configure the hub VNet and not the ExpressRoute circuit or individual spokes. Here’s how to set it up:

1. Open the Azure portal and search for Virtual networks.
2. Select the hub VNet that includes the GatewaySubnet.
3. In the hub virtual network settings, click on Address space.
4. Under Advertised gateway prefixes, click + Add prefix. Enter the collective CIDR, like 10.0.0.0/22 to encompass four adjacent /24 networks.
5. If applicable for a dual-stack design, add the IPv4 and IPv6 summarised prefixes separately.
6. Select Save and confirm that the summarised prefixes are listed in the Advertised gateway prefixes section.

Validating Your Configuration

Once Azure applies the changes and BGP converges (in this case using ExpressRoute and Megaport), you can log into your router or view the incoming BGP routes through your provider’s interface to verify which routes Azure is sending.

Here’s what to do:

1. Take a screenshot before enabling the feature to document the individual hub and spoke prefixes.
2. After configuration, refresh your route view and look for the new summarised prefix.
3. Ensure that the hub and spoke prefixes covered by the summary are no longer advertised individually.
4. Check that any address space outside the configured summary remains advertised separately.

Before and After Example

In my demonstration environment, I have a hub along with 20 spokes, all within the 10.27.0.0/16 address prefix. Initially, I received 21 prefixes at Megaport. After enabling the feature, I now see just one prefix.

Key Takeaways

• Configuration Location: Always configure the hub, not the spokes. Only the virtual network containing the GatewaySubnet can use the summarizedGatewayPrefixes property for this functionality.
• No Overlap: Do not add overlapping entries in the advertised gateway prefixes.
• Keep Uncovered Networks Visible: If any hub or spoke address space isn’t included in a summary, the gateway will still advertise it individually.
• Explicit Dual-Stack Planning: IPv4 and IPv6 summaries need to be entered separately.
• Restoration of Default Behaviour: If all advertised gateway prefixes are removed, Azure will revert to advertising hub and peered spoke address spaces individually.
• Protect On-Premises Edge: Use appropriate routing policies to ensure only expected prefixes are accepted. Although summarisation simplifies advertisements, it doesn’t replace the need for routing governance.

Advertised Gateway Prefixes provide an efficient way for Azure networking teams to manage route scaling from a gateway-enabled hub VNet. By summarising prefixes, you can drastically reduce the complexity of the routes advertised across ExpressRoute or VPN connections, all while keeping uncovered address spaces visible for compatibility.

FAQs

What are Advertised Gateway Prefixes?

Advertised Gateway Prefixes are summarised CIDR blocks that your Azure hybrid gateway can advertise to on-premises networks, reducing the number of individual prefixes transmitted.

Why should I use them?

They simplify route management, reduce the number of advertised prefixes, and help keep your network structured as it scales.

Where do I configure Advertised Gateway Prefixes?

You configure them in the hub virtual network. This is the only place where the summarizedGatewayPrefixes property can be applied.

Can I have overlapping entries in the prefix list?

No, overlapping entries are not permitted in the advertised gateway prefixes list.

What happens if I remove all entries?

Removing all entries will revert Azure back to advertising hub and peer address spaces individually.