“When connecting enterprise on-premises datacenters to Azure Landing Zones, asymmetric routing occurs if BGP Local Preference is not configured to prioritize ExpressRoute over VPN backup tunnels.”

While architecting hybrid cloud connectivity for financial clients at Kyndryl, outbound traffic from on-premises preferred the 10Gbps Azure ExpressRoute link, but return traffic from Azure routed across a slower IPsec VPN backup tunnel.

Architecture: BGP Local Preference & BFD Failover

This Asymmetric Routing caused stateful firewalls at the enterprise perimeter to drop return packets because the TCP SYN and ACK passed through different security appliances.

We re-engineered the BGP peering configuration on the Azure ExpressRoute Virtual Network Gateway (VNet Gateway) and on-premises Cisco ASR routers.

1. Inbound Traffic Preference (BGP Local Preference): Set BGP local-preference 200 on ExpressRoute routes and local-preference 100 on IPsec VPN routes on-premises.
2. Outbound Traffic Preference (AS-Path Prepending): Prepended our AS number 3 times (AS 65000 AS 65000 AS 65000) on the VPN BGP session to force Azure to prefer ExpressRoute.

[!IMPORTANT] Always enable BFD (Bidirectional Forwarding Detection) on Azure ExpressRoute BGP sessions to trigger sub-second circuit failover during physical fiber cuts.

# # Cisco ASR Route Map for Azure ExpressRoute BGP Local Preference
router bgp 65000
 neighbor 192.168.250.1 remote-as 12076
 neighbor 192.168.250.1 route-map AZURE-EXPRESSROUTE-IN in

route-map AZURE-EXPRESSROUTE-IN permit 10
 set local-preference 200

The Verdict

Key Takeaway

Set BGP Local Preference to Guarantee Symmetric ExpressRoute Routing.

Configuring BGP Local Preference and AS-Path Prepending ensures symmetric traffic flow across Azure ExpressRoute circuits, eliminating stateful firewall drops.