Configure route filters for Microsoft peering: Azure portal
Route filters are a way to consume a subset of supported services through Microsoft peering. The steps in this article help you configure and manage route filters for ExpressRoute circuits.
Dynamics 365 services, and Office 365 services such as Exchange Online, SharePoint Online, and Skype for Business, and Azure services such as storage and SQL DB are accessible through Microsoft peering. When Microsoft peering is configured in an ExpressRoute circuit, all prefixes related to these services are advertised through the BGP sessions that are established. A BGP community value is attached to every prefix to identify the service that is offered through the prefix. For a list of the BGP community values and the services they map to, see BGP communities.
If you require connectivity to all services, a large number of prefixes are advertised through BGP. This significantly increases the size of the route tables maintained by routers within your network. If you plan to consume only a subset of services offered through Microsoft peering, you can reduce the size of your route tables in two ways. You can:
Filter out unwanted prefixes by applying route filters on BGP communities. This is a standard networking practice and is used commonly within many networks.
Define route filters and apply them to your ExpressRoute circuit. A route filter is a new resource that lets you select the list of services you plan to consume through Microsoft peering. ExpressRoute routers only send the list of prefixes that belong to the services identified in the route filter.
About route filters
When Microsoft peering is configured on your ExpressRoute circuit, the Microsoft edge routers establish a pair of BGP sessions with the edge routers (yours or your connectivity provider's). No routes are advertised to your network. To enable route advertisements to your network, you must associate a route filter.
A route filter lets you identify services you want to consume through your ExpressRoute circuit's Microsoft peering. It is essentially a white list of all the BGP community values. Once a route filter resource is defined and attached to an ExpressRoute circuit, all prefixes that map to the BGP community values are advertised to your network.
To be able to attach route filters with Office 365 services on them, you must have authorization to consume Office 365 services through ExpressRoute. If you are not authorized to consume Office 365 services through ExpressRoute, the operation to attach route filters fails. For more information about the authorization process, see Azure ExpressRoute for Office 365. Connectivity to Dynamics 365 services does NOT require any prior authorization.
Microsoft peering of ExpressRoute circuits that were configured prior to August 1, 2017 will have all service prefixes advertised through Microsoft peering, even if route filters are not defined. Microsoft peering of ExpressRoute circuits that are configured on or after August 1, 2017 will not have any prefixes advertised until a route filter is attached to the circuit.
To be able to successfully connect to services through Microsoft peering, you must complete the following configuration steps:
You must have an active ExpressRoute circuit that has Microsoft peering provisioned. You can use the following instructions to accomplish these tasks:
- Create an ExpressRoute circuit and have the circuit enabled by your connectivity provider before you proceed. The ExpressRoute circuit must be in a provisioned and enabled state.
- Create Microsoft peering if you manage the BGP session directly. Or, have your connectivity provider provision Microsoft peering for your circuit.
You must create and configure a route filter.
- Identify the services you with to consume through Microsoft peering
- Identify the list of BGP community values associated with the services
- Create a rule to allow the prefix list matching the BGP community values
You must attach the route filter to the ExpressRoute circuit.
Before you begin
Before you begin configuration, make sure you meet the following criteria:
You must have an active ExpressRoute circuit. Follow the instructions to Create an ExpressRoute circuit and have the circuit enabled by your connectivity provider before you proceed. The ExpressRoute circuit must be in a provisioned and enabled state.
You must have an active Microsoft peering. Follow instructions at Create and modifying peering configuration
Step 1: Get a list of prefixes and BGP community values
1. Get a list of BGP community values
BGP community values associated with services accessible through Microsoft peering is available in the ExpressRoute routing requirements page.
2. Make a list of the values that you want to use
Make a list of BGP community values you want to use in the route filter. As an example, the BGP community value for Dynamics 365 services is 12076:5040.
Step 2: Create a route filter and a filter rule
A route filter can have only one rule, and the rule must be of type 'Allow'. This rule can have a list of BGP community values associated with it.
1. Create a route filter
You can create a route filter by selecting the option to create a new resource. Click Create a resource > Networking > RouteFilter, as shown in the following image:
You must place the route filter in a resource group.
2. Create a filter rule
You can add and update rules by selecting the manage rule tab for your route filter.
You can select the services you want to connect to from the drop down list and save the rule when done.
Step 3: Attach the route filter to an ExpressRoute circuit
You can attach the route filter to a circuit by selecting the "add Circuit" button and selecting the ExpressRoute circuit from the drop down list.
If the connectivity provider configures peering for your ExpressRoute circuit refresh the circuit from the ExpressRoute circuit blade before you select the "add Circuit" button.
To get the properties of a route filter
You can view properties of a route filter when you open the resource in the portal.
To update the properties of a route filter
You can update the list of BGP community values attached to a circuit by selecting the "Manage rule" button.
To detach a route filter from an ExpressRoute circuit
To detach a circuit from the route filter, right click on the circuit and click on "disassociate".
To delete a route filter
You can delete a route filter by selecting the delete button.
For more information about ExpressRoute, see the ExpressRoute FAQ.