Configure route filters for Microsoft peering: Azure CLI

Route filters are a way to consume a subset of supported services through Microsoft peering. The steps in this article help you configure and manage route filters for ExpressRoute circuits.

Connectivity to all Azure services causes a large number of prefixes gets advertised through BGP. The large number of prefixessignificantly increases the size of the route tables maintained by routers within your network. If you plan to consume only a subset of services offered through Microsoft peering, you can reduce the size of your route tables in two ways. You can:

• Filter out unwanted prefixes by applying route filters on BGP communities. Route filtering is a standard networking practice and is used commonly within many networks.

• Define route filters and apply them to your ExpressRoute circuit. A route filter is a new resource that lets you select the list of services you plan to consume through Microsoft peering. ExpressRoute routers only send the list of prefixes that belong to the services identified in the route filter.

About route filters

When Microsoft peering gets configured on your ExpressRoute circuit, the Microsoft Edge routers establish a pair of BGP sessions with your edge routers through your connectivity provider. No routes are advertised to your network. To enable route advertisements to your network, you must associate a route filter.

A route filter lets you identify services you want to consume through your ExpressRoute circuit's Microsoft peering. It's essentially an allowed list of all the BGP community values. Once a route filter resource gets defined and attached to an ExpressRoute circuit, all prefixes that map to the BGP community values gets advertised to your network.

Prerequisites

To successfully connect to services through Microsoft peering, you must complete the following configuration steps:

• You must have an active ExpressRoute circuit that has Microsoft peering provisioned. You can use the following instructions to accomplish these tasks:
  • Create an ExpressRoute circuit and have the circuit enabled by your connectivity provider before you continue. The ExpressRoute circuit must be in a provisioned and enabled state.
  • Create Microsoft peering if you manage the BGP session directly. Or, have your connectivity provider provision Microsoft peering for your circuit.

If you choose to install and use the CLI locally, this tutorial requires Azure CLI version 2.0.28 or later. To find the version, run az --version. If you need to install or upgrade, see Install the Azure CLI.

Sign in to your Azure account and select your subscription

To begin your configuration, sign in to your Azure account. Use the following examples to help you connect:

az cloud set -n AzureChinaCloud
az login
# az cloud set -n AzureCloud   //means return to Public Azure.

Check the subscriptions for the account.

az account list

Select the subscription for which you want to create an ExpressRoute circuit.

az account set --subscription "<subscription ID>"

Get a list of prefixes and BGP community values

1. Use the following cmdlet to get the list of BGP community values and prefixes associated with services accessible through Microsoft peering:

   az network route-filter rule list-service-communities
   

2. Make a list of BGP community values you want to use in the route filter.

Create a route filter and a filter rule

A route filter can have only one rule, and the rule must be of type 'Allow'. This rule can have a list of BGP community values associated with it. The command az network route-filter create only creates a route filter resource. After you create the resource, you must then create a rule and attach it to the route filter object.

1. To create a route filter resource, run the following command:

   az network route-filter create -n MyRouteFilter -g MyResourceGroup
   

2. To create a route filter rule, run the following command:

   az network route-filter rule create --filter-name MyRouteFilter -n CRM --communities 12076:51035 --access Allow -g MyResourceGroup
   

Attach the route filter to an ExpressRoute circuit

Run the following command to attach the route filter to the ExpressRoute circuit:

az network express-route peering update --circuit-name MyCircuit -g ExpressRouteResourceGroupName --name MicrosoftPeering --route-filter MyRouteFilter

Common tasks

To get the properties of a route filter

To get the properties of a route filter, use the following command:

az network route-filter show -g ExpressRouteResourceGroupName --name MyRouteFilter 

To update the properties of a route filter

If the route filter is already attached to a circuit, updates to the BGP community list automatically propagate prefix advertisement changes through the BGP session established. You can update the BGP community list of your route filter using the following command:

az network route-filter rule update --filter-name MyRouteFilter -n CRM -g ExpressRouteResourceGroupName --add communities '12076:51035' --add communities '12076:51034'

To detach a route filter from an ExpressRoute circuit

Once a route filter is detached from the ExpressRoute circuit, no prefixes are advertised through the BGP session. You can detach a route filter from an ExpressRoute circuit using the following command:

az network express-route peering update --circuit-name MyCircuit -g ExpressRouteResourceGroupName --name MicrosoftPeering --remove routeFilter

Clean up resources

You can only delete a route filter if it isn't attached to any circuit. Ensure that the route filter isn't attached to any circuit before attempting to delete it. You can delete a route filter using the following command:

az network route-filter delete -n MyRouteFilter -g MyResourceGroup

Next Steps

For information about router configuration samples, see: