AZ-700 Question 145
Select 2Your organization has established an ExpressRoute circuit for accessing Azure services from on-premises. The circuit is provisioned and shown as 'Enabled' in the Azure portal. However, users report they cannot reach resources hosted in the connected Azure virtual network, and the BGP session is stuck in the 'Idle' state. Upon further review, you see no routes are being exchanged between your on-premises edge router and Azure. You have verified that the Azure side is using the correct ASN and IP addresses for BGP. Which two troubleshooting steps are most likely to resolve the issue?
- A
Enable BGP route reflection in your Azure virtual network to propagate BGP routes.
- B
Check on-premises firewall settings to ensure TCP port 179 for BGP traffic is allowed.
- C
Verify that the ExpressRoute Gateway� private peering configuration is properly associated with the correct Azure VNet.
- D
Configure the Azure VPN Gateway type to �VPN� instead of �ExpressRoute� to bypass BGP issues.
Show answer and explanation
Correct answers: B, C
Explanation
When diagnosing a BGP session stuck in the 'Idle' state on an ExpressRoute circuit, the two most common culprits are blocked ports (TCP 179) or misconfiguration of the ExpressRoute Gateway peering association. Firewall rules often need to be adjusted to allow inbound and outbound BGP traffic on TCP port 179, and you must verify that the ExpressRoute Gateway� private peering is correctly configured for the intended Virtual Network. For more details, refer to Microsoft documentation on 'Troubleshoot ExpressRoute BGP connection issues.'
- A. Incorrect.
Incorrect. Azure auto-manages route propagation on the gateway, and enabling BGP route reflection inside the VNet is not a standard troubleshooting step for ExpressRoute connectivity.
- B. Correct.
Correct. BGP uses TCP port 179. If a firewall is blocking or dropping this port, BGP will remain idle and prevent proper route exchange.
- C. Correct.
Correct. Ensuring that the ExpressRoute Gateway is linked to the correct VNet via private peering is essential. If the gateway association is misconfigured, routes won�t propagate between on-premises and Azure.
- D. Incorrect.
Incorrect. VPN Gateway type is used for IPsec-based Site-to-Site connections, not for ExpressRoute. Switching to a VPN Gateway will not resolve an ExpressRoute BGP issue.