vwan route map not working when multiple route replace maps with comma seperated

Question

vwan route map not working when multiple route replace maps with comma seperated

Martin Kallukalam 465

My configuration (POC) is like this. I have a VWAN with 2 VNETs 10.30.96.0/19 10.30.224.0/19

A P2S VPN with address pool 172.24.10.0/24

My Windows Laptop with Azure VPN client configured using downloaded hub vpn profile

I am testing route map configuration with various scenarios
scenario #1
I add below route map rule and attach it to P2S VPN

I have not added a match condition which means the condition will match on any route.
User's image

I want basically to replace all routes published to P2S and replace it with 10.40.96.0/19,10.41.96.0/19 (don't ask me why. Because I am testing route map and its reliability and functionality feature).

Problem #1 When I have two routes comma separated, only the first route takes effect.
The 2nd one is ignored. This is not the expected behavior as per documentation.

User's image

Problem #2
regardless of route map, both VNET routes are published to VPN client
Expected behavior is the two VNET routes should be dropped and replaced with 2 routes 10.40.96.0/19 and 10.41.96.0/19, while it is not what is seen in VPN routes

See attached pic
User's image

Martin Kallukalam 465 Reputation points

2025-05-26T02:19:37.2433333+00:00

@Anonymous
you closed my other thread with the comment that this is a duplicate of the other.
It is not a duplicate. These are two different issues .
Sindhuja Dasari 1,520 Reputation points Microsoft External Staff Moderator

2025-05-26T04:23:08.9+00:00
Hello Martin Kallukalam

I understand that you're facing issue with VWAN route map. Thanks for the detailed input and screenshots.

Problem #1: Only First Route in Replace Takes Effect
Comma-separated values might not be supported for Replace on Route Prefix. Even though the documentation may be ambiguous or imply multi-route support with commas in stating, there are no commas defined while setting the route prefixes.

Refer https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-drop-inbound-branch-sites
As you see there are no comma-separated values, the CIDR ranges are combined as a single range and used "contains" Criteria.

Problem #2: VNET Routes Still Pushed Despite Replace
Despite applying a "Replace" action with no match condition, the original VNET routes still show up in P2S VPN list.

Likely Cause: Replace in route map alters matched attributes - it doesn't implicitly drop unmatched original routes unless they are explicitly removed.

Even when all routes are matched (due to no condition), Azure adds the Replace prefix alongside the originals.

To actually replace all the advertised routes, add a rule to drop all routes and a add rule to modify and replace with your desired pattern.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Martin Kallukalam 465 Reputation points

2025-05-26T12:49:59.34+00:00

@sindhuja Dasari
On Problem #1.
I am not using comma values in match conditions. I am using them in actions where the doc says it is supported. Pls see the link to the doc below

https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-about

Even in match condition it shows comma separated values and says in the example ALL 4 routes are matched

So I am trying out the option you recommended. I created a drop all routes and another rule which replace all routes with 2 routes .
Pls note both the CIDRs cannot be summarized any further so they have to be listed as two separate routes

In route map dashboard, it dropped all the routes (except the HUB CIDR ).
However the 10.46.96.0/19 and 10.41.96.0/19 are not showing up.

On VPN Client all the routes are still showing up.

So at this time, I am not sure what else to do. The routemap behavior seems to be very unreliable and unpredictable.

Do you have any suggestion or specific steps I should take which you can test in your vwan first and proven to work?
My goal as I said is to drop all routes and just publish 2 routes to VPN client 10.40.96.0/19 and 10.41.96.0/19.
Martin Kallukalam 465 Reputation points

2025-05-27T11:01:04.78+00:00

Venkat There is no previous drop rule. I have already removed the drop rule when I posted the screen shot .
Anonymous

2025-05-27T11:23:05.6933333+00:00

Hi @Martin Kallukalam

Can you please share the requested details in private chat for further troubleshootings.
Anonymous

2025-05-27T13:00:32.45+00:00

Hi @Martin Kallukalam

I will check the issue internally and also replicate it in my lab environment to verify the functionality. I’ll confirm the status once testing is complete.

Accepted answer

0 additional answers

Your answer

Martin Kallukalam 465 Reputation points

2025-05-26T02:19:37.2433333+00:00

@Anonymous
you closed my other thread with the comment that this is a duplicate of the other.
It is not a duplicate. These are two different issues .
Sindhuja Dasari 1,520 Reputation points Microsoft External Staff Moderator

2025-05-26T04:23:08.9+00:00

Hello Martin Kallukalam

I understand that you're facing issue with VWAN route map. Thanks for the detailed input and screenshots.

Problem #1: Only First Route in Replace Takes Effect
Comma-separated values might not be supported for Replace on Route Prefix. Even though the documentation may be ambiguous or imply multi-route support with commas in stating, there are no commas defined while setting the route prefixes.

Refer https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-drop-inbound-branch-sites
As you see there are no comma-separated values, the CIDR ranges are combined as a single range and used "contains" Criteria.

Problem #2: VNET Routes Still Pushed Despite Replace
Despite applying a "Replace" action with no match condition, the original VNET routes still show up in P2S VPN list.

Likely Cause: Replace in route map alters matched attributes - it doesn't implicitly drop unmatched original routes unless they are explicitly removed.

Even when all routes are matched (due to no condition), Azure adds the Replace prefix alongside the originals.

To actually replace all the advertised routes, add a rule to drop all routes and a add rule to modify and replace with your desired pattern.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Martin Kallukalam 465 Reputation points

2025-05-26T12:49:59.34+00:00

@sindhuja Dasari
On Problem #1.
I am not using comma values in match conditions. I am using them in actions where the doc says it is supported. Pls see the link to the doc below

https://learn.microsoft.com/en-us/azure/virtual-wan/route-maps-about

Even in match condition it shows comma separated values and says in the example ALL 4 routes are matched

So I am trying out the option you recommended. I created a drop all routes and another rule which replace all routes with 2 routes .
Pls note both the CIDRs cannot be summarized any further so they have to be listed as two separate routes

In route map dashboard, it dropped all the routes (except the HUB CIDR ).
However the 10.46.96.0/19 and 10.41.96.0/19 are not showing up.

On VPN Client all the routes are still showing up.

So at this time, I am not sure what else to do. The routemap behavior seems to be very unreliable and unpredictable.

Do you have any suggestion or specific steps I should take which you can test in your vwan first and proven to work?
My goal as I said is to drop all routes and just publish 2 routes to VPN client 10.40.96.0/19 and 10.41.96.0/19.
Martin Kallukalam 465 Reputation points

2025-05-27T11:01:04.78+00:00

Venkat There is no previous drop rule. I have already removed the drop rule when I posted the screen shot .
Anonymous

2025-05-27T11:23:05.6933333+00:00

Hi @Martin Kallukalam

Can you please share the requested details in private chat for further troubleshootings.
Anonymous

2025-05-27T13:00:32.45+00:00

Hi @Martin Kallukalam

I will check the issue internally and also replicate it in my lab environment to verify the functionality. I’ll confirm the status once testing is complete.

Answer 1

Hi @Martin Kallukalam,

The route map only supports summary routes. You can match on multiple specific routes and summarize them into a single route. The reason why the first route worked is because it was the first one evaluated. However, you cannot create multiple summary routes within a single route map rule.

User's image

Route maps allow you to perform route aggregation, route filtering, and modify BGP attributes such as AS-PATH and Community, enabling fine-grained control over route selection and propagation. Route maps can be configured on the following resources and settings.

If a route map has multiple modifications configured in a rule, all configured actions are applied on the route. So, the last modification shows up in the dashboard as the route keeps replacing the prefixes till the last one and if you create 2 route map rules with the Replace action without any condition and keep processing the rules without terminating them, then it will modify till the end and the last modification will show up in the dashboard.

I also tested the same in my lab and got the same expected result, so this is the expected behavior.

User's image

Output: User's image

Refer: Why use Route-maps?

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Share via

vwan route map not working when multiple route replace maps with comma seperated

0 additional answers

Your answer