I want to customize the ASN number of VHUB which is connected with VWAN

Kannan Vanniarajan 20 Reputation points
2026-07-30T09:51:36.67+00:00

Dear Support Team,

We are integrating multiple Azure Virtual WAN (vWAN) environments across different accounts using VPN Gateway connections. During this setup, we observed that Azure is not learning routes because the connected Virtual WANs are using the same BGP ASN.

From our investigation, it appears that the Virtual Hub ASN is fixed to 65515. We would like to configure a different ASN to avoid this conflict.

Although the Azure Crossplane provider appears to support specifying a custom ASN, Azure rejects the configuration during provisioning. Could you please clarify whether it is possible to customize the Virtual Hub ASN? If so, we would appreciate it if you could share the supported procedure or any prerequisites required to configure a custom ASN successfully.

Thank you for your assistance. We look forward to your guidance.

Kind regards,

Kannan V

Azure Virtual WAN
Azure Virtual WAN

An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.

0 comments

Answer accepted by question author

kagiyama yutaka 4,835 Reputation points
2026-07-30T12:33:20.6533333+00:00

I think the vhub asn stays fixed at 65515 and azure gives no way to change it, and the simple step is just add the needed prefixes as static routes on each vwan link. adding those routes lets the traffic go through, and nothing in the platform lets u modify that asn.

Was this answer helpful?

1 person found this answer helpful.
0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sina Salam 31,216 Reputation points Volunteer Moderator
    2026-07-30T13:36:57.1833333+00:00

    Hello Kannan Vanniarajan,

    Welcome to the Microsoft Q&A and thank you for posting your questions here.

    I understand that you would like to customize the ASN number of VHUB which is connected with VWAN.

    In your design, the gateway ASN is 65515, and BGP over IPsec is not supported because the remote Virtual WAN receives routes with 65515 already in the AS path, so BGP loop prevention will drop those routes. The supported solution for this exact architecture is to use static routing, not a custom vHub ASN. - https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-connectivity

    What you need to do is to:

    • Remove the custom virtualRouterAsn configuration from Crossplane/IaC for this vWAN-to-vWAN gateway design.
    • Disable BGP on the IPsec tunnel path between the Virtual WAN environments.
    • Configure the VPN sites and local network gateways with the required static address spaces.
    • Confirm there is no overlapping address space between all VNets, hubs, and connected networks.
    • Validate connectivity and route visibility after the static routes are applied.

    If dynamic routing with BGP is mandatory, the supported redesign is to use SD-WAN/NVA appliances in the Virtual WAN hub or in peered spoke VNets, then configure BGP using unique non-reserved ASNs. Azure-reserved ASNs such as 65515, 65517, 65518, 65519, and 65520 must not be used for the NVA ASN. - https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-connectivity, https://learn.microsoft.com/en-us/azure/virtual-wan/scenario-bgp-peering-hub

    There is no supported customer-side configuration, Crossplane setting, ARM setting, or CLI workaround that makes this specific Azure-managed vWAN-to-vWAN VPN gateway design support BGP by changing the vHub ASN. Azure Support is not required either to apply the supported fix, which is static routing.

    Use the below official resources for more reading and implementation steps:

    I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

    Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-07-30T09:51:55.7133333+00:00

    No. Azure Virtual WAN does not support changing the ASN for Virtual Hubs or Virtual WAN gateways.

    For the scenario described, the behavior is expected:

    1. Virtual WAN uses ASN 65515 for the virtual network gateway in the hub.
    2. When connecting one Virtual WAN to another by IPsec using virtual network gateways, BGP over IPsec is not supported because both sides use ASN 65515 and BGP loop prevention drops the routes.
    3. In that case, the connection must use static routing, not BGP.
    4. The error suggesting to contact support to enable router ASN modification is misleading. The documented and confirmed behavior is that ASN modification is not supported, including backend changes.

    Relevant constraints from the documentation:

    • Virtual WAN does not support ASN changes for Virtual Hubs or any gateways.
    • If a VPN Gateway virtual network gateway is created for connection to Virtual WAN, its BGP ASN cannot be 65515 because 65515 is used by Azure Virtual WAN.
    • For Virtual WAN-to-Virtual WAN connectivity using virtual network gateways, the tunnels must use static routing and have no BGP support.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.