You run a hub-and-spoke architecture. The hub VNet contains an ExpressRoute gateway to on-premises and a pair of third-party NVAs. Spokes use gateway transit. You need dynamic route exchange between the NVAs and the ExpressRoute gateway so on-prem routes are learned by NVAs and NVA-learned prefixes reach the gateway, enabling branch-to-branch and spoke-to-spoke flows without manual UDRs. What should you implement?

Azure Route Server is designed for this exact scenario. By deploying Route Server in the hub VNet and peering it via eBGP with the NVAs, it will learn routes from the NVAs. Enabling Route Server integration with the ExpressRoute gateway allows for bidirectional route exchange: NVA routes are advertised to on-premises via ExpressRoute, and on-premises routes are advertised to the NVAs. This facilitates dynamic branch-to-branch and spoke-to-spoke communication through the NVAs without manual UDRs. Replacing ExpressRoute with a VPN gateway is not a suitable solution as the requirement specifies ExpressRoute. Enabling BGP on VNet peering only works for VNet-to-VNet connectivity and doesn't facilitate dynamic route exchange with NVAs or ExpressRoute. UDRs are static and do not provide dynamic route exchange; ExpressRoute gateways do not automatically ingest UDRs into BGP. Azure Virtual WAN Basic does not support NVA integration for dynamic routing.