Cloud Networking · Route Tables

Route Tables in the Cloud

Architecture, limits & next-hop types across AWS · Azure · GCP

Structural Model

How route tables attach to your network

AWS VPC

Subnet-scoped tables

ScopePer VPC resource

AttachmentSubnet (explicit or implicit)

Cardinality1 table → many subnets

DefaultMain route table (auto)

Sys routeslocal (auto per CIDR block)

SelectionLongest prefix match (no priority)

BGP injectVGW propagation (per table)

Edge routingGateway (ingress) associations

200 tables per VPC

Azure VNet

Subscription-scoped UDR tables

ScopeARM resource (region + subscription)

AttachmentSubnet (0 or 1 UDR table)

Cardinality1 table → subnets across VNets

DefaultAuto system routes per subnet

Sys routesVirtualNetwork, Internet, None

SelectionLPM · UDR wins over system routes

BGP injectVPN GW / ER GW / Route Server

Edge routingNo gateway-level UDR edge assoc.

200 tables per region / sub

GCP VPC

VPC-level routing (no table object)

ScopePer VPC network (global resource)

AttachmentNo per-subnet attachment

CardinalityAll VMs see all applicable routes

DefaultAuto per-VPC (subnet + 0.0.0.0/0)

Sys routesSubnet routes (immutable, highest prio)

SelectionLPM + priority value (lower = better)

BGP injectCloud Router only (mandatory)

SelectivityNetwork tags per static route

N/A no table object to count

Limits & Quotas

What you can actually create

Resource	AWS	Azure	GCP	Adj.
Tables per VPC / network	200	200 / sub	N/A	Yes
Routes per table (static)	500raised from 50, Jun 2025	4001,000 with AVNM	250static per VPC	Yes
Dynamic prefixes — own region	→ 500 table limit	4,000 / RS peer	250	No
Dynamic prefixes — other regions	—	—	250	No
Max BGP prefixes from single peer	—	4,000	5,000	—
Subnets per VPC / VNet	200	No hard limit	No hard limit	Yes / —
IPv4 CIDR blocks per VPC / VNet	5 → 50	Multiple ranges	1 primary	Yes / —

Adjustable quota

Hard system limit

Workaround available

Next-Hop Types

Where traffic can be steered

Next hop	AWS	Azure	GCP	Notes
Internet / default route	Internet Gateway	Internet	default-internet-gateway	All auto-create 0/0
NVA / Firewall insertion	ENI / GWLBEGENEVE via GWLBE	VirtualApplianceNIC IP or ILB IP	ILB (passthrough NLB)mandatory for HA	Core inspection path
VPN gateway (hybrid)	Virtual Private Gateway	VirtualNetworkGateway	HA VPN tunnel	Hybrid connectivity
Transit / hub routing	Transit Gateway	Virtual WAN (hub RT)	NCC hub	Hub-spoke transit
VPC / VNet peering	VPC Peering connection	VirtualNetworkPeering	Peering subnet route	Azure: system-only
Drop (null route)	Blackhole	None	Policy-based route only	GCP: PBR only
Private service access	Gateway Endpoint (S3/DDB)	ServiceEndpoint (system)	Private Service Connect	Bypasses UDR / NVA
NAT (outbound)	NAT Gateway	NAT Gateway (not UDR type)	Cloud NAT (not a route NH)	Not a direct NH type
Source-aware routing	—	—	Policy-based routes	src + dst + proto
IPv6 egress	Egress-only IGW	Internet (IPv6 route)	default-internet-gateway	All support ::/0

Know Before You Design

Critical operational constraints

AWS

East-west inspection

The local route always wins for intra-VPC traffic. To force subnet-to-subnet traffic via a firewall, you must use GWLBE (GENEVE) or separate VPCs. TGW/VGW cannot override the local route.

△ Also: no uRPF in VPC peering — asymmetric routing is possible with overlapping CIDRs.

Azure

UDR ceiling at scale

400 UDRs per table is the binding constraint in large hub-spokes. Expand to 1,000 via AVNM routing configurations (API 2025-01-01+). Service endpoint routes bypass UDR processing — NVA won't see that traffic.

△ VirtualAppliance NH needs direct reachability — not via ER/vWAN gateway. Use ILB for HA NVA.

GCP

The 250-prefix hard wall

Cloud Router enforces 250 unique BGP prefixes per region per VPC (from own + from other regions). Routes beyond the limit are silently dropped (not adjustable) using deterministic lexicographic ordering (shorter masks first).

△ Summarize on-prem routes before advertising into GCP. Monitor with Cloud Monitoring metrics.

Key Takeaway

Key takeaway

AWS raised default routes-per-table from 50 → 500 (June 2025). Azure hits 400 UDRs before most engineers expect. GCP’s 250-prefix Cloud Router ceiling is a hard system limit — silent drops, not rejections. Plan for all three before you hit production.