Site-to-Site VPN connection over ExpressRoute private peering not valid

Hello,

It seems this article is either outdated or wrong with what it is currently proposing - the requirements most likely need to change.

We have the same issue as described here, we have full control of the firewall from on-prem and can manipulate the routes as needed.

Our setup
ExpressRoute circuit with private peering - working
ER VPN GateWay and VNET linked with ER connection
VPN GateWay with private IP's enabled
Connection(IPSEC) with private IP's enabled

The IPSEC connection is established but traffic from Azure to on-prem does not prefer it.

Azure needs to send on-prem the routes. This isn’t an on prem to Azure issue, the firewall can manipulate the routes anyway we need to. But if we receive the /16 over the tunnel, the underlay (ER) will drop because that’s how the firewall gets to its IPSec peer IP, by means of the /16 route we get on the ER.

We can’t have the same /16 coming over the underlay and IPSec overlay

Need something more specific for the overlay IPsec subnets

Are we missing something here? It feels like our only other options are:

1. Using ExpressRoute without IPSEC(can't do this as it's a requirement)
2. NVA - will need to look into this
3. Azure VirtualWAN (not viable right now) - can we use AS-PATH prepending with virtual WAN?

Not sure where to go from here but as it stands site-to-site over ExpressRoute and how the configuration is laid out in that article won't work with native Azure resources.

Do you maybe have an example setup that's working with only configuring the wider /16 path over ER and more specific path /24 over VPN on-prem side? If that could be shared then we could do a comparison.

Thanks