Azure Learning

expressroute

Properties2
tagsnetworking, hybrid, expressroute, connectivity
aliasesExpressRoute, er, dedicated private link

2 min read

Azure ExpressRoute

What it is

Azure ExpressRoute extends your on-premises networks into the Microsoft cloud over a private, dedicated connection that does not traverse the public internet — provided by a connectivity provider (colocation, point-to-point Ethernet/Ethernet over MPLS, or integrated express route).

Why it exists

VPN over the internet is subject to variable latency, congestion, and security exposure. Organizations needing consistent performance, higher throughput, and private/SLA-backed connectivity to Azure use ExpressRoute — plus that traffic gives them access to Microsoft 365 and Azure from the same private peering.

Key ideas

  • Three circuit offerings: Microsoft peering (Microsoft 365, public Azure services), Public peering (legacy; retired), and Private peering (VNet access) — with modern Standard and Premium depending on services reached.
  • A single ExpressRoute circuit can connect to VNets in multiple subscriptions/regions via circuit -> gateway -> VNet.
  • Requires a gateway (ExpressRoute gateway) on a GatewaySubnet in the target VNet.
  • BGP is the routing protocol between your edge and the ExpressRoute gateway (dynamic, enables failover).
  • Redundancy — circuits are designed with redundant paths (active/active) by the provider.
  • Daily/hourly billing + data transfer; Premium add-on: global reach / more circuits / cross-region, per current docs.

How it fits

[on-prem edge/ER circuit]  <— private, no internet —>  [ExpressRoute gateway]
       provider (Ethernet/MPLS)                         |  (GatewaySubnet)
                                                        ▼
                                                   [VNet subnets]

expressroute - Microsoft diagram

Diagrams courtesy of Microsoft Learn / Azure docs: expressroute/expressroute-introduction

Exam notes

  • ExpressRoute ≠ VPN: private, dedicated, no internet, higher/consistent throughput; VPN = internet, cheaper, less predictable.
  • Uses BGP, not IKE/IPsec for the core connectivity.
  • Only Premium/SKU and a gateway in the right VNet connect many regions — a circuit is tied to a peering location/region.
  • For exam, know the width vs VPN trade-off, peering types (Microsoft vs Private), and that you still need a gateway per connected VNet.

Home · vpn-gateway · bgp · virtual-wan · vnet

📘 Source: Microsoft Learn — Expressroute

Graph View

Backlinks