expressroute

Azure ExpressRoute

What it is

Azure ExpressRoute extends an on-premises network into Microsoft cloud services over a private provider connection rather than the public internet. The connection can use an any-to-any IP VPN network, point-to-point Ethernet, or a virtual cross-connection through a connectivity provider or colocation facility.

Why it exists

Organizations use ExpressRoute when their hybrid network needs private connectivity, predictable performance characteristics, provider integration, or a design with higher resiliency than a typical internet path. It can connect to Azure and, in appropriate scenarios, Microsoft 365 services. “Private” means the traffic does not travel over the public internet; it does not by itself mean every workload connection is encrypted or that every service is reachable.

Key ideas

• Private peering connects a VNet to on-premises networks. Microsoft peering connects to supported Microsoft cloud services, with specific routing and public-address requirements. Azure public peering is deprecated; use current service documentation for the exact supported services.
• BGP exchanges routes dynamically between the customer/provider edge and Microsoft. It tells each side which address prefixes are reachable; it does not authorize application users or automatically encrypt application protocols.
• A VNet connection normally uses an ExpressRoute virtual network gateway in GatewaySubnet. Architecture features such as FastPath have exceptions, so validate the selected design rather than reducing every connection to one diagram.
• Built-in circuit redundancy is valuable but bounded. A circuit has redundant connections to Microsoft edge routers at a peering location. For maximum resiliency, Microsoft recommends two circuits at different peering locations; one circuit does not eliminate provider, location, configuration, or application failures.
• Scope and cost depend on SKU and design. A circuit can link multiple VNets subject to documented limits and configuration. Premium adds broader global connectivity and larger limits; Local and billing models have separate behavior.
• Protect the data too. Apply TLS or another suitable encryption approach when data confidentiality requires it, because a private transport path is not a substitute for end-to-end application security.

Northwind example

Northwind’s warehouse network needs a reliable private route to the order-processing VNet. It orders an ExpressRoute circuit through a connectivity provider, configures private peering and BGP, and attaches the VNet through the appropriate gateway design. The team still uses HTTPS to its order API and Azure RBAC for authorization. For an outage plan, it evaluates a second circuit at a different peering location and tests the routes; it does not call one redundant circuit “disaster recovery.”

How it fits

[on-premises edge]  <— private provider connection —>  [ExpressRoute circuit/gateway]
       provider (Ethernet/MPLS)                         |  (GatewaySubnet)
                                                        ▼
                                                   [VNet subnets]

Diagrams courtesy of Microsoft Learn / Azure docs: expressroute/expressroute-introduction

Exam notes

• ExpressRoute is private provider connectivity; VPN Gateway uses encrypted tunnels over the public internet.
• BGP exchanges routes; it is not the same as IPsec or an application authorization system.
• Know private versus Microsoft peering, gateway architecture, and the difference between circuit redundancy and a full resiliency plan.

Related

Home · vpn-gateway · bgp · virtual-wan · vnet

📘 Source: Microsoft Learn — Expressroute