Azure Expressroute with VPN: because life isn’t complicated enough

Hey sports fans! Let’s have a chat about something a lot of folks don’t use or even realize you can use, and that’s a site to site tunnel over an Expressroute circuit. So buckle up, it’s time to ride the lightning.

neat copilot generated image

Expressroute, that money-guzzling beast of high bandwidth goodness you know and love. What if “private” connectivity to Azure isn’t enough, what if you still need some encryption in the mix and need a vpn tunnel? Maybe you have some compliance requirement, maybe you have extra money and need to spend it, who knows? You can absolutely do that, in fact, you can do that in a couple of different ways.

Let’s start with the most common, having a site to site tunnel over Expressroute private peering.

This is all private, so you can just use the vpn gateway private ip address to setup your tunnel by enabling that on the vpngw and the connection. You could also just advertise the onprem vpn endpoint device address up to Azure via the Expressroute since all the traffic will use the vpn tunnel and not the Expressroute itself.

You’ll still have the Expressroute gateway and vpn gateway coexisting in the same vnet. It’ll go something like this:

Pretty much the only traffic coming in to Azure from the Expressroute will go to the vpn gateway. That’s the private peering option, pretty easy and nothing out of the ordinary really, onprem to Azure connects via the Expressroute but then all your data rides the vpn tunnel to the vpn gateway.

Let’s look at option 2, using Microsoft peering.

This works the exact same way really but the path taken is vastly different. With Microsoft peering everything is public instead of private, so you’ll be advertising public ip addresses up to Azure and will need a route filter applied on the Expressroute to receive public region or service routes from Azure (more here). This might seem weird, but you won’t need an Expressroute gateway in your vnet because the Expressroute isn’t directly attached to your vnet. You’ll learn the public ip of the VPN gateway (assuming it’s in the region allowed by your route filter, that’s a must have, obviously) and will connect to that just like you would if you were using the internet.

From the point of view of the VPN gateway you’re coming from the “internet” since you’re hitting its public ip address, but you’re using the Expressroute to reach Azure instead of going to the actual internet. How neat is that!

Bottom line, if you want to use private ip’s all the way then stick to private peering and slap an Expressroute gateway in your vnet. If you’d rather use public ip addresses then stick with Microsoft peering and you can forgo the Expressroute gateway altogether.

That brings us to the end of this little ditty about VPN’ing over Expressroute. Thanks for taking the time to read through this and I hope it helps you. Check out my Github for more labs and examples here: https://github.com/quiveringbacon.