Azure ExpressRoute and VPN Gateway

When an organisation migrates workloads to Azure, it typically needs its on-premises offices, data centres, and users to communicate with Azure resources privately — without traffic traversing the public internet. This is required for security (avoid exposure to internet threats), compliance (some regulations prohibit certain data travelling over public networks), and performance (predictable latency without internet congestion). Azure provides two connectivity options: Azure VPN Gateway (encrypted tunnels over the internet) and Azure ExpressRoute (dedicated private circuits).

An Azure VPN Gateway is a managed gateway resource deployed in a virtual network that creates encrypted IPsec/IKE tunnels between Azure and on-premises networks. It supports two types of connections: Site-to-Site (S2S) — connecting an entire on-premises network to Azure VNet, typically from a physical VPN device; and Point-to-Site (P2S) — individual clients (laptops, developer machines) connect to Azure using the Azure VPN client application. S2S is for branch-to-cloud; P2S is for remote workers.

VPN Gateway comes in multiple SKUs with different bandwidth and feature capabilities. Basic (legacy, max 100 Mbps, no zone redundancy). VpnGw1 (up to 650 Mbps, supports BGP). VpnGw2 (1 Gbps). VpnGw3 (1.25 Gbps). VpnGw5 (10 Gbps). Zone-redundant SKUs (e.g. VpnGw1AZ) place the gateway across availability zones for higher availability. Choose the SKU based on your required throughput and whether you need active-active configuration for redundancy.

A Site-to-Site connection requires four components: the VPN Gateway (in Azure), a Local Network Gateway resource (representing your on-premises VPN device's public IP and address space), a VPN device on-premises (router, firewall, or dedicated VPN appliance), and a shared key (pre-shared secret for authentication). After creating the connection, the Azure gateway and the on-premises device negotiate the tunnel using IKEv1 or IKEv2. Azure provides configuration scripts for hundreds of VPN device models.

Azure ExpressRoute is a dedicated private connection from your on-premises network to Azure through a connectivity provider (e.g. Equinix, AT&T, BT). Traffic travels over the provider's MPLS network — it never touches the public internet. ExpressRoute offers predictable bandwidth (from 50 Mbps to 100 Gbps), lower latency than VPN tunnels, higher reliability (SLA of 99.95%), and is required by many regulated industries and for high-bandwidth workloads like bulk data migration. Microsoft peering also gives access to Microsoft 365 and Azure services globally.

An ExpressRoute circuit is the logical connection between your network and Microsoft through a provider. It has a bandwidth tier (50 Mbps–100 Gbps) and two redundant physical connections for high availability. Each circuit supports two peering types: Private peering — connects to your Azure virtual networks (VNets) and resources over RFC 1918 address space. Microsoft peering — connects to Microsoft's public services including Azure Storage, Azure SQL, and Microsoft 365 (Exchange Online, Teams, SharePoint).

To connect a VNet to an ExpressRoute circuit, you deploy an ExpressRoute Gateway (a specialised type of VNet Gateway) and then create a connection linking it to the circuit. ExpressRoute Gateway SKUs (Standard, High Performance, Ultra Performance, ErGw1AZ–ErGw3AZ) determine the bandwidth capacity per gateway. Unlike VPN gateways, ExpressRoute gateways do not encrypt traffic — encryption happens at the circuit level by the provider or via IPsec over ExpressRoute if needed by regulation.

Choosing between ExpressRoute and VPN Gateway depends on requirements. ExpressRoute provides dedicated bandwidth, lower and more predictable latency, no encryption overhead (provider-managed), but takes weeks to provision and costs significantly more. VPN Gateway can be deployed in minutes, costs much less, and provides encryption (IPsec), but bandwidth is limited by the SKU and shared internet variability adds latency and packet loss. Many enterprises use both: ExpressRoute for production, VPN as a failover backup path.

A standard VPN Gateway uses a single active gateway instance with one public IP. In active-active mode, the gateway has two gateway instances each with its own public IP, creating two parallel IPsec tunnels to the on-premises device. If one instance fails, traffic automatically flows through the remaining tunnel with no manual intervention. Active-active also distributes traffic across both tunnels, effectively doubling the available bandwidth. It requires a compatible on-premises VPN device that supports BGP and multiple tunnel endpoints.

BGP (Border Gateway Protocol) is the standard internet routing protocol supported by both Azure VPN Gateway and ExpressRoute. With BGP, route information is automatically exchanged between Azure and on-premises — new subnets are advertised without manually updating static route tables. ExpressRoute always uses BGP. VPN Gateway supports BGP on route-based tunnels with SKUs VpnGw1 and higher. BGP is essential in hub-spoke topologies where you need consistent routing between multiple on-premises sites and multiple Azure VNets.

VPN Gateway emits metrics to Azure Monitor including Tunnel Bandwidth, Tunnel Egress/Ingress Bytes, Tunnel Peak Packets, and BGP Peer Status. You can create metric alerts to notify you when a tunnel drops (connection status changes) or throughput exceeds expected levels. The Connection troubleshoot tool in the portal tests connectivity between the VPN Gateway and the on-premises device and returns diagnostic information about packet drops and IKE negotiation failures.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Azure VPN Gateway creates encrypted IPsec tunnels over the internet for Site-to-Site and Point-to-Site connectivity at lower cost, Azure ExpressRoute provides dedicated private circuits through a connectivity provider for predictable bandwidth and lower latency, and both can be used together with ExpressRoute as primary and VPN as failover. Next up we explore the Azure Stack portfolio for offline and edge deployment scenarios.