Azure ExpressRoute extends the corporate network into the Microsoft cloud over a private connection. The line is provided by a connectivity provider, such as a network operator or a data center connected to Microsoft. Through ExpressRoute, companies reach services in Microsoft Azure and, for specific scenarios, Microsoft 365.
Because the traffic does not travel over the internet, Microsoft promises more reliability, more consistent latency and higher speed than with an internet connection.
How does ExpressRoute work?
The core is the so-called circuit, a logical connection between the corporate network and Microsoft. Each circuit has an identifier, the service key, and is mapped to a provider and a peering location. It consists of two connections to two Microsoft routers at the peering location. Routes are exchanged via BGP.
The connection can be made in three ways: through the provider's IP VPN, through a point-to-point Ethernet connection or through a virtual cross-connection in a data center. With ExpressRoute Direct, large organizations connect directly to the Microsoft network at 10, 100 or 400 Gbit/s.
Peering: what can be reached over the line
- Private peering: connects the corporate network to virtual networks in Azure. Servers are reachable through their private IP addresses.
- Microsoft peering: connects to public Microsoft services such as Microsoft 365 and Azure PaaS services. This requires your own public IP addresses. Microsoft recommends ExpressRoute for Microsoft 365 only in specific cases, because the services are built for access over the internet.
Bandwidths, SKUs and billing
Through providers, bandwidths from 50 Mbit/s to 10 Gbit/s can be booked. The Local SKU is intended for Azure regions near the peering location, and data transfer is included in the port price. Standard reaches all regions within a geopolitical region. Premium opens access to regions worldwide and raises the limits for routes and connected networks. Billing is either with unlimited data or based on outbound data.
Resilience and encryption
A circuit is redundant through its two connections but ends at one peering location. For maximum resilience, Microsoft recommends two circuits at two locations. A VPN connection via the Azure VPN Gateway can also serve as a fallback path.
Important: private does not mean encrypted. Traffic over ExpressRoute is not encrypted by default. With ExpressRoute Direct, MACsec can be enabled. For end-to-end encryption, an IPsec tunnel can run over private peering, for example between Azure VPN Gateway and an on-premises firewall such as a FortiGate.
When does ExpressRoute fit?
ExpressRoute is worthwhile when large amounts of data flow regularly between the data center and Azure, when applications need consistent latency or when requirements call for a connection without the internet. For smaller sites, a VPN is usually enough. For administering the servers in Azure, Azure Bastion is an option regardless of how the line is set up.
TOMORIS clarifies which connection fits as part of its cloud expertise, with a view to applications, sites and operations.