Azure ExpressRoute Configuration Guide

Azure ExpressRoute Configuration Guide
Enterprise Implementation with Azure Portal

Azure ExpressRoute provides a Private, dedicated Connection between an On-Premises Datacenter and Microsoft Azure. Unlike Site-to-Site VPN, ExpressRoute Traffic does not Traverse the Public Internet. Instead, connectivity is delivered through a Telecommunications Provider or through ExpressRoute Direct Ports in Microsoft Edge Facilities.

This Architecture is typically used for Enterprise Hybrid Environments that Require High Bandwidth, Predictable Latency, and Private Connectivity to Azure Services.

The following Guide explains a complete Enterprise Deployment including Architecture Planning, IP Design, Portal Configuration, BGP Routing Configuration, and Connectivity Validation.

Azure ExpressRoute SKUs and Parameters

Azure ExpressRoute includes two main categories of SKUs:

First Category: ExpressRoute Circuit SKUs

Second Category: ExpressRoute Virtual Network Gateway SKUs

Both affect Connectivity Scope, Routing Scale, throughput, and overall Hybrid Architecture Performance.

1. ExpressRoute Circuit SKU Tiers

2. ExpressRoute Circuit Bandwidth Options

Bandwidth determines the throughput capacity of the ExpressRoute circuit between the provider network and Microsoft edge routers.

Bandwidth options depend on the connectivity provider and peering location.

3. ExpressRoute Billing Models

4. ExpressRoute Peering Types

ExpressRoute supports different routing domains called peerings.

Most deployments use Azure Private Peering.

5. ExpressRoute Virtual Network Gateway SKUs

The ExpressRoute gateway connects the Azure VNet to the ExpressRoute circuit. Gateway SKUs determine throughput and scale.

AZ gateway SKUs support availability zones and provide higher resiliency.

6. ExpressRoute Key Configuration Parameters

During ExpressRoute configuration, several parameters must be defined.

7. Gateway Subnet Requirements

This subnet is reserved exclusively for Azure gateway infrastructure.

8. Typical Enterprise ExpressRoute Architecture

9. Recommended Enterprise Configuration

ExpressRoute Deployment Abbreviations

Networking Abbreviations

Routing and Protocol Abbreviations

Peering Abbreviations

Infrastructure Abbreviations

Azure Architecture Abbreviations

Typical ExpressRoute Architecture Acronyms

Most Important Abbreviations in ExpressRoute Deployments

These abbreviations appear frequently in Azure networking architecture diagrams, deployment documentation, and hybrid connectivity designs involving ExpressRoute.

1. Architecture Overview

ExpressRoute connectivity consists of several Components that work together to create a Hybrid Network.

 On Premises Network
This includes Routers, Firewalls, and Internal Networks located Inside the Organization’s Datacenter.

Connectivity Provider
A Telecommunications Partner that provides the Private Circuit between the On-Premises Network and the Microsoft Edge Network.

Expressroute Circuit
The Logical Connection created in Azure that represents the Dedicated Connection between the Provider Network and Microsoft Azure.

 Expressroute Gateway
The Azure Gateway deployed inside the Azure Virtual Network to Route Traffic between the vNet and the ExpressRoute Circuit.

 Azure Virtual Network
The Network containing Azure Workloads such as Virtual Machines, Databases, and Application Services.

 Routing Protocol
ExpressRoute uses BGP for Dynamic Routing between the On-Premises Network and Azure.

 2. Example Enterprise Network Design

Azure Virtual Network: 10.10.0.0/16

Application Subnet: 10.10.1.0/24

Database Subnet: 10.10.2.0/24

GatewaySubnet: 10.10.255.0/27

On-Premises Network: 192.168.0.0/16

Private Peering BGP ASN: 65010

Microsoft ASN: 12076

Primary Peering Subnet: 172.16.0.0/30

Secondary Peering Subnet: 172.16.0.4/30

3. Create Resource Group

Login to:  Azure Portal.

Search for: Resource Groups (RG).

Select Create.

Enter the following Information.

Resource Group Name: RG-Network-Hybrid

Region: (Select the  Azure Region where the vNet will exist)

Select Review and Create.

4. Create the Azure Virtual Network

Navigate to Virtual Networks.

Select Create.

Configure the following:

Name: vNet-Hybrid

Address Space: 10.10.0.0/16

Create Subnets:

Application Subnet: 10.10.1.0/24

Database Subnet: 10.10.2.0/24

GatewaySubnet: 10.10.255.0/27

The Subnet used by the ExpressRoute Gateway must be Named GatewaySubnet exactly.

The Recommended Minimum Size for GatewaySubnet in ExpressRoute Deployments is /27.

5. Create ExpressRoute Circuit

Navigate to ExpressRoute Circuits.

Select Create.

Configure the circuit options:

Name: ER-Circuit-Primary

Provider: (Select your Connectivity Provider)

Peering Location: (Choose the location provided by your connectivity partner)

Bandwidth: (Select required bandwidth such as 1 Gbps)

SKU Tier: (Standard or Premium)

Billing Model: MeteredData or UnlimitedData

Select Review and Create.

After the Circuit is created, Azure Generates a Service Key.

The Service Key must be provided to your Connectivity Provider so they can Provision the Circuit.

6. Provider Provisioning

The provider uses the Service Key to Activate the Circuit on their Side.

During provisioning the Circuit Status changes through Several States:

NotProvisioned, Provisioning, Provisioned

The Peering configuration can start ONLY after the Provider Marks the Circuit as Provisioned

7. Configure Azure Private Peering

Azure Private Peering allows On-Premises Networks to access Azure Virtual Networks.

Navigate to the ExpressRoute Circuit.

Open Peerings

Select Add

Configure Azure Private Peering:

Primary Subnet: 172.16.0.0/30

Secondary Subnet: 172.16.0.4/30

VLAN ID: Defined by Provider

Peer ASN: 65010

Shared Key: (Optional but Recommended)

Enable IPv6 (if required)

This configuration establishes BGP Sessions between Azure and the On Premises Router.

8. Configure On Premises Router

Configure: BGP and IP Addressing on the On-Premises Router.

Router ASN: 65010

Azure ASN: 12076

BGP Neighbor: Azure Edge Router

Advertise Internal Networks: 192.168.0.0/16

Ensure the Router Advertises Routes toward Azure and accepts Azure Network Prefixes.

9. Create ExpressRoute Virtual Network Gateway

Navigate to Virtual Network Gateway.

Select Create.

Configure the Gateway:

Name: ER-Gateway-Hub

Gateway Type: ExpressRoute

SKU: ErGw1AZ or ErGw2AZ depending on scale

Virtual network: vNet-Hybrid

Subnet: GatewaySubnet

Deployment of the ExpressRoute gateway typically takes between thirty and 45 minutes.

10. Create ExpressRoute Connection

Navigate to:  Virtual Network Gateway

Open Connections

Select Add

Connection Type: ExpressRoute

Select the ExpressRoute Circuit

Enable Maximum Resiliency (if required)

Select Create.

This Step connects the Azure virtual network to the ExpressRoute circuit.

11. Validate BGP Status

Open the ExpressRoute Circuit

Check the following:

Circuit Provisioning State: Provisioned

Private Peering State: Enabled

BGP Session State: Connected

These States Confirm Routing is Operational.

12. Deploy Azure Test Virtual Machine

Deploy a Virtual Machine into the Application Subnet.

Example:

VM Name: VM-Hybrid-Test

Subnet: 10.10.1.0/24

Operating System: Windows Server

13. Test Hybrid Connectivity

Test communication between Azure and On-Premises Systems.

Recommended Testing:

RDP from On-Premises Network to Azure Virtual Machine, Ping , Drive Map, DB Connectivity Tests

Successful communication confirms that ExpressRoute Routing is functioning correctly.

14. ExpressRoute Security Best Practices

Use Private Peering Only for Azure Workloads.

Restrict Route Advertisements to necessary Network Prefixes.

Use Network Security Groups to control Traffic Inside Azure Virtual Networks.

Implement Azure Firewall or Network Virtual Appliances for Inspection and Segmentation.

Enable Monitoring through Azure Network Watcher and Azure Monitor.

Log Routing Events and Gateway Metrics.

15. High Availability Best Practices

Enterprise deployments typically Implement Redundancy.

Deploy Dual ExpressRoute Circuits in Separate Peering Locations.

Use Active/Active Routing through BGP.

Deploy Zone Redundant ExpressRoute Gateways.

Use Multiple on Premises Routers.

This Architecture prevents Connectivity Loss during Circuit Failures or Maintenance.

16. ExpressRoute vs VPN Considerations

ExpressRoute Advantages include.

Private Connectivity

Higher Bandwidth Options

Predictable Latency

Enterprise Reliability

Site to Site VPN Advantages include.

Lower Cost

Faster Deployment

No Provider Dependency

Many Enterprises deploy both Technologies Simultaneously for Redundancy.

ExpressRoute Serves as the Primary Hybrid Connection while VPN Provides Backup Connectivity.

17. Troubleshooting Checklist

If connectivity fails, verify the following:

Circuit Provisioning State is: Provisioned

BGP Session State is: Established

Gateway Subnet Size is: /27 or Larger

Gateway Type is ExpressRoute

On-Premises Router is Advertising Internal Networks.

Azure Route Tables are Correct

Network Security Groups are Not Blocking Traffic.

Once these items are confirmed, Hybrid Connectivity should Operate Normally.

ExpressRoute Enterprise Deployment Flow

Create Resource Group

Create Virtual Network

Create Gateway Subnet

Create Expressroute Circuit

Provide Service Key To Provider

Configure Private Peering

Configure On Premises Router

Deploy ExpressRoute Gateway

Create VNet Connection

Validate Routing

Test Application Connectivity

This Process Establishes Secure, High Performance Hybrid Connectivity between on Premises Infrastructure and Microsoft Azure.