5.1.2.3. Design for Azure VPN Gateway and ExpressRoute
5.1.2.3. Design for Azure VPN Gateway and ExpressRoute
💡 First Principle: Securely and reliably extending an on-premises network to the cloud is fundamental for creating seamless hybrid environments that bridge existing infrastructure with cloud resources, supporting diverse requirements for performance, security, and cost.
Hybrid connectivity options against their requirements:
The first branch decides it. A VPN traverses the public internet, so it can promise no bandwidth or latency guarantee — which immediately rules it out for workloads that name those requirements, and equally rules ExpressRoute out as over-specified when they do not. The standard resilient design pairs them in one direction only: ExpressRoute primary, VPN failover. An answer that makes the VPN the preferred path has inverted it.
Scenario: You are designing the network connectivity for a hybrid application. Critical business data needs to be synchronized daily between on-premises and Azure, requiring a dedicated, high-bandwidth, and highly secure connection. Non-critical dev/test traffic can traverse the internet securely.
Azure VPN Gateway and Azure ExpressRoute are Azure services that establish secure connections between on-premises networks and Azure VNets.
Key Design Considerations:
- Azure VPN Gateway:
- Purpose: Establishes secure, encrypted tunnels (IPsec/IKE VPN) over the public internet.
- Use Cases: Hybrid connectivity for non-critical workloads, dev/test environments, or when cost is a primary concern.
- Performance: Bandwidth is limited by internet connection and VPN Gateway SKU.
- Azure ExpressRoute:
- Purpose: Creates a private, dedicated, high-bandwidth connection, bypassing the public internet.
- Use Cases: Mission-critical applications, large data transfers, or scenarios requiring predictable performance and low latency.
- Performance: Offers higher bandwidth (up to 100 Gbps) and lower latency.
- Security: Traffic remains on a private connection, enhancing security.
- Cost: Generally more expensive than VPN Gateway.
- Redundancy: Design for high availability by deploying redundant VPN Gateways or ExpressRoute circuits.
Design decisions in practice:
| Requirement in the scenario | What it points to |
|---|---|
| "Guaranteed bandwidth", "predictable latency", "SLA-backed" | ExpressRoute — a VPN crosses the public internet and can promise neither |
| "Lowest cost", "quick to stand up", "branch office" | Site-to-site VPN |
| "Offices must reach each other, not just Azure" | ExpressRoute Global Reach |
| "Many branch sites to terminate" | Azure Virtual WAN — managed hubs with transit routing |
| "Must survive the circuit failing" | ExpressRoute primary with VPN failover |
| "Traffic must not traverse the public internet at all" | ExpressRoute with private peering |
Resilience has a specific shape and questions test its direction. The standard design is ExpressRoute as the primary path and a site-to-site VPN as the failover — never the reverse. An answer that makes the VPN preferred has inverted the design and forfeits the guarantee the circuit was bought for. For higher assurance still, ExpressRoute circuits are provisioned with two connections at the peering location, and a truly resilient design uses circuits from two different peering locations.
Gateway sizing follows the circuit rather than the other way round: the VNet gateway SKU caps throughput regardless of what the circuit provides, and the zone-redundant SKUs are what keep the gateway itself available during a zone failure.
⚠️ Exam Trap: ExpressRoute does not encrypt traffic by default. It is private, not encrypted — a requirement naming encryption in transit needs a VPN over the circuit or application-level TLS.
⚠️ Common Pitfall: Relying on a single ExpressRoute circuit for a mission-critical workload without a backup. A single physical link is a single point of failure. Best practice is to have a redundant ExpressRoute circuit or a backup VPN Gateway connection.
Key Trade-Offs:
- Performance/Security (ExpressRoute) vs. Cost/Flexibility (VPN): ExpressRoute offers superior, consistent performance and security but comes with higher costs and longer setup times. A VPN is cheaper and faster to deploy but relies on the public internet, leading to variable performance.
Reflection Question: How does strategically choosing between Azure VPN Gateway (for secure internet-based tunnels) and Azure ExpressRoute (for private dedicated connections) fundamentally enable hybrid connectivity solutions, balancing performance, security, and cost requirements for diverse on-premises and cloud communication needs?
