3.3.3. ExpressRoute Features
Global Reach: Connects two ExpressRoute circuits, enabling on-premises-to-on-premises traffic through Microsoft's backbone. Example: Connect your New York datacenter to your London datacenter via Azure's network instead of the public internet.
FastPath: Bypasses the ExpressRoute Gateway for traffic destined to VNets, reducing latency by ~1-2ms. Supported on Ultra Performance and ErGw3AZ gateway SKUs only. Traffic still requires the gateway for network features like VNet peering—FastPath only optimizes direct VM access.
BFD (Bidirectional Forwarding Detection): Detects link failures in sub-second timeframes (vs. BGP's default 180-second hold timer). Enable on your CE router for faster failover.
Encryption over ExpressRoute:
ExpressRoute is private but not encrypted by default — it avoids the public internet rather than protecting the payload. Two mechanisms add encryption, and the exam distinguishes them by layer:
| MACsec | IPsec | |
|---|---|---|
| Layer | 2 (the physical link) | 3 (the IP payload) |
| Protects | Your router to Microsoft's edge router | End to end, across the circuit into the VNet |
| Requires | ExpressRoute Direct | A site-to-site VPN tunnel run over private peering |
| Scope | Everything on the link, including both peerings | The traffic inside the tunnel |
MACsec (ExpressRoute Direct only) encrypts all traffic on the physical link between your router and Microsoft's edge, at Layer 2 rather than at the IP layer.
IPsec over ExpressRoute is the alternative when you do not have ExpressRoute Direct: you establish a site-to-site VPN across ExpressRoute private peering, so the tunnel rides the private circuit instead of the internet.
⚠️ Exam Trap: "Encrypt traffic over ExpressRoute" does not mean "replace it with a VPN". If the scenario has ExpressRoute Direct, MACsec is the intended answer. If it does not, the answer is a VPN tunnel over the existing circuit.
