Hybrid Connectivity
VPN Gateway · ExpressRoute · Global Reach · Metro
Practice questions for this topic →
VPN vs ExpressRoute
| Site-to-site VPN | ExpressRoute | |
|---|---|---|
| Path | Encrypted (IPsec/IKE) over the public internet | Private connection through a provider; not over the internet |
| Quality | Variable | More reliable, faster and consistent latency; uptime SLA |
| Encryption | Built in | Not encrypted by default; MACsec on ExpressRoute Direct, or IPsec end to end |
| Routing | BGP supported | Dynamic BGP; two connections to two Microsoft Enterprise Edge routers |
ExpressRoute options
| Option | Use for |
|---|---|
| Local SKU | Unlimited data plan only |
| Standard SKU | Metered or unlimited; all regions in the same geopolitical region |
| Premium add-on | Global connectivity across geopolitical regions; required for Global Reach between geopolitical regions |
| Global Reach | Links ExpressRoute circuits so on-premises sites reach each other over Microsoft's network |
| Metro | Dual-homed to two peering locations in one city for the same cost as a standard circuit; the standard pair of links doesn't survive loss of the whole peering location |
| Direct | Dual 10, 100 or 400 Gbps ports straight into Microsoft with no provider; physical isolation; enroll the subscription (AllowExpressRoutePorts) |
| FastPath | Traffic bypasses the gateway to reach VMs; needs Ultra Performance, ErGw3AZ or ErGwScale (10+ units); Direct supports UDR, VNet peering and Private Link over it, provider circuits are IPv4 only |
All ingress is free except with the Global Reach add-on. Outbound data is included only in Unlimited plans.
Encryption, coexistence and VPN SKUs
- MACsec encrypts at layer 2 and works only on ExpressRoute Direct. You bring the key (stored in Key Vault). Once enabled, all control and data traffic is encrypted. A key mismatch drops connectivity: there's no fallback to unencrypted. Ciphers: GCM-AES-128/256 and XPN variants. IPsec gives end-to-end layer 3 encryption.
- S2S VPN as an ExpressRoute failover works for private peering only (no VPN failover for Microsoft peering). Requirements: route-based VPN gateway (not Basic SKU), keep the VPN gateway ASN at 65515, gateway subnet /27 or larger, and prefer ExpressRoute with a higher local preference to avoid asymmetric routing.
- Point-to-site VPN uses OpenVPN, IKEv2 or SSTP; site-to-site and VNet-to-VNet use IPsec/IKE; tunnels share the gateway's bandwidth.
- VPN SKU consolidation: since Nov 1, 2025 you can't create non-AZ VpnGw1–5 gateways; existing ones can be upgraded manually until Sep 2026 (no downtime if they already use a Standard public IP; Basic IPs must upgrade). Names ending in AZ are zone-supported.
Exam Tips
Tick each tip once you can answer it without looking.
“Private connection that does not traverse the internet with predictable latency” → ExpressRoute. Trap: VPN is encrypted but still goes over the internet.
“Encrypted connectivity, quick and cheap” → Site-to-site VPN.
“Failover path if the ExpressRoute circuit goes down” → Site-to-site VPN coexisting with ExpressRoute.
“Connect two on-prem datacenters via their ExpressRoute circuits” → ExpressRoute Global Reach.
“ExpressRoute must reach VNets in another geopolitical region” → ExpressRoute Premium.
“Survive the loss of a single peering location” → ExpressRoute Metro (or circuits at two locations).
“Need 100 Gbps with no connectivity provider” → ExpressRoute Direct.
“Individual remote users connect to a VNet with Entra ID sign-in” → Point-to-site VPN (OpenVPN + Entra ID auth).
“New zone-resilient VPN gateway” → VpnGw1AZ–VpnGw5AZ. Trap: Non-AZ SKUs can no longer be created and are being migrated.
“Traffic over ExpressRoute must be encrypted” → MACsec (ExpressRoute Direct) or IPsec VPN over private peering.
“ExpressRoute circuit SKUs” → Local (unlimited only), Standard (metered or unlimited), Premium add-on (global connectivity). Trap: All ingress is free except with the Global Reach add-on.
“ExpressRoute Direct capacity” → Dual 10, 100 or 400 Gbps ports straight into Microsoft with no provider. Trap: Enroll the subscription with AllowExpressRoutePorts.
“ExpressRoute FastPath” → Bypasses the gateway to reach VMs; needs Ultra Performance, ErGw3AZ or ErGwScale with 10+ units. Trap: Provider circuits are IPv4 only; UDR and VNet peering over FastPath need Direct.
“ExpressRoute MACsec rules” → Only on Direct; you supply the key (Key Vault); once on, all traffic is encrypted; a key mismatch drops connectivity with no fallback. Trap: ExpressRoute isn't encrypted by default; IPsec is the end-to-end option.
“Site-to-site VPN as ExpressRoute backup” → Private peering only; route-based gateway (not Basic); ASN 65515; gateway subnet /27 or larger. Trap: No VPN failover exists for Microsoft peering; prefer ExpressRoute with higher local preference.
“VPN Gateway SKU consolidation” → No new non-AZ VpnGw1-5 since Nov 1, 2025; migrate by Sep 2026; no downtime if a Standard public IP is already used. Trap: Basic public IPs must be upgraded.
“VPN connection types and protocols” → Site-to-site: IPsec/IKE. Point-to-site: OpenVPN, IKEv2 or SSTP. Also VNet-to-VNet. Trap: Tunnels share the gateway's bandwidth.
“VPN Gateway SKU consolidation order of events” → Migration window Sep 2025 to Sep 2026; new non-AZ VpnGw1-5 gateways can't be created from Nov 1, 2025; old SKUs scheduled for deprecation after Sep 2026. Trap: A manual upgrade has no downtime if the gateway already uses a Standard public IP.