Complete Azure ExpressRoute reference: circuit provisioning, peering types, FastPath, Global Reach, redundancy architecture, Megaport integration, and production Terraform.
ON-PREMISES PROVIDER EDGE AZURE
─────────────────────────────────────────────────────────────────────
Customer Edge Router Meet-Me Location ExpressRoute GW
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ CE Router │ │ Provider MSEE │ │ GW in GatewayS- │
│ BGP AS: 65001 │──Port────│ (MSEE Pair) │──────►│ ubnet of VNet │
│ │ 1Gbps │ Microsoft AS │ │ │
│ Primary link │ │ 12076 │ │ Private Peering │
│ + Backup link │──Port────│ (redundant MSEE)│ │ BGP 65515 │
└──────────────────┘ └──────────────────┘ └──────────────────┘
│ │
│ ┌─────────────────────────────────────────────┐ │
│ │ ExpressRoute Circuit (the "pipe") │ │
│ │ • SKU: Standard or Premium │ │
│ │ • Bandwidth: 50Mbps → 100Gbps │ │
│ │ • Provider: Equinix, Megaport, AT&T, etc. │ │
│ └─────────────────────────────────────────────┘ │
│ │
└──────────────────────────────────────────────────────────┘
Private Peering (VNet access)
Microsoft Peering (O365, Azure PaaS)
| Peering | Access | BGP Prefixes | Use Case |
|---|---|---|---|
| Private Peering | Azure VNets | On-prem prefixes ↔ VNet prefixes | Private workloads, VMs, databases |
| Microsoft Peering | Microsoft cloud (O365, Azure PaaS public IPs) | On-prem prefixes / NAT pool | Office 365, Azure Storage public endpoint |
Azure Public Peering was deprecated — Microsoft Peering replaced it.
Data Center A (UK) Data Center B (US)
┌──────────────┐ ┌──────────────┐
│ CE Router │──ExpressRoute─►Azure UK◄──│ CE Router │
│ AS 65001 │ │ │ AS 65002 │
└──────────────┘ │ └──────────────┘
│
Global Reach: enables
DC-A ←→ DC-B via Azure
backbone (no public internet)
Use case: Branch offices communicating via ExpressRoute
without internet breakout at each site
# azure-expressroute/terraform/main.tf
provider "azurerm" { features {} }
# Step 1: Create the ExpressRoute Circuit
resource "azurerm_express_route_circuit" "this" {
name = "erc-corp-to-azure"
resource_group_name = azurerm_resource_group.this.name
location = var.location
service_provider_name = "Megaport" # or Equinix, AT&T, etc.
peering_location = "Washington DC" # provider's meet-me location
bandwidth_in_mbps = 1000 # 1 Gbps
sku {
tier = "Standard" # Standard (regional) or Premium (global)
family = "MeteredData" # MeteredData or UnlimitedData
}
tags = var.tags
}
# Step 2: Configure Private Peering (after circuit provisioned by provider)
resource "azurerm_express_route_circuit_peering" "private" {
peering_type = "AzurePrivatePeering"
express_route_circuit_name = azurerm_express_route_circuit.this.name
resource_group_name = azurerm_resource_group.this.name
peer_asn = 65001 # Your on-premises ASN
primary_peer_address_block = "169.254.0.0/30" # /30 for primary link
secondary_peer_address_block = "169.254.0.4/30" # /30 for secondary link
vlan_id = 100
shared_key = var.bgp_auth_key # MD5 authentication
}
# Step 3: Create ExpressRoute Gateway in GatewaySubnet
resource "azurerm_virtual_network_gateway" "expressroute" {
name = "ergw-corp"
resource_group_name = azurerm_resource_group.this.name
location = var.location
type = "ExpressRoute"
sku = "ErGw3AZ" # ErGw1AZ/2AZ/3AZ or UltraPerformance
ip_configuration {
name = "gwipconfig"
public_ip_address_id = azurerm_public_ip.gw.id
private_ip_address_allocation = "Dynamic"
subnet_id = azurerm_subnet.gateway.id
}
tags = var.tags
}
# Step 4: Connect Gateway to Circuit
resource "azurerm_virtual_network_gateway_connection" "expressroute" {
name = "conn-expressroute"
resource_group_name = azurerm_resource_group.this.name
location = var.location
type = "ExpressRoute"
virtual_network_gateway_id = azurerm_virtual_network_gateway.expressroute.id
express_route_circuit_id = azurerm_express_route_circuit.this.id
# Enable FastPath for traffic to bypass gateway (requires ErGw3AZ or UltraPerformance)
express_route_gateway_bypass = true
routing_weight = 10
tags = var.tags
}WITHOUT FastPath:
On-prem → ExpressRoute → Azure GW → VNet VM
Latency: GW adds 1-2ms; GW max throughput: 10Gbps (ErGw3AZ)
WITH FastPath:
On-prem → ExpressRoute → VNet VM (bypasses GW for data plane)
Latency: No GW overhead; throughput: limited by circuit bandwidth
Requires: ErGw3AZ or UltraPerformance SKU
Enable:
express_route_gateway_bypass = true (in connection resource)
Limitations:
• Does NOT bypass GW for: VNet peering traffic, UDR next-hop
• Basic Load Balancer behind ExpressRoute: not supported with FastPath
MANDATORY: Two physical links to two separate MSEEs
Primary link → MSEE-1 (VLAN 100)
Secondary link → MSEE-2 (VLAN 100)
Azure automatically BGP peers with both MSEEs.
If one MSEE fails, traffic moves to the other within seconds.
RECOMMENDED: Two ExpressRoute circuits from different providers
Circuit 1: Megaport → Washington DC MSEE
Circuit 2: Equinix → Washington DC MSEE (different physical path)
Cost: 2x circuit fee + 2x GW connection fee
Benefit: No single provider failure risk
! On-premises CE Router — ExpressRoute BGP
router bgp 65001
neighbor 169.254.0.1 remote-as 12076 ! Primary MSEE (Microsoft ASN)
neighbor 169.254.0.1 description ER-PRIMARY-MSEE
neighbor 169.254.0.1 password MD5_AUTH_KEY
neighbor 169.254.0.1 soft-reconfiguration inbound
neighbor 169.254.0.5 remote-as 12076 ! Secondary MSEE
neighbor 169.254.0.5 description ER-SECONDARY-MSEE
neighbor 169.254.0.5 password MD5_AUTH_KEY
address-family ipv4
! Advertise on-premises subnets to Azure
network 10.10.0.0 mask 255.255.0.0
network 10.20.0.0 mask 255.255.0.0
neighbor 169.254.0.1 activate
neighbor 169.254.0.5 activate
exit-address-family
| Metric | Alert Threshold | Action |
|---|---|---|
BitsInPerSecond / BitsOutPerSecond |
> 80% of circuit bandwidth | Upgrade circuit |
ArpAvailability |
< 100% | Check BGP session |
BgpAvailability |
< 100% | Investigate peering |
GlobalReachBitsInPerSecond |
Baseline ± 30% | Investigate routing |
MIT License