How does Azure ExpressRoute work, and what is the GCP equivalent?
Show the answer
Say this first
An ExpressRoute circuit is a private connection, through a provider or ExpressRoute Direct, into Microsoft's edge. Every circuit has a primary and a secondary link to two Microsoft edge routers, both active, each with its own BGP session. Private peering reaches VNets through an ExpressRoute gateway in the VNet's GatewaySubnet; Microsoft peering reaches Microsoft 365 and Azure public services. Microsoft's ASN is 12076. GCP offers Dedicated and Partner Interconnect with BGP on Cloud Router.
Go deeper
Circuit anatomy
- Ordered at a peering location with a bandwidth (provider circuits from 50 Mbps up to 10 Gbps; ExpressRoute Direct gives you 10 or 100 Gbps ports).
- Two links, two BGP sessions per peering. For private peering you supply two
/30subnets (one per link), a VLAN ID and your ASN. - Private peering: to VNets. Needs an ExpressRoute virtual network gateway in
GatewaySubnet. FastPath can send data around the gateway for high-throughput cases. - Microsoft peering: to public Microsoft services, with public IPs and route filters.
- Global Reach: connects two of your circuits so two on-prem sites talk over Microsoft's backbone.
- Premium add-on: reach VNets in other geopolitical regions and a larger route limit.
Not encrypted
Same as Direct Connect. MACsec is available on ExpressRoute Direct; otherwise IPsec over private peering.
GCP Cloud Interconnect
- Dedicated Interconnect: your own 10 or 100 Gbps circuits into a Google colocation.
- Partner Interconnect: through a provider, smaller sizes.
- VLAN attachments connect to a Cloud Router, which runs BGP and installs routes in the VPC. Google publishes the topologies (two metros, four connections) needed for the 99.99% SLA.
Mapping across clouds
| AWS | Azure | GCP |
|---|---|---|
| Direct Connect connection | ExpressRoute circuit | Interconnect connection |
| Private VIF | Private peering | VLAN attachment |
| Public VIF | Microsoft peering | Private Google Access for on-prem hosts |
| BGP on your router to AWS | BGP to the Microsoft edge routers | BGP to Cloud Router |
They will ask next
Is a single ExpressRoute circuit redundant?
The two links protect against one edge router or link failing, but both sit in one peering location. A facility or provider outage takes both down. Critical sites use two circuits in two locations.
Where does the ExpressRoute gateway live, and why does it matter?
In
GatewaySubnetof the hub VNet. Its SKU caps throughput and connections, so a busy hub can be limited by the gateway rather than the circuit.
Traps
- Thinking the secondary link is standby. Both are active by default.
- Forgetting the ExpressRoute gateway SKU when planning bandwidth.