Virtual networks, VPN Gateway and ExpressRoute
Networking connects Azure resources to each other, to the internet, and to your own offices.
Azure Virtual Network (VNet)
An Azure Virtual Network is your own private network in Azure. Resources in it, such as virtual machines, can communicate securely with each other, with the internet, and with on-premises networks.
A VNet provides:
- Isolation and segmentation: you choose its private IP address range and divide it into subnets.
- Internet communication: resources can be given public IP addresses or put behind a public load balancer.
- Communication between Azure resources: inside a VNet, and through service endpoints to PaaS services.
- Communication with on-premises networks: through VPN Gateway or ExpressRoute (below).
- Routing: Azure routes traffic between subnets automatically; route tables (user-defined routes) and BGP let you change where it goes.
- Filtering: network security groups (NSGs) allow or deny traffic by port, protocol and address, and network virtual appliances (such as firewalls) can inspect it.
A VNet belongs to one region and one subscription. Subnets let you split it into segments, for example a web subnet and a database subnet, each with its own rules.
Virtual network peering
Peering connects two VNets so their resources talk as if they were on one network. Traffic between peered VNets stays on Microsoft's private backbone, never the public internet. Global peering connects VNets in different regions.
Connecting on-premises networks to Azure
VPN Gateway
A VPN gateway sends encrypted traffic over the public internet between Azure and your network. You deploy it in a dedicated subnet of a VNet, and each VNet can have one VPN gateway. Connection types:
- Site-to-site: connects a whole office network to Azure.
- Point-to-site: connects a single computer to Azure.
- VNet-to-VNet: connects two Azure VNets.
There are two kinds of VPN: route-based (the usual choice; routes decide which traffic enters the tunnel, and it supports point-to-site and coexisting with ExpressRoute) and the older policy-based (a fixed list of address ranges decides). For high availability you can run the gateway active-active (two tunnels at once), deploy it zone-redundant across availability zones, or use a VPN as the failover path for ExpressRoute.
VPN gateways are quick to set up and inexpensive, but traffic still travels over the internet.
ExpressRoute
Azure ExpressRoute extends your on-premises network into Microsoft's cloud over a private, dedicated connection through a connectivity provider. It does not go over the public internet.
- More reliable, with faster and more consistent speeds and lower latency
- Better for security and compliance requirements
- Dynamic routing with BGP, and built-in redundancy in every peering location
- Reaches Azure services and Microsoft 365 alike
- Costs more and takes longer to set up than a VPN
You connect in one of four ways:
| Connectivity model | How it works |
|---|---|
| Cloud exchange co-location | your equipment sits in a co-location facility that has a cloud exchange, and you get a virtual cross-connect to Microsoft |
| Point-to-point Ethernet | a dedicated Ethernet link from your site to Microsoft |
| Any-to-any (IP VPN) | Microsoft joins your provider's wide area network, like another branch office |
| ExpressRoute Direct | you connect straight to Microsoft's network at a peering location, at very high speeds |
ExpressRoute Global Reach links your own sites to each other through Microsoft's network, for example an office in London to one in Mumbai, without using the internet.
A few things still use the internet even with ExpressRoute, such as DNS lookups and certificate revocation checks.