Choosing Between Azure VPN Gateway and ExpressRoute

Overview and What You Will Learn

In this lab, you will create a Site-to-Site VPN Gateway connection, understand the setup and characteristics of ExpressRoute conceptually alongside it, and see why a resilient production hybrid network commonly uses both together rather than choosing only one.

Why This Matters in Production

An enterprise migrating a core banking workload to Azure needs consistent, predictable latency between their on-premises datacenter and Azure - a VPN connection running over the shared public internet cannot guarantee this the way a dedicated physical circuit can. ExpressRoute exists specifically for this requirement, at a meaningfully higher cost and longer provisioning time than a VPN.

Core Principles

VPN Gateway and ExpressRoute both connect an on-premises network to an Azure VNet, but through fundamentally different paths.

A common, resilient production pattern uses ExpressRoute as the primary connection for its performance and reliability, with a VPN Gateway configured as an automatic backup path if the ExpressRoute circuit ever fails - combining the strengths of both rather than relying on just one.

Detailed Step-by-Step Practical Lab

1. Create a Resource Group and a VNet with a dedicated gateway subnet:

Note

The subnet used for a VPN Gateway must be named exactly GatewaySubnet - Azure specifically looks for this name when creating the gateway, similar to how Bastion requires its own exact subnet name.

2. Create a public IP for the VPN Gateway:

3. Create the VPN Gateway itself - this step commonly takes 30-45 minutes to complete, since Azure is provisioning dedicated infrastructure:

4. Create a Local Network Gateway representing your on-premises network's public IP and address range:

5. Create the actual Site-to-Site connection linking the two gateways, using a pre-shared key both sides must match:

6. Confirm the connection status once both sides are configured (in a real scenario, your on-premises firewall or router needs matching configuration):

7. ExpressRoute is provisioned through a different workflow entirely - working with a connectivity provider to establish the physical circuit, then creating an ExpressRoute Circuit resource in Azure and linking it to your VNet via an ExpressRoute Gateway, a process that commonly takes weeks rather than the minutes-to-an-hour a VPN Gateway requires.

8. Clean up:

Production Best Practices & Common Pitfalls

Common Mistake

Choosing VPN Gateway as the sole connectivity method for a workload that genuinely needs the low, consistent latency ExpressRoute provides - like real-time financial trading systems - then discovering internet-path latency variability causes real problems under load.

Tip

Both VPN Gateway and ExpressRoute commonly use BGP (Border Gateway Protocol) to exchange routes dynamically between your network and Azure, rather than requiring static routes to be manually maintained on both sides as your network changes over time.

• VPN Gateway is provisioned in minutes to an hour; ExpressRoute takes weeks, since it involves coordinating a physical circuit with a connectivity provider. Plan ExpressRoute provisioning time into any migration timeline well in advance.
• The pre-shared key in a Site-to-Site VPN must match exactly on both the Azure side and the on-premises device. A mismatched key is one of the most common reasons a newly created VPN connection shows as "Not Connected" despite every other setting appearing correct.

Quick Reference & Troubleshooting Commands