13.2 Hybrid Connectivity Design
Key Takeaways
- VPN Gateway encrypts traffic over the public internet (IPsec/IKE); ExpressRoute is a private, non-internet circuit with higher SLA (99.95%) but no built-in encryption unless you add IPsec or MACsec.
- ExpressRoute bandwidth ranges from 50 Mbps to 10 Gbps per circuit; ExpressRoute Direct offers dual 10-Gbps, 100-Gbps, or 400-Gbps ports for the largest enterprises.
- ExpressRoute Premium SKU raises the route limit from 4,000 to 10,000 routes and unlocks global connectivity across geopolitical regions — Local and Standard SKUs are region/geography-limited.
- Virtual WAN Basic hubs support only Site-to-Site VPN (up to 500 Mbps aggregate); Standard hubs add ExpressRoute, Point-to-Site VPN, VNet-to-VNet transit, Azure Firewall, and up to 20 Gbps per hub.
- Standard Virtual WAN hubs are automatically connected in a full mesh over the Microsoft backbone, removing the need to manually configure any-to-any VNet peering or transit routing.
Why This Topic Matters
"Recommend a connectivity solution that connects Azure resources to on-premises networks" is official Domain 4 bullet #46, and hybrid connectivity design questions are near-guaranteed on AZ-305 because almost every enterprise workload assumes a hybrid footprint. The exam distinguishes candidates who memorize service names from those who can reason about bandwidth, encryption, cost, and blast radius trade-offs across VPN Gateway, ExpressRoute, and Virtual WAN.
VPN Gateway
An Azure VPN Gateway creates an encrypted (IPsec/IKE) tunnel over the public internet between Azure and an on-premises location (Site-to-Site), an individual client (Point-to-Site), or another Azure VNet (VNet-to-VNet). Key design facts:
- SKUs span from legacy Basic (avoid — deprecated) through VpnGw1-5 and the zone-redundant VpnGw1AZ-5AZ family, with aggregate throughput benchmarks roughly from 650 Mbps (VpnGw1) up to 10 Gbps (VpnGw5).
- The Az-suffixed SKUs (e.g., VpnGw2AZ) deploy gateway instances across Availability Zones for zone resiliency — always recommend the AZ SKU in a region that supports zones unless the scenario has a specific reason not to.
- VPN Gateway traffic traverses the public internet (encrypted), so it inherits internet variability — not ideal for workloads with strict, consistent low-latency requirements.
- Active-active gateway configuration (two instances, both active) improves resiliency over active-passive.
ExpressRoute
ExpressRoute provides a private, dedicated connection to Azure through a connectivity provider — traffic never traverses the public internet, which is why ExpressRoute carries a 99.95% SLA (vs. VPN Gateway's lower internet-dependent reliability) and far more predictable latency.
Bandwidth and SKU Tiers
| Aspect | Detail |
|---|---|
| Circuit bandwidth options | 50 Mbps, 100 Mbps, 200 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps |
| ExpressRoute Direct | Dual 10-Gbps, 100-Gbps, or 400-Gbps ports (largest enterprises, multiple circuits over one physical connection) |
| Local SKU | VNets in the same Azure region as the circuit's peering location only |
| Standard SKU | VNets within the same geopolitical region |
| Premium SKU | Global connectivity — a circuit in any region reaches VNets in every region worldwide; also raises route limit from 4,000 to 10,000 routes |
Encryption caveat: ExpressRoute private peering is not encrypted by default. If a workload has a compliance requirement for encryption-in-transit over ExpressRoute, the design must add IPsec over ExpressRoute (site-to-site VPN layered on the private peering) or MACsec (link-layer encryption, typically with ExpressRoute Direct). This is a classic AZ-305 trap: candidates assume "private connection" means "encrypted," and the exam will test that assumption directly.
VPN as ExpressRoute Failover
A resilient hybrid design layers a Site-to-Site VPN Gateway as a backup path for ExpressRoute failure — both connect into the same virtual network gateway subnet, and Azure prefers the ExpressRoute route (via BGP) when both are healthy.
Virtual WAN
Virtual WAN is Microsoft's managed hub-and-spoke networking service that consolidates VPN, ExpressRoute, Point-to-Site, and NVA/firewall connectivity into virtual hubs, automatically meshed together.
| Hub Type | Site-to-Site VPN | ExpressRoute | Point-to-Site VPN | VNet-to-VNet Transit | Azure Firewall | Max Throughput |
|---|---|---|---|---|---|---|
| Basic | Yes | No | No | No | No | ~500 Mbps aggregate |
| Standard | Yes | Yes | Yes | Yes | Yes | Up to 20 Gbps per hub |
Standard hubs are automatically connected in a full mesh over the Microsoft global backbone, so any spoke VNet or branch site can reach any other spoke or branch without manually configuring peering or transit routes — this is the single biggest operational win over building the same topology manually with VNet peering and route tables. Routing Intent and Routing Policies on a Standard hub can force all internet-bound or private (VPN/ExpressRoute/VNet/NVA) traffic through a security appliance (Azure Firewall, NVA, or partner SaaS) deployed in the hub.
Decision Table
| Scenario | Recommended Solution |
|---|---|
| Small number of sites, moderate bandwidth, cost-sensitive, tolerant of internet variability | Site-to-Site VPN Gateway (AZ SKU) |
| Consistent low latency, high bandwidth, mission-critical, predictable performance SLA needed | ExpressRoute (Standard or Premium SKU based on region reach) |
| Dozens to hundreds of branch sites, need centralized any-to-any routing and built-in firewall | Virtual WAN Standard hub(s) with VPN + ExpressRoute gateways |
| Only 1-2 sites, all in one Azure region, low bandwidth (<500 Mbps) | Virtual WAN Basic hub (Site-to-Site VPN only) |
| Regulatory requirement for encryption over a private circuit | ExpressRoute + IPsec (or MACsec on ExpressRoute Direct) |
Exam Scenario
A logistics company has 60 branch offices across North America and Europe, a headquarters requiring guaranteed low-latency access to Azure SQL Managed Instance, and a security mandate to centrally inspect all branch-to-branch and branch-to-internet traffic. The design: a Virtual WAN with Standard hubs in each major region (any-to-any full mesh over Microsoft's backbone), an ExpressRoute circuit (Standard or Premium SKU depending on regional reach) with Premium SKU if HQ needs cross-geography VNet access connected into the HQ-region hub for the latency-sensitive SQL MI traffic, Site-to-Site VPN gateways in each Standard hub for the 60 branch sites, and Routing Intent configured to force all internet and inter-hub traffic through an Azure Firewall deployed in each hub for centralized inspection.
A design requires 15 branch offices in a single Azure region, each needing only basic Site-to-Site VPN connectivity under 500 Mbps aggregate, with no need for ExpressRoute or a central firewall. Which Virtual WAN hub type is most cost-appropriate?
A finance company uses ExpressRoute Standard SKU private peering to connect to Azure and has a compliance requirement that all data in transit must be encrypted. What should the architect add to the design?