2.7 Azure VPN Gateway and ExpressRoute
Key Takeaways
Site-to-site VPN commonly sends IPsec/IKE traffic over the public internet; point-to-site protocols vary, and VNet-to-VNet VPN can use the Microsoft backbone.
Site-to-Site VPN connects whole networks; Point-to-Site connects individual devices; VNet-to-VNet connects two VNets.
ExpressRoute is a private, dedicated connection through a connectivity provider that does NOT traverse the public internet.
ExpressRoute provides a private path with provisioned throughput and a connection SLA, but traffic is not encrypted by default; check current offer and location limits.
ExpressRoute Global Reach links on-premises sites to each other through the Microsoft backbone.
Quick Answer: A VPN Gateway supports encrypted connections, including site-to-site and point-to-site tunnels that typically cross the public internet. ExpressRoute is a private, dedicated circuit that does not use the public internet — faster, more predictable, with an SLA, but typically more expensive and not encrypted by default.
Azure VPN Gateway
An Azure VPN Gateway is a specific gateway resource deployed into a dedicated subnet named GatewaySubnet within your VNet. A typical site-to-site connection uses IPsec/IKE across the public internet; point-to-site can use IKEv2/IPsec, OpenVPN, or SSTP depending on the client. VNet-to-VNet VPN traffic can use the Microsoft backbone, so routing depends on the connection type.
There are three connection types you must distinguish on the exam:
| Connection type | Connects | Typical use |
|---|---|---|
| Site-to-Site (S2S) | An entire on-premises network ↔ an Azure VNet | Branch office or data center to Azure |
| Point-to-Site (P2S) | A single client device ↔ an Azure VNet | A remote worker's laptop |
| VNet-to-VNet | One Azure VNet ↔ another Azure VNet | Linking VNets across regions/subscriptions |
The classic scenario: "a remote employee needs to connect their laptop to the corporate Azure VNet" → Point-to-Site, because it connects one device, not a whole site. "Connect the head-office network to Azure" → Site-to-Site.
VPN Gateway SKUs trade off aggregate throughput and tunnel count. For site-to-site and point-to-site traffic that crosses the public internet, the path also affects performance; VNet-to-VNet traffic can use the Microsoft backbone.
Worked example: A retailer has a head-office data center and 30 branch stores. To link the head-office network to Azure you provision a Site-to-Site tunnel from the on-premises VPN device to the Azure VPN Gateway. For a field auditor who occasionally needs the corporate VNet from a hotel, you enable Point-to-Site, which installs a VPN client on that single laptop. The two are not interchangeable — choosing P2S for the whole head office would scale poorly, and choosing S2S for one laptop would require a router the auditor does not have.
For VPN traffic crossing the public internet, throughput and latency vary with internet conditions. The VPN Gateway SLA covers gateway availability, not the entire internet path.
Azure ExpressRoute
Azure ExpressRoute establishes a private, dedicated connection between your on-premises infrastructure and Microsoft (Azure and Microsoft 365) through a connectivity provider — it does not go over the public internet. This is the principal path distinction to understand.
Because the path is private and provisioned, ExpressRoute delivers:
- Provisioned throughput — circuit and Direct-port options vary by location and offer; select capacity for measured traffic needs.
- Lower, more consistent latency than internet-based VPN.
- Greater reliability with a connectivity SLA (the internet underneath a VPN has no SLA).
- A connection to Microsoft's edge that supports private peering (to your VNets) and Microsoft peering (to Microsoft 365 and Azure PaaS public endpoints).
An important and frequently missed fact: ExpressRoute is not encrypted by default. Its privacy comes from the dedicated circuit, not from cryptography. If encryption is required, you can run IPsec over ExpressRoute private peering. MACsec is available only on ExpressRoute Direct ports, not provider-provisioned circuits.
ExpressRoute Global Reach
ExpressRoute Global Reach lets you link your on-premises sites to each other through the Microsoft backbone using your existing ExpressRoute circuits — useful when, for example, a London office and a Singapore office should exchange traffic over Microsoft's network rather than your own WAN.
VPN Gateway vs. ExpressRoute: Decision Framework
For a typical on-premises-to-Azure connection, compare the requirements before choosing between these services. Map the keywords in the scenario to the right answer:
| Factor | VPN Gateway | ExpressRoute |
|---|---|---|
| Path | Typically public internet for on-premises S2S; VNet-to-VNet can use Microsoft backbone | Private, dedicated circuit |
| Encryption | Site-to-site uses IPsec/IKE; point-to-site protocol varies | Not encrypted by default |
| Throughput | Depends on gateway SKU and, for internet-based VPNs, the path | Depends on provisioned circuit or Direct option and location |
| Latency | Internet-based VPN latency varies with the path | Provisioned private path; verify end-to-end latency |
| SLA | Gateway SLA only | Connection SLA |
| Cost | Lower | Higher |
| Setup time | Minutes | Days/weeks (provider provisioning) |
How to read the scenario:
- Keywords "dedicated", "private", "does not use the public internet", "highest/predictable bandwidth", "mission-critical", "lowest latency" → ExpressRoute.
- Keywords "encrypted tunnel", "over the internet", "low cost", "quick to set up", "connect a branch office" → VPN Gateway (Site-to-Site).
- Keywords "individual laptop / remote worker" → Point-to-Site VPN.
Many enterprises use both: ExpressRoute for the primary private link and a Site-to-Site VPN as an encrypted failover if the circuit goes down.
Common Traps to Memorize
- ExpressRoute does not traverse the public internet — a wrong answer often claims it is "a faster internet VPN."
- ExpressRoute is not encrypted by default; do not assume privacy means encryption.
- Point-to-Site = one device; Site-to-Site = a whole network — read whether the scenario mentions a laptop or a site.
- A VPN Gateway lives in a subnet that must be named
GatewaySubnet. - Compare the connection path, encryption, and workload requirements; current throughput options depend on the selected offer and location.
Which Azure service provides a private, dedicated connection to Azure that does NOT use the public internet?
Site-to-Site VPN
VNet peering
Point-to-Site VPN
ExpressRoute
Does Azure ExpressRoute encrypt traffic by default?
Yes, all ExpressRoute traffic is encrypted with IPsec automatically
Encryption is mandatory and cannot be disabled
Only Microsoft peering traffic is encrypted
No, ExpressRoute relies on the dedicated private circuit and is not encrypted by default
A remote employee needs to connect their personal laptop to the company's Azure VNet. Which connection type is most appropriate?
Site-to-Site VPN
VNet-to-VNet connection
ExpressRoute
Point-to-Site VPN
A company already has ExpressRoute circuits at two on-premises sites and wants those sites to exchange traffic through the Microsoft backbone. Which capability fits?
Azure VPN Gateway
VNet peering
ExpressRoute Global Reach
Azure Front Door
Sections you finish are checked off in the contents.