Use ExpressRoute Gateway for IPSec connection

Question

Hi,

I'm planning to have ExpressRoute for the Hub network. Since it is taking some delay from the provider, I'm planning to have an IPSec connection for the time being. Can I deploy an ExpressRoute Gateway and use it for IPSec. Once the ExpressRoute circuit is completed, I will use the same gateway for ExpressRoute.

Answer 1

Hello @Nithin Radhakrishnan ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know if you can deploy an ExpressRoute Gateway and use it for IPSec.

ExpressRoute supports a couple of encryption technologies to ensure confidentiality and integrity of the data traversing between your network and Microsoft's network. This requires you to have ExpressRoute circuit.

Refer: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-encryption#end-to-end-encryption-by-ipsec-faq

https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering

But from your question, I understand that the ExpressRoute circuit is yet to be setup and you just want to use an IPSec connection for the time being to connect to Azure.

ExpressRoute gateway is used to send network traffic on a private connection and is used when configuring ExpressRoute. With ExpressRoute gateway, you can create a connection to link a virtual network to an Azure ExpressRoute circuit. It is not used for IPSec connection.

Refer: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-linkvnet-portal-resource-manager

If you want to configure IPSec connection, you need to consider VPN gateway, which is used to send encrypted traffic across the public Internet. Site-to-Site, Point-to-Site, and VNet-to-VNet connections all use a VPN gateway.

Refer: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-gateways

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-configure-vnet-connections#network-to-network-vpn-connection

https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/

https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

My suggestion is as below:

• Create a gateway subnet with /27 or a shorter prefix and deploy a route-based (non-Basic SKU) VPN gateway in Azure and connect to your on-premises for the time being.
• Later when the ExpressRoute circuit is provisioned and active, you can create an ExpressRoute gateway in the same gateway subnet and connect it to your ExpressRoute circuit and delete the existing VPN gateway. Or you can keep both the gateways as a coexisting setup if required.

Refer: https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.