Express route

Buyani Ngwenya 21

Hi, Is it possible to route express route traffic from on-prem through a Virtual Appliance(Cisco virtual firwall hosted in Azure)?

SUNOJ KUMAR YELURU 14,466 Reputation points MVP

2021-07-29T00:21:14.427+00:00

To follow-up, Please let us know if you have further query on this.
Please don’t forget to Accept the answer
SUNOJ KUMAR YELURU 14,466 Reputation points MVP

2021-08-06T01:36:25.127+00:00

To follow-up, Please let us know if you have further query on this.
Please don’t forget to Accept the answer
Awari, Arun, Vodafone Group 1 Reputation point

2021-09-03T03:25:58.623+00:00

Yes, using different vnet and subnets, it is possible to route the traffic from express route from on prem to Virtula Appliance. For this you need to use user-defined routes which will override the system routes.

https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/secure-vnet-dmz?toc=%2Fazure%2Fvirtual-network%2Ftoc.json&tabs=portal

Below link provide some more details ---
ExpressRoute: You must use BGP to advertise on-premises routes to the Microsoft Edge router. You cannot create user-defined routes to force traffic to the ExpressRoute virtual network gateway if you deploy a virtual network gateway deployed as type: ExpressRoute. You can use user-defined routes for forcing traffic from the Express Route to, for example, a Network Virtual Appliance.

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

Hope above clarifies your doubts.

1 answer

SUNOJ KUMAR YELURU 14,466 Reputation points MVP

2021-07-28T14:08:16.447+00:00

Hi @Buyani Ngwenya

Configure secure encrypted connectivity between your on-premises network and your Azure virtual networks (VNets) over an ExpressRoute private connection. You can use Microsoft peering to establish a site-to-site IPsec/IKE VPN tunnel between your selected on-premises networks and Azure VNets. Configuring a secure tunnel over ExpressRoute allows for data exchange with confidentiality, anti-replay, authenticity, and integrity.

Refer configuration details-
https://learn.microsoft.com/en-us/azure/expressroute/site-to-site-vpn-over-microsoft-peering

VPN devices and device configuration guides
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#devicetable

If the Answer is helpful, please click Accept Answer and up-vote, this can be beneficial to other community members.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Your answer