Connecting various On Premise Sites ( on MPLS & backup on Internet VPN) to workloads spread across 3 different Azure Regoins

Question

hi there ,

We have set of 12 different locations connected to Central DC via MPLS cloud and back up as Internet VPN. The DC will be decommissioned and all workloads will be moved to Azure cloud in 3 different regions . Requirement is to have these locations connected to these workloads in Azure. Each location will access workload in VNet based in its allocated nearest Region. Looking for a best way to do this.. Is it recommend to leverage MPLS provider cloud exchange solution to run Express routes to all 3 different regions from there . And for backup we use S2S tunnels directly from site over Internet . Or does Azure Virtual WAN fits in here

Answer 1

@Amanjit Saini

Thank you for reaching out.

I understand you have 12 different on-prem locations connected to Central DC via MPLS cloud and back up as Internet VPN. And now you are going to decommission the Central DC and move the workloads to Azure in 3 different regions. The requirement is to connect the 12 on-prem locations to an allocated Azure Region and establish connectivity via Virtual networks i.e. Azure Express Route and/or Azure VPN.

Depending on your requirements and based on my understanding above I think Virtual WAN will be better suited for this architecture. Although even though if you plan to use Azure WAN solution here you will have to connect the 12 on-prem locations to Azure Using Express Route/ VPN.

Following will be the advantage of using Azure WAN in this scenario.

• Virtual WAN provides large-scale site-to-site and express route connectivity. Virtual WAN supports up to 20-Gbps aggregate throughput both for VPN and ExpressRoute. More details here
• The three regions can depict a WAN hub and it will be easier to establish Hub to Hub connectivity and Any-to-any connectivity
• Easy to deploy and maintain NVA's in the WAN Hub along with Azure Firewall to sanitize the traffic and help secure the assets.

As Azure WAN brings different network functionalities together and are easy to maintain and implement, I think this will be a better suited service for your scenario.

You can go through following tutorials which can help in understanding more advantages of Azure WAN.

• https://www.youtube.com/watch?v=nP5XntjA7OQ
• https://www.youtube.com/watch?v=f-GyAURZWzg

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

​​Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi Amanjit,

This decision will also depends on different specific aspects such as application latency, budget , others. In general let me share you this comparison :

	Azure ExpressRoute	Azure Virtual WAN
Connectivity	Direct to Azure	Through Azure hub
Configuration	Can be configured in different ways, including CloudExchange Colocation, Point-to-point Ethernet Connection, Any-to-any (IPVPN) Connection, and ExpressRoute Direct	Automates site-to-site configuration and connectivity between on-premises sites and an Azure hub
Internet Dependence	No	Yes
Reliability	High	Depends on internet quality
Backup Connectivity	VPNs	VPNs
Use Case	Primary connectivity to Azure	Connecting branches and Azure

In your case, you could leverage the MPLS provider cloud exchange solution to run ExpressRoute to all 3 different Azure regions. For backup, you can use Site-to-Site (S2S) VPN tunnels directly from the site over the Internet. Alternatively, Azure Virtual WAN could also fit in here, providing automated connectivity and configuration, and allowing each location to access workloads in its nearest Azure region.

References:

• https://learn.microsoft.com/en-us/azure/expressroute/expressroute-connectivity-models
• https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure
• https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal
• https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/

If the information helped address your question, please Accept the answer.

Luis

Answer 3

We had a similar situation where we wanted to get away from a provider's MPLS solution. We went with vWan. We have hubs in 6 regions for our on-prem locations to connect to and utilize the microsoft backbone for all production traffic. All these locations also have a dmvpn backup solution.