Most companies do not move everything to the cloud at once, so they need a safe bridge between the two worlds.

Let us start with some basic words. Azure is Microsoft’s cloud platform, a huge collection of computers in data centers that you rent when you need them. A network is a group of computers connected so they can talk to each other. On-premises means the computers and equipment that sit in your own buildings, such as your office server room, as opposed to the cloud. A virtual network, shortened to VNet, is your own private network inside Azure, isolated from other customers.

Many organizations keep some systems in their own buildings and move others into Azure. This mixture is called a hybrid cloud. For a hybrid cloud to work, the on-premises network and the Azure VNet must be able to exchange data privately and reliably. A payroll program in the office may need to read a database in Azure. An application in Azure may need to look up customers stored in an old office system. Without a connection, these two sides are strangers who cannot talk.

Azure gives you two main ways to build this connection. VPN Gateway sends encrypted traffic across the public internet. ExpressRoute uses a private line from a telecom provider that never touches the public internet. Both end up at your Azure VNet, but the journey is very different.

flowchart LR
    OP["On-premises network"] -- "Encrypted tunnel over the public internet" --> VG["VPN Gateway"]
    OP -- "Private dedicated line via a provider" --> ER["ExpressRoute"]
    VG --> VN["Azure virtual network"]
    ER --> VN
        

A VPN creates a protected tunnel through a public network so that outsiders cannot read your data.

VPN stands for Virtual Private Network. The word “virtual” means the private network is created by software, not by laying a new physical cable. The word “private” means that only the two ends can understand the data. The public internet carries your messages, but the messages are scrambled so that anyone who intercepts them sees only nonsense.

The scrambling is called encryption. Data is converted into unreadable code using a secret key, and only someone holding the matching key can turn it back into readable form. The protected path that encrypted data travels through is called a tunnel. To build a tunnel, both ends agree on a set of rules for how to prove identity and how to encrypt. The most common rule set used between sites is called IPsec, together with a negotiation method called IKE, short for Internet Key Exchange. Azure VPN Gateway uses these standards.

VPN Gateway is the Azure service that ends the encrypted tunnel on the cloud side.

A gateway is a device or service that sits at the edge of a network and controls traffic going in and out. Azure VPN Gateway is a special kind of virtual network gateway that you place inside your VNet. Its job is to send encrypted traffic between your Azure VNet and an outside location over the public internet. The outside location may be your office, an individual traveling employee, or another Azure VNet.

Behind the scenes, Azure runs two or more virtual machines for each gateway, which are managed entirely by Microsoft. You never log into them. You only choose the size, the settings and the connections. By default, the two machines work as a pair in an active and standby arrangement, so if one fails the other takes over. This is the first layer of protection against failure.

flowchart LR
    D["On-premises VPN device"] -- "IPsec tunnel over the internet" --> G["Azure VPN Gateway in GatewaySubnet"]
    LNG["Local network gateway: describes the on-premises side"] -. "linked by" .-> C["Connection with shared key"]
    G -. "linked by" .-> C
    G --> V["VMs and services in the VNet"]
        

VPN Gateway supports connecting whole sites, single users, and other virtual networks.

The size of the gateway you choose decides its speed, the number of tunnels and how resilient it is.

A SKU is simply a product size with its own features and price. VPN gateways come in a range of SKUs, with names such as VpnGw1, VpnGw2 and so on up to VpnGw5. Bigger numbers give higher throughput and more tunnels. Throughput is the amount of data that can move through each second. Rough figures range from several hundred megabits per second for the smaller sizes to around ten gigabits per second for the largest. An older Basic SKU also exists, but it is considered a legacy option with many limits, so it is not suitable for new production designs.

Each size also exists in a zone-redundant form, often marked with the letters AZ in the name. An availability zone is a physically separate data center building inside an Azure region, with its own power and cooling. A zone-redundant gateway places its machines in different zones, so it keeps working even if an entire building is lost.

Routing decides which traffic goes into the tunnel and how the two sides learn each other’s addresses.

A route is a rule that says, “traffic going to this address range should be sent this way.” A VPN has to know which address ranges live on each side so that the right traffic enters the tunnel. There are two styles of VPN for this.

What is BGP?

BGP, the Border Gateway Protocol, is the language that networks use to tell each other which address ranges they can reach. Instead of typing every range by hand, the two sides announce them automatically. If a new subnet is added on either side, the other side learns about it at once. BGP also makes it possible to have several tunnels and to switch traffic automatically if one fails.

The steps are the same in concept for every site-to-site VPN, and following them in order avoids confusion.

Point-to-Site gives remote workers secure access to Azure resources without a physical office.

Not every user sits inside an office with a VPN device. People work from home, from cafes and from airports. For them, Azure offers a point-to-site VPN. The user installs a VPN client, chooses a profile that points to the Azure gateway, signs in, and gets a private connection into the VNet.

Choosing a protocol

OpenVPN works on many kinds of devices and passes through most firewalls. SSTP works on Windows and runs over the same port as ordinary secure web traffic, so it passes through most restrictive networks. IKEv2 is quick and well suited to mobile devices that change networks often. The right choice depends on the devices your staff use.

ExpressRoute is a private connection from your network to Microsoft that does not use the public internet.

ExpressRoute lets you extend your on-premises network into the Microsoft cloud over a private connection provided by a connectivity provider, which is a telecom company. Because the traffic never travels over the public internet, ExpressRoute generally offers more reliability, faster and more consistent speeds, and lower delay than ordinary internet-based connections.

The word latency means the time a message takes to travel from one point to another. For applications that talk to each other thousands of times a second, such as a database in Azure queried by a program in the office, steady low latency matters a great deal. A private line gives more predictable latency than the shared internet.

An ExpressRoute circuit is the logical connection that you order, and a provider builds the physical path.

The unit you buy is an ExpressRoute circuit. A circuit is a logical link between your network and Microsoft, ordered in the Azure portal and delivered through a connectivity provider at a peering location, which is a facility where the provider and Microsoft networks meet. When you create a circuit, Azure gives you a service key, a unique code that you pass to your provider so they can attach your line to your circuit.

Each circuit includes two connections, a primary and a secondary, going to two separate Microsoft edge routers at the peering location. This built-in pair gives you redundancy against a single device or cable failure. To benefit from it, your own network must be set up to use both.

flowchart LR
    CE["Your edge routers"] --> PR["Connectivity provider network"]
    PR --> M1["Microsoft edge router: primary"]
    PR --> M2["Microsoft edge router: secondary"]
    M1 --> GW["ExpressRoute gateway in your VNet"]
    M2 --> GW
    GW --> VN["Azure virtual network"]
        

Four connectivity models

Peering decides which Microsoft services your private connection can reach.

In ExpressRoute, peering is a routing relationship between your network and Microsoft’s network over the circuit. A circuit can carry different kinds of peering for different destinations.

You choose how fast the circuit is, how far it reaches and how data usage is billed.

Bandwidth is the maximum amount of data a circuit can carry each second. Circuits ordered through providers are available in a range of speeds, from small ones such as fifty megabits per second up to ten gigabits per second, while ExpressRoute Direct offers high-speed ports. You can usually raise the bandwidth later without rebuilding the circuit.

Metered and unlimited data plans

With a metered plan, you pay a monthly fee for the circuit plus a charge for the data that leaves Azure. With an unlimited plan, the monthly fee is higher but outbound data is included. If you move large amounts of data out of Azure every month, the unlimited plan is often cheaper. Data coming into Azure is generally not charged in either plan.

Extra components and options connect the circuit to your VNets and improve performance.

A circuit by itself reaches Microsoft’s edge. To connect it to a particular virtual network, you place an ExpressRoute gateway in that VNet, again inside a GatewaySubnet. You then create a connection that links the gateway to the circuit. The gateway has its own size options, which decide how much traffic it can pass and how many connections it handles. One circuit can connect to several VNets, within the limits of its SKU.

A private line is not the same as an encrypted line, so you may need to add protection.

Since ExpressRoute traffic avoids the public internet, many companies feel it is safe enough. Others, especially those with strict rules for finance, healthcare or government data, require encryption as well. Azure supports several ways to add it.

Both reach Azure, but they differ in path, speed, cost, setup time and promise of reliability.

flowchart TD
    S["Need to connect to Azure"] --> Q1{"Individual remote users?"}
    Q1 -- Yes --> P["VPN Gateway: Point-to-Site"]
    Q1 -- No --> Q2{"Need steady high speed and low delay?"}
    Q2 -- Yes --> Q3{"Can you wait for a provider to build it?"}
    Q3 -- Yes --> E["ExpressRoute"]
    Q3 -- No --> V1["Start with a Site-to-Site VPN"]
    Q2 -- No --> V2["VPN Gateway: Site-to-Site"]
    E --> B["Consider a VPN as backup"]
        

A VPN can quietly stand by as a backup for an ExpressRoute circuit.

Even a private line can be cut by a digger or a provider’s fault. Critical systems therefore plan a second path. One popular design uses ExpressRoute as the main route and a site-to-site VPN as a backup. The two connections can exist side by side on the same VNet. Routing is arranged so that traffic prefers ExpressRoute while it is healthy, and moves automatically to the VPN tunnel if ExpressRoute fails. This is called failover.

Other resilience steps include ordering two circuits from different providers at different peering locations, using zone-redundant gateways, and testing failover before you need it. The more critical the system, the more independent paths it deserves.

Larger organizations place one gateway in a central hub network and share it with many others.

When a company has many virtual networks, building a separate gateway in each would be wasteful and hard to manage. A common pattern is the hub-and-spoke design. One central VNet, called the hub, holds shared services including the VPN or ExpressRoute gateway. Other VNets, called spokes, are connected to the hub by VNet peering. With a feature called gateway transit, spokes can use the hub’s gateway to reach on-premises networks without having gateways of their own.

A connection to the cloud is also a door into your network, so it must be guarded.

Joining the two networks means a problem on one side can spread to the other. A few habits reduce this risk.

A few key numbers and tools show whether your connections are healthy.

Hybrid connections fail in many small ways: a wrong key, a changed address on the office router, an expired certificate or a provider fault. Azure offers tools to see what is happening.

A simple troubleshooting path

The two services are priced very differently, so compare the whole bill and not just one line.

For VPN Gateway, you pay an hourly charge based on the gateway SKU you choose, plus charges for data leaving Azure. Larger SKUs cost more per hour. You also pay for the public IP addresses used. There is no separate provider fee, because the connection uses your ordinary internet service.

For ExpressRoute, the cost has several parts: a monthly charge for the circuit based on its bandwidth and SKU, a charge for the ExpressRoute gateway in your VNet, outbound data charges on metered plans, and the connectivity provider’s own fees for the physical line. Add-ons such as Global Reach or Direct ports bring extra charges. Exact prices change and vary by region, so check the official pricing pages and use the Azure pricing calculator before you commit.

Habits that experienced teams follow, and traps that beginners often fall into.

Seeing how organizations actually use these services makes the choices easier to remember.

VPN Gateway sends encrypted traffic over the public internet, so it is quick and affordable to set up but its speed varies. ExpressRoute uses a private connection built with a provider that does not cross the public internet, so it is steadier and faster but costs more and takes longer to arrange.

Not by default. It is private, which is not the same as encrypted. If you need encryption, you can add application-level TLS, MACsec on ExpressRoute Direct, or an IPsec VPN over the circuit.

Yes. A common design uses ExpressRoute as the main path and a site-to-site VPN as a backup, with routing arranged so traffic prefers ExpressRoute and falls back to the VPN if needed.

For a site-to-site VPN you need a compatible VPN device or firewall that supports IPsec. For point-to-site you only need client software on each user’s computer.

Azure looks for a subnet with exactly this name to place the gateway machines. Using any other name will not work. It should also be big enough for the gateway and future features.

A VPN gateway can often be built and connected within a day, although creating the gateway itself takes a while. ExpressRoute depends on a provider building a physical connection, which can take weeks.

Yes. One circuit can link to several VNets, within the limits of its SKU. Premium circuits allow more connected VNets and reach across geopolitical regions.

For most cases, VNet peering is simpler, faster and cheaper because traffic stays on Microsoft’s backbone. A VNet-to-VNet VPN is useful when you specifically want an IPsec-encrypted tunnel between the networks.

Connecting your own network to Azure is the foundation of any hybrid cloud, and Azure gives you two strong tools for it. VPN Gateway builds encrypted IPsec tunnels over the public internet and supports whole sites, single users and other virtual networks. ExpressRoute provides a private line through a connectivity provider, with steadier speed, lower delay and a choice of peering types, but it is more costly and takes longer to arrange. You have learned about gateways, subnets, SKUs, routing and BGP, circuits and peering, encryption choices, resilience designs, hub-and-spoke layouts, monitoring and cost.

The best designs start from your real needs: how much data moves, how steady the speed must be, how critical the system is, and how much time and money you have. Many organizations begin with a VPN, grow into ExpressRoute, and keep the VPN as a backup. Whatever you choose, plan address ranges first, build in redundancy, protect the connection, and test your failover.