A few months ago, we changed our public documentation to
organize the Azure networking services and features
into four pillars.
I'm here to talk to you about the hybrid connectivity
pillar, which is also reflected in the Azure portal.
When I say hybrid connectivity, I mean getting
from the physical world, on-prem or from a device like
a cell phone or a laptop, into resources in Azure.
First, let's look at the Azure VPN service.
VPN gateway is a collection of objects in Azure working
together to enable an IPsec or TLS tunnel to Azure
across the Internet.
This is done in one of two ways, with site-to-site
tunnels starting at your on-premise location with
a physical device like a router or firewall, or a
point-to-site connection from your mobile device
like a cell phone, tablet, laptop, or other supported
Internet connected devices.
For both point-to-site and site-to-site, you start
with a VPN gateway connected to your Azure VNet.
With point-to-site, a client application or client config,
is installed on the device and is connected securely
to the VPN gateway.
For a site-to-site connection, a local network gateway object
is created that represents the IP address of the on-prem
device and then a connection object is created to join
the local network gateway to the VPN gateway.
This establishes the secure tunnel through the Internet.
Next, we look at the ExpressRoute service.
Like VPN, ExpressRoute is about getting connectivity
from your premise to Microsoft, but in
ExpressRoute's case, doing this by not
using the internet.
Most customers work with a service provider like
AT &T or any of our over 200 ExpressRoute partners
to provide a private, non-internet path to
Microsoft's network.
Once connected with an ExpressRoute circuit, you
can go to Microsoft public and Azure public services
like SQL Server, Azure Storage, Dynamics, or
in some cases, M365.
This is done using public IP addresses over Microsoft
Peering, the orange lines in this diagram.
In this scenario, you would also use a route filter
feature to reduce the BGP overhead to only receive
the specific address ranges for the regions
or services you need.
However, most commonly used is private peering.
This is the blue box in the lower right-hand
corner of the diagram.
Using an ExpressRoute gateway on the VNet and a connection
object between the circuit and the gateway allows you
to extend your corporate on-premise private network
into Azure and access your Azure resources directly
on this private data path.
Again, not using the Internet.
ExpressRoute enables you to connect multiple ExpressRoute
gateways in the same or different regions back
to the same circuit.
For our largest premium ExpressRoute circuit,
that could be up to 100 ExpressRoute gateways in any
region in the world back to the same ExpressRoute circuit.
There's also an ExpressRoute direct port option, which
would replace the partner edge in the diagram.
This allows you to connect your edge router directly to
the Microsoft routers in a facility for direct connection
to the Microsoft network.
Also, for monitoring, we offer the ExpressRoute
Traffic Collector.
This feature can provide detailed flow data on your
circuits to be able to identify things like top
talkers or other traffic-based metrics and queries.
The final service I'll cover in the hybrid
connectivity pillar is our virtual WAN service.
As the diagram shows, Virtual WAN, also called vWAN, brings
together all of the features of ExpressRoute and VPN,
and then extends them for any-to-any connectivity
into and across Azure.
If you're familiar with a hub-and-spoke architecture,
a Virtual WAN implements this in a concise, single-object
structure to implement the hub-and-spoke scaffolding
much faster than you could build yourself.
If you use a vWAN-aware SDN hardware device on
your premise, you get large-scale VPN automation.
Just log into your on-prem device with your Azure
credentials, and it can auto-configure the device and
establish the IPsec connection back to your vWAN hub.
This is great if you have many branch offices
or retail outlets that need VPN connections to
your Azure workloads.
vWAN also integrates with Azure Firewall, but not just
Azure's firewall, but also to other popular firewalls
from the marketplace to turn your regular vWAN hub into
what we call a secure hub.
This allows you to use the firewall of your choice and
your unique security policies to make your WAN secure.
vWAN introduces many other routing features like route
maps, routing intent, and others to manage the flows
across the virtual WAN.
All of this together allows you to enable, secure, and
control your network traffic, making the Microsoft backbone
and Azure your corporate WAN.
Hopefully this provides some insight into the
three main services in our hybrid connectivity pillar,
Azure VPN, ExpressRoute, and Virtual WAN.