Azure ExpressRoute design
Upendra Kumar
Cloud Solutions Architect | Azure Technical Architect| Microsoft Certified Trainer
ExpressRoute enables us to connect on Premises to Azure services seamlessly. lets review some design decisions you will make before deploying an ExpressRoute circuit.
Workflow
The architecture consists of the following components.
Components
Recommendations
The following recommendations apply for most scenarios. Follow these recommendations unless you have a specific requirement that overrides them.
Connectivity providers
Select a suitable ExpressRoute connectivity provider for your location.
ExpressRoute connectivity providers connect your datacenter to Microsoft in the following ways:
ExpressRoute circuit
Ensure that your organization has met the?ExpressRoute prerequisite requirements?for connecting to Azure.
If you haven't already done so, add a subnet named?GatewaySubnet?to your Azure VNet and create an ExpressRoute virtual network gateway using the Azure VPN gateway service. For more information about this process, see?ExpressRoute workflows for circuit provisioning and circuit states.
Considerations
These considerations implement the pillars of the Azure Well-Architected Framework, which is a set of guiding tenets that can be used to improve the quality of a workload. For more information, see?Microsoft Azure Well-Architected Framework.
Scalability
ExpressRoute circuits provide a high bandwidth path between networks. Generally, the higher the bandwidth the greater the cost.
ExpressRoute offers two?pricing plans?to customers, a metered plan and an unlimited data plan. Charges vary according to circuit bandwidth. Available bandwidth will likely vary from provider to provider. Use the?Get-AzExpressRouteServiceProvider?cmdlet to see the providers available in your region and the bandwidths that they offer.
A single ExpressRoute circuit can support a certain number of peerings and VNet links. See?ExpressRoute limits?for more information.
For an extra charge, the ExpressRoute Premium add-on provides some additional capability:
See?ExpressRoute pricing?for details.
ExpressRoute circuits are designed to allow temporary network bursts up to two times the bandwidth limit that you procured for no additional cost. This is achieved by using redundant links. However, not all connectivity providers support this feature. Verify that your connectivity provider enables this feature before depending on it.
Availability
ExpressRoute does not support router redundancy protocols such as hot standby routing protocol (HSRP) and virtual router redundancy protocol (VRRP) to implement high availability. Instead, it uses a redundant pair of BGP sessions per peering. To facilitate highly-available connections to your network, Azure provisions you with two redundant ports on two routers (part of the Microsoft edge) in an active-active configuration.
By default, BGP sessions use an idle timeout value of 60 seconds. If a session times out three times (180 seconds total), the router is marked as unavailable, and all traffic is redirected to the remaining router. This 180-second timeout might be too long for critical applications. If so, you can change your BGP time-out settings on the on-premises router to a smaller value. ExpressRoute also supports?Bidirectional Forwarding Detection (BFD)?over private peering. By enabling BFD over ExpressRoute, you can expedite link failure detection between Microsoft Enterprise edge (MSEE) devices and the routers on which you terminate the ExpressRoute circuit (PE). You can terminate ExpressRoute over Customer Edge routing devices or Partner Edge routing devices (if you went with managed Layer 3 connection service).
You can configure high availability for your Azure connection in different ways, depending on the type of provider you use, and the number of ExpressRoute circuits and virtual network gateway connections you're willing to configure. The following summarizes your availability options:
领英推荐
Security
Security provides assurances against deliberate attacks and the abuse of your valuable data and systems. For more information, see?Overview of the security pillar.
You can configure security options for your Azure connection in different ways, depending on your security concerns and compliance needs.
ExpressRoute operates in layer 3. Threats in the application layer can be prevented by using a network security appliance that restricts traffic to legitimate resources.
To maximize security, add network security appliances between the on-premises network and the provider edge routers. This will help to restrict the inflow of unauthorized traffic from the VNet:
For auditing or compliance purposes, it may be necessary to prohibit direct access from components running in the VNet to the Internet and implement forced tunneling. In this situation, Internet traffic should be redirected back through a proxy running on-premises where it can be audited. The proxy can be configured to block unauthorized traffic flowing out, and filter potentially malicious inbound traffic.
To maximize security, do not enable a public IP address for your VMs, and use NSGs to ensure that these VMs aren't publicly accessible. VMs should only be available using the internal IP address. These addresses can be made accessible through the ExpressRoute network, enabling on-premises DevOps staff to perform configuration or maintenance.
If you must expose management endpoints for VMs to an external network, use NSGs or access control lists to restrict the visibility of these ports to an allowlist of IP addresses or networks.
Microsoft Side:
Customer Side focus :
Sharing the same ExpressRoute circuit
“can I share the same ExpressRoute circuit across multiple subscriptions and multiple subscriptions across tenants?” The short answer is?Yes.
It’s all to do with the Azure entities in the Azure portal – the?ExpressRoute Circuit, the?Connection?and the?Virtual Network Gateway. In fact, it’s the?Connection?entity that glues the?ExpressRoute Circuit?and the?Virtual Network Gateway?together. The glue, requires a?Circuit?authorisation key in order for other?Connections?to utilise it.
Below is what it looks like:
Reference:
https://learn.microsoft.com/en-us/azure/expressroute/
Assistant Vice President - Strategy and Architecture @ Deutsche Bank | Cloud Infrastructure Architect
2 年Nice article Upendra ....!!!!