Closing this Azure series with the cable that ties the hybrid estate together. VPN over the internet is fine for branch offices and DR paths; when the requirement is predictable latency, real bandwidth, and traffic that never touches the public internet, the answer is ExpressRoute: a private circuit between your edge and Microsoft’s, delivered through a connectivity provider or directly at a peering location.

Circuits, Peerings, and What Connects Where

A circuit has a bandwidth, an SKU, and up to two peerings. Private peering extends your network to your VNets, the one everybody means. Microsoft peering carries traffic to public Microsoft endpoints, Microsoft 365 and Azure PaaS public IPs, over the circuit instead of the internet, useful for strict egress regimes but demanding careful route filtering so you do not accidentally pull all Microsoft prefixes into your WAN. SKU choice is about route scope: Local reaches only the Azure region tied to the peering location at no egress charge, Standard reaches the geopolitical region, Premium extends globally and raises route limits. Start Standard unless you have a concrete global or scale reason.

resource "azurerm_express_route_circuit" "this" {
  name                  = "erc-dc1-weu"
  resource_group_name   = azurerm_resource_group.hub.name
  location              = "westeurope"
  service_provider_name = "Equinix"
  peering_location      = "Amsterdam"
  bandwidth_in_mbps     = 1000

  sku {
    tier   = "Standard"
    family = "MeteredData"
  }
}

resource "azurerm_express_route_circuit_peering" "private" {
  peering_type                  = "AzurePrivatePeering"
  express_route_circuit_name    = azurerm_express_route_circuit.this.name
  resource_group_name           = azurerm_resource_group.hub.name
  peer_asn                      = 65010
  primary_peer_address_prefix   = "172.16.255.0/30"
  secondary_peer_address_prefix = "172.16.255.4/30"
  vlan_id                       = 100
}

resource "azurerm_virtual_network_gateway_connection" "er" {
  name                       = "con-er-dc1"
  location                   = "westeurope"
  resource_group_name        = azurerm_resource_group.hub.name
  type                       = "ExpressRoute"
  virtual_network_gateway_id = azurerm_virtual_network_gateway.er.id
  express_route_circuit_id   = azurerm_express_route_circuit.this.id
  express_route_gateway_bypass = true
}

Designing for Failure, Because Circuits Fail

Every circuit is delivered as a redundant pair of BGP sessions, but that redundancy lives in one peering location, and peering locations have maintenance and incidents. The resilient design is two circuits in two peering locations, active active, with your edge routers preferring by BGP local preference and Azure returning traffic based on the routes you advertise. Add a VPN over internet as the third tier for true emergencies, sitting in the same hub with a higher route cost. Then, and this is the step most organizations skip, test the failover by draining a circuit during a maintenance window and watching the traffic move. Bidirectional Forwarding Detection should be enabled on both sides so failure detection happens in under a second instead of waiting out BGP hold timers.

Gateways, FastPath, and Route Hygiene

The ExpressRoute gateway SKU caps your throughput, so size it to the circuit (ErGw3AZ for serious bandwidth, always a zone redundant SKU), and enable FastPath, the gateway_bypass flag above, so data plane traffic skips the gateway hop entirely and the gateway handles only route exchange. In Virtual WAN designs from earlier in this series, the hub’s built in gateway replaces this and routing intent steers ExpressRoute traffic through the hub firewall for inspection.

Route hygiene closes it out: advertise summarized prefixes from on premises rather than hundreds of specifics, never advertise a default route toward Azure unless you truly intend to pull all Azure egress through your datacenter, and monitor advertised and learned route counts against gateway limits. ExpressRoute problems are almost never the circuit; they are almost always a route that someone advertised or filtered without telling the person now debugging it.

That wraps 28 days of Azure. The whole series builds one coherent platform: landing zone, network, identity, workloads, operations, and recovery. Thank you for reading along.

Cheers
Osama