Organisations running production workloads in Azure need reliable, secure connectivity between their on-premises environment and Azure VNets. Two options exist: Azure VPN Gateway (IPSec over the public internet) and Azure ExpressRoute (private, dedicated circuit via a connectivity provider). The choice has significant implications for latency, bandwidth, availability SLA, and cost.
Azure VPN Gateway
VPN Gateway establishes an IPSec/IKEv2 tunnel over the public internet. Traffic is encrypted end-to-end but traverses shared internet infrastructure, making latency variable and bandwidth limited by the tunnel's throughput capacity.
VPN Gateway SKUs (relevant ones for production):
- VpnGw2 — up to 1 Gbps aggregate, 30 S2S tunnels, 99.9% SLA. ~$270/month.
- VpnGw3 — up to 1.25 Gbps, 30 tunnels. ~$500/month.
- VpnGw2AZ — zone-redundant deployment, 99.99% SLA. ~$380/month.
The zone-redundant SKUs (VpnGwXAZ) are strongly recommended for production — the non-AZ SKUs are single-instance and the 99.9% SLA translates to ~8.7 hours potential downtime per year.
Azure ExpressRoute
ExpressRoute uses a dedicated private circuit provisioned through a connectivity provider (Tata Communications, Bharti Airtel, Reliance Jio, Sify in India; AT&T, Equinix, Megaport globally). Traffic never traverses the public internet. Azure connects directly to the provider's MPLS backbone at one of its peering locations (Mumbai, Chennai, Delhi, Pune for India).
Circuit speeds: 50 Mbps to 10 Gbps. Pricing is a combination of the Azure circuit fee (SKU-based) and the provider's port and service fee.
ExpressRoute types:
- Provider model — connectivity provider provisions the last-mile from your on-prem to their peering location. Suitable for most enterprise deployments.
- Direct — you connect directly to Microsoft's peering router at an ExpressRoute location with your own equipment. 10 Gbps or 100 Gbps ports. Enterprise-grade networking expertise required.
Key Technical Differences
| Factor | VPN Gateway | ExpressRoute |
|---|---|---|
| Path | Public internet (encrypted) | Private MPLS / provider backbone |
| Max bandwidth | 10 Gbps (active-active) | 10 Gbps (100 Gbps with Direct) |
| Latency | Variable (30–100ms typical for India–Azure) | Consistent, predictable (provider-SLA backed) |
| SLA (zone-redundant) | 99.99% | 99.95% (standard circuit); 99.99% with dual circuits |
| BGP | Static or BGP routing | BGP mandatory |
| Encryption | IPSec (always) | Not encrypted by default; MACsec optional at Direct ports |
| Setup time | Minutes (self-service) | Weeks to months (provider provisioning) |
ExpressRoute Redundancy: The Critical Design Requirement
Microsoft requires two physical connections to every ExpressRoute circuit for resiliency — a primary and a secondary from the provider. These must enter your premises via diverse physical paths (different conduits, different entry points). If both connections share a common cable path, a single dig event can take down both. This is where many ExpressRoute deployments fail in practice.
For zone-redundant 99.99% availability, the recommended architecture is two ExpressRoute circuits from two different providers, each connecting to zone-redundant ExpressRoute Gateways in Azure. This architecture eliminates both provider and Azure-side single points of failure.
BGP Configuration for ExpressRoute
ExpressRoute uses BGP for route exchange. Key considerations:
- You receive Azure public IP prefixes via Microsoft Peering and private VNet prefixes via Private Peering
- Advertise only the specific on-prem prefixes you need Azure to route back to — do not advertise a default route unless you intend to send all Azure outbound internet traffic back through your on-prem firewall
- Use BGP communities to distinguish routes received from primary vs secondary circuit for traffic engineering
- BFD (Bidirectional Forwarding Detection) is supported on ExpressRoute and reduces failover detection time from the BGP hold timer (~90 seconds) to under 1 second
The Cost Reality
A 200 Mbps ExpressRoute circuit with a mid-tier provider in India costs approximately ₹80,000–₹1,50,000/month (circuit + port fee + Azure gateway). For that price, you get consistent latency, private transit, and a provider-backed SLA. A VPN Gateway (VpnGw2AZ) costs ~₹32,000/month but adds internet latency and variability that's unacceptable for latency-sensitive workloads.
The tipping point: if you need consistent sub-20ms latency to Azure, are moving more than 500 Mbps regularly, or have compliance requirements that prohibit data on public internet paths, ExpressRoute is justified. For most SMB workloads — M365 sync, backup, occasional cloud resource management — VPN Gateway is the right answer.
"ExpressRoute is not just a faster VPN. It changes the fundamental character of the connection — from best-effort internet transit to an SLA-backed private circuit."
Sripadatech designs and provisions both VPN and ExpressRoute connectivity. Contact us to discuss your connectivity requirements.