Microsoft Cloud: Azure ExpressRoute


Video 1 of 2: Misha Cetrone from Megaport explains how to connect to Azure using Microsoft's ExpressRoute product via Megaport's Portal


Microsoft’s Private Interconnect service is called ExpressRoute (ER).

When connecting to the Microsoft Cloud (Azure) via an ExpressRoute with Megaport, the VXC forms the Layer 2 component of the connection and Layer 3 BGP connectivity is established directly between the customer and Azure. Here are some key terms to understand:

    • VNET – Virtual Network
      A Microsoft term for a group of cloud resources within Azure. Each VNET basically represents a discrete network, in which you control the IP Address blocks, DNS settings, Security Policies, and route tables.


  • QinQ
    Refers to the ability to encapsulate multiple inner VLANs within one outer VLAN. Technically know as 802.1ad, it is also commonly referred to as “Double Tagged” VLANs. This technology is required for Express Route connectivity. See more info here.



  • Azure Private Peering
    Provides access to Private VNETs within Azure
  • Microsoft (Public) Peering
  • Provides access to Azure resources that live in a Public space and Dynamics CRM.
  • Provides access to Office 365 resources (including Skype for Business). NOTE: While fully supported and available through Megaport, this connectivity now requires manual approval from Microsoft before you can enable it. See more information here.


There are two elements involved with an ExpressRoute connection. The first is your chosen ER plan which can be found here and is billed directly from Microsoft. (Make sure to select the correct region and currency for accurate pricing).  The second is the VXC with Megaport to connect to your chosen ER location.

When provisioning an ER circuit it’s important to remember that you can connect multiple VNETs to a single ER Circuit (a minimum of 10, but more are possible depending on your ER plan). However, each ER subscription includes two Virtual Ports on the Microsoft Cloud side. Microsoft offers an SLA on its ER connectivity, but in order to comply with this you must ensure to deploy two ER VXCs for redundancy.

Megaport supports ExpressRoute access to for both peering interfaces, Azure Private and Microsoft (Public) Peering. Be aware that whilst Azure Private does not require approval and is available instantly, Microsoft (Public) Peering requires manual validation of public IP space by Microsoft, and certain public endpoints (such as Office 365) require a further validation process. Both of these peering interfaces are delivered via a single VXC using 802.1ad configuration. A typical ER deployment might look like this:


You will note that the VXC connecting to Microsoft contains two “Inner” VLANs. These are referred to as the C-Tagged VLANs and are configured in the Azure console. The “Outer” VLAN tag is called the S-Tag and is the VLAN Assigned to the VXC in the Megaport Portal.

To deploy an ExpressRoute connection you’ll first need to choose your ER plan and deploy this in the Azure Console. Once this is done you will be provided with a Service Key. Copy this Service Key and then log in to the Megaport Portal. Choose the Port you want to connect from and go to add a VXC. Select Connect to Cloud and choose Azure ExpressRoute. You will then be presented with the configuration screen for the ExpressRoute VXC:

Once you copy and paste the ER Service Key into the field in the right hand panel you will be presented the target port locations based on the region you chose to deploy your ER. (e.g. If your ER service is deployed in the Australia East region in Sydney you will only be able to select the Sydney ER targets).  Select your chosen connection point for your first connection. Should you wish to deploy a second connection (and this is recommended), you can simply create a second VXC, re-enter the same Service Key, and then select the other connection target.

You will also notice some helpful links on the configuration screen to various resources including the Azure Resource Manager (ARM) console, and some tutorial videos.

To finish the configuration simply fill in the left hand panel:

Name Your Connection – A free text field allowing you to assign an easily identifiable name for this connection.

Rate Limit – The speed in Mbps for this connection.

A-End VLAN – The VLAN for this connection that you will receive via the Megaport (For ExpressRoute this is the S-Tag). This must be a unique VLAN ID on this Port. You can also select the toggle to “untag” this VXC. This will remove the VLAN tagging for this connection but will also mean only one VXC can be deployed on this Port.

One important note about untagging for an ER Circuit. QinQ is a technology that not all organisations have used in the past As such, if you do not have equipment that can support this, you can remove this requirement by un-tagging the outer VLAN. This would remove the S-Tag and deliver the three inner C-tags natively as 802.1Q VLANs. This still means you can only deploy a single VXC on this Port, so it does not scale well and is typically a temporary measure. It can be a useful stopgap nonetheless.


Additional useful links:

Microsoft Cloud: Azure Region Pair via ExpressRoute – HA Design

QinQ Router config Samples

Express Route Overview

Azure Resource Manager Console

©2020 Megaport. Megaport, Virtual Cross Connect, VXC and MegaIX are registered trademarks of Megaport (Services) Pty Ltd ACN 607 432 646.

Log in with your credentials

Forgot your details?