search

LucianFrango / Lucian.Franghiu.com

https://lucian.blog
0 stars 0 forks source link

Encrypting ExpressRoute for improved security | Lucian Franghiu's blog #7

Open utterances-bot opened 3 years ago

utterances-bot commented 3 years ago

Encrypting ExpressRoute for improved security | Lucian Franghiu's blog

An overview (with diagrams) of the currently available ExpressRoute encryption options, with a brief touch on encapsulation.

https://lucian.franghiu.com/encrypting-expressroute-for-improved-security/

LucianFrango commented 3 years ago

A follow up blog on this is coming, when I get some downtime to finalize it. Theres a key point to mention around doing a VPN over ER that may impact a design decision on using this pattern.

LucianFrango commented 2 years ago

Good news regarding this pattern - while there are two gateways configured here, an ExpressRoute Gateway and a VPN Gateway, there is no double 'bandwidth' charge, as outlined here: https://github.com/MicrosoftDocs/azure-docs/pull/75142#issuecomment-1005974701

My understanding is that since the traffic leaves the VNet via the VPN Gateway and does not traverse any public internet, traffic just routes via the ExpressRoute gateway and out to on-premises. Therefore traffic just leaves the VNet once via the ExpressRoute gateway so there is no double egress bandwidth charge.

mattfeltonma commented 2 years ago

This is a wonderful write up Lucian. I love you how you summarize the benefits and considerations at the end.

Great job!

dacarubio commented 1 year ago

Thanks for this Lucian. Very informative! Just wanted to confirm two things here:

  1. Can we establish a two VPN overlay connection for both private and microsoft peering at the same time (co-existing)?
  2. Regarding egress charges mentioned above, is this only applicable for Private Peering (which traverses via Expressroute Gateways) and not on Microsoft peering (considering that this is will leverage public IP termination but will still traverse via Expressroute circuit and not Public Internet.

Cheers!

dacarubio commented 1 year ago

Looks like I've already found the answers as per links below:

https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering?toc=%2Fazure%2Fexpressroute%2Ftoc.json

https://learn.microsoft.com/en-us/azure/expressroute/site-to-site-vpn-over-microsoft-peering

All good for me Lucian thanks again! :)