Azure VPN Gateway vs. ExpressRoute - Quick comparison

Table Of Contents

• Introduction
• VPN Gateway
  • Connectivity designs
• ExpressRoute Gateway
  • Benefits of using Azure ExpressRoute
  • Connectivity models
• Key differences table between P2S, S2S and ExpressRoute

Introduction

Let's start by clearing the confusion around the terms Virtual Network Gateway, VPN Gateway, and ExpressRoute Gateway.  

• Virtual Network Gateway represents the category of gateways that reside inside a virtual network and are used to connect virtual networks or on-premises networks to virtual networks. 

• VPN Gateway is a specific type of Virtual Network Gateway. It is used to send encrypted traffic across the public Internet. Site-to-Site, Point-to-Site, and VNet-to-VNet connections all use a VPN gateway.

• ExpressRoute Gateway is also a specific type of Virtual Network Gateway. It sends network traffic on a dedicated private connection when configuring Azure ExpressRoute.

When you create a Virtual Network Gateway, you need to specify several settings. One required setting -GatewayTypespecifies whether the gateway is used for ExpressRoute or VPN traffic.  Each virtual network can have only one Virtual Network Gateway of each type. For example, you can have only one Virtual Network Gateway that uses -GatewayType VPN, and one that uses -GatewayType ExpressRoute.

VPN Gateway

A virtual network gateway is composed of two or more Azure-managed VMs automatically configured and deployed to a specific subnet you create called the GatewaySubnet. When you create a VPN gateway, gateway VMs are deployed to the gateway subnet and configured with your specified settings. This process can take 45 minutes or more to complete, depending on your selected gateway SKU.

Connectivity designs

You can create multiple connection configurations using VPN Gateway, so you must determine which configuration best fits your needs. Point-to-Site (P2S), Site-to-Site (S2S), and VNet-to-VNet (V2V) connections all have different instructions and configuration requirements. See all details about the VPN Gateway designs here.

Point-to-Site (P2S)

Site-to-Site (S2S)

VNet-to-VNet (V2V)

ExpressRoute Gateway

Azure ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection with the help of a connectivity provider. With ExpressRoute, you can establish connections to Microsoft cloud services, such as Microsoft Azure and Microsoft 365.

You must first create a virtual network gateway to connect your Azure virtual network and your on-premises network using ExpressRoute. A virtual network gateway serves two purposes: exchanging IP routes between the networks and routing traffic.

Benefits of using Azure ExpressRoute

• Layer 3 connectivity between your on-premises network and the Microsoft Cloud through a connectivity provider. Connectivity can be from an any-to-any (IPVPN) network, a point-to-point Ethernet connection, or through a virtual cross-connection via an Ethernet exchange.
• Connectivity to Microsoft cloud services across all regions in the geopolitical region.
• Global connectivity to Microsoft services across all regions with the ExpressRoute premium add-on.
• Dynamic routing between your network and Microsoft via BGP.
• Built-in redundancy in every peering location for higher reliability.
• Connection uptime SLA.
• QoS support for Skype for Business.

Connectivity models

Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a colocation facility. ExpressRoute connections don't go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds, consistent latencies, and higher security than typical connections over the Internet. For information on how to connect your network to Microsoft using ExpressRoute, see ExpressRoute connectivity models.

Key differences

The following table shows the main differences between Point-to-Site, Site-to-Site, and ExpressRoute at the time of this writing.