Express Route Standard SKU utilization question

@Suwarna S Kale , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.

Hello, Gitarani

Thank you for providing the info. However, few more questions about how we achieve both networking models (VWAN and Hub/spoke) under the same Azure Tenant and have decentralized/segregated environments for two different projects:

• How exactly do ExpressRoute different subscriptions on Azure and on-premise DC locations, Is it connecting directly from the provider's site to Azure subscriptions with two separate connections and another connection to our organization's data center? OR is it ExpressRoute provider --> on-premise DC --> to two Azure subscriptions?
• Can both subscriptions still access all on-premise DC resources with different connections?
• As both subscriptions would share the ExpressRoute bandwidth, in the future when we are required to increase the limit, is there any downtime that needs to be considered while increasing the bandwidth limit?
• Is the above strategy of using both VWAN and hub-spoke model under the same Azure Tenant recommended by Microsoft?

Hello @Suwarna S Kale ,

Please find answers to your questions below:

How exactly do ExpressRoute different subscriptions on Azure and on-premise DC locations, Is it connecting directly from the provider's site to Azure subscriptions with two separate connections and another connection to our organization's data center? OR is it ExpressRoute provider --> on-premise DC --> to two Azure subscriptions?

I'm not sure I completely understand this question, but I assume you are asking about the traffic flow.

Since the ExpressRoute circuit with a Vnet connection (existing hub and spoke setup) is connected to your on-premises and another Vnet (new virtual WAN setup) is connected to this circuit, the traffic flow is as below:

For traffic from on-premises to Vnet1 (subscription1) or Vnet2 (subscription2):

On-premises --> MSEE devices at the ExR peering location --> ExpressRoute gateway of the Vnet you are trying to reach and finally the resource such as VM within that Vnet.

For traffic from Vnet1 (subscription1) or Vnet2 (subscription2) to on-premises:

Azure Vnet (Vnet1 or Vnet2) --> Respective ExR gateway --> ExR circuit (MSEE devices) --> On-premises.

On-premises DC to ExpressRoute circuit is a single connection.

ExpressRoute circuit to the 2 subscriptions are 2 different connections as thye circuit is connected to 2 ExR gateways in the 2 subscriptions. From the circuit, the traffic is forwarded to the ExR gateway of the desired Vnet.

So,

Your Hub Spoke Model Hub VNET will use ExR GW of Subscription1 to connect to ExR Circuit of Subscription1

Your vWAN vHub will use its ExR GW of Subscription2 to connect to ExR Crkt of Subscription1

Can both subscriptions still access all on-premises DC resources with different connections?

Yes, both subscriptions can access all on-premises DC resources.

As both subscriptions would share the ExpressRoute bandwidth, in the future when we are required to increase the limit, is there any downtime that needs to be considered while increasing the bandwidth limit?

You can attempt to increase the bandwidth of your ExpressRoute circuit in the Azure portal, or by using PowerShell with no downtime. If there's capacity available on the physical port on which your circuit was created, your change will succeed and if there isn't enough capacity left on the current port, the change will fail.

• Downgrading the bandwidth of a circuit is not supported.
• To determine if there is available capacity for a bandwidth upgrade, submit a support request.

Refer: https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-faqs#can-the-bandwidth-of-an-expressroute-circuit-be-changed

https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-howto-circuit-portal-resource-manager#modify

Is the above strategy of using both VWAN and hub-spoke model under the same Azure Tenant recommended by Microsoft?

It is generally recommended to use Multiple ExpressRoute circuits to add resiliency for the peering location.

Using ExpressRoute circuits from a single peering location creates a single point of failure and makes your organization susceptible to peering location outages. It is recommended to use dual ExpressRoute circuits from different peering locations when you're connecting an on-premises location to virtual networks in Azure. This setup will ensure redundant paths to Azure by removing single points of failure between on-premises and Azure.

Refer: https://video2.skills-academy.com/en-us/azure/well-architected/services/networking/azure-expressroute

https://video2.skills-academy.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/connectivity-to-azure

https://video2.skills-academy.com/en-us/azure/architecture/reference-architectures/hybrid-networking/expressroute

https://video2.skills-academy.com/en-us/azure/expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering

https://video2.skills-academy.com/en-us/azure/virtual-wan/virtual-wan-faq#when-theres-an-expressroute-circuit-connected-as-a-bow-tie-to-a-virtual-wan-hub-and-a-non-virtual-wan-vnet-what-is-the-path-for-the-non-virtual-wan-vnet-to-reach-the-virtual-wan-hub

But there is no one-size fits all setup for all customers. The setup and architecture differ from customer to customer depending upon their requirement.

If you are fine with a single connection point between on-premises and Azure, then you can go with the above architecture.

As shown in the step 5 of the below doc:

https://video2.skills-academy.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology#step-5-transition-connectivity-to-virtual-wan-hub

But the recommended architecture is to have a full Virtual WAN setup with hub-to-hub connectivity and 2 ExpressRoute circuits as shown in the End-state architecture section of the below doc:

https://video2.skills-academy.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology#end-state-architecture-and-traffic-paths

Regards,

Gita

@Suwarna S Kale ,

Could you please provide an update on this post?

Kindly let us know if the above helps or you need further assistance on this issue.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

@Suwarna S Kale , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.