In normal Expressroute circuit, network/data traffic between Microsoft Edge Router and Azure Virtual Network/Virtual Machine is encrypted or not? If not, how we can encrypt it without using IPsec.

Vivek Pathak 0 Reputation points
2023-09-25T09:35:16.15+00:00

In normal Expressroute circuit, network/data traffic between Microsoft Edge Router and Azure Virtual Network/Virtual Machine is encrypted or not? If not, how we can encrypt it without using IPsec. We are looking to encrypt the traffic between Microsoft Edge Router and Virtual Networks/Virtual Machines inside Azure boundary without using IPSec. Kindly help.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,480 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,267 questions
Azure ExpressRoute
Azure ExpressRoute
An Azure service that provides private connections between Azure datacenters and infrastructure, either on premises or in a colocation environment.
342 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee
    2023-09-25T11:16:21.19+00:00

    Hello @Vivek Pathak ,

    I understand that you would like to know if traffic between Microsoft Edge Router and Azure is encrypted in a normal Expressroute circuit or not. If not, then how to encrypt it without using IPSec.

    By default, traffic over an ExpressRoute connection is not encrypted.

    ExpressRoute supports a couple of encryption technologies to ensure confidentiality and integrity of the data traversing between your network and Microsoft's network.

    1. IPSec VPN over Private peering --> which you don't want to do.

    https://video2.skills-academy.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering?toc=%2Fazure%2Fexpressroute%2Ftoc.json

    1. MACsec for ExpressRoute Direct ports:

    https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-howto-macsec

    Refer: https://video2.skills-academy.com/en-us/azure/expressroute/expressroute-about-encryption

    MACsec with ExpressRoute Direct provides point-to-point encryption between your device and Microsoft device. So, in this case all traffic such as BGP control traffic, Private peering traffic, MS peering traffic - which includes PaaS service traffic as well, gets encrypted using MACsec keys.

    MACsec encrypts all traffic on a physical link with a key owned by one entity (for example, customer). Therefore, it's available on ExpressRoute Direct only.

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments