Migrate ExpressRoute

Brad Benz 25

We have an existing ExpressRoute connection that is in production. Unfortunately, the subnet in which it resides was built incorrectly as a /28. We'd like to deploy some additional connectivity options with an IPSec VPN gateway, and due to the subnet not being a /27 or shorter prefix, we're hitting a roadblock.

What would be the best, least-intrusive way to go about rectifying this situation? I understand we'd likely have to delete the existing ExpressRoute Gateway and the associated subnet and recreate both objects with an appropriate prefix size.

Am I on the right track here? Any caveats I should be aware of?

GitaraniSharma-MSFT 49,171 Reputation points Microsoft Employee

2023-10-26T08:45:19.6733333+00:00
Hello @Brad Benz ,

As mentioned in the below document,

https://video2.skills-academy.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal#to-configure-coexisting-connections-for-an-already-existing-vnet

If you have a virtual network that has only one virtual network gateway, for example, a Site-to-Site VPN gateway and you want to add another gateway of a different type, for example, ExpressRoute gateway, check the gateway subnet size. If the gateway subnet is /27 or larger, you can skip the following steps and follow the steps in the previous section to add either a Site-to-Site VPN gateway or an ExpressRoute gateway. If the gateway subnet is /28 or /29, you have to first delete the virtual network gateway and increase the gateway subnet size. The steps in this section show you how to do that.

Delete the existing ExpressRoute or Site-to-site VPN gateway.

Delete and recreate the GatewaySubnet to have prefix of /27 or shorter.

Configure a VNet with a Site-to-Site connection and then Configure the ExpressRoute gateway.

Once the ExpressRoute gateway is deployed, you can link the virtual network to the ExpressRoute circuit.

Some limitations to keep in mind:

https://video2.skills-academy.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal#limits-and-limitations

Also, as @msrini-MSFT mentioned below, if you delete and recreate your gateway, you will have downtime for your cross-premises connections. So, if you have a hub and spoke architecture, you can create another hub (or make an existing Vnet as your new hub) where you can freshly deploy the S2S VPN and ExR gateways and just switch the existing ExR connection to the new hub Vnet and then delete your old ExR gateway. This would have lesser down time.

Kindly let us know if helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
GitaraniSharma-MSFT 49,171 Reputation points Microsoft Employee

2023-10-27T12:34:01.2+00:00

@Brad Benz , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.
Brad Benz 25 Reputation points

2023-10-27T13:33:01.88+00:00

Thank you for the feedback; this is exactly what I was looking for.

Accepted answer

msrini-MSFT 9,266 Reputation points Microsoft Employee

2023-10-26T04:07:21.8066667+00:00

Hi, You should plan for a maintenance windows and delete the connection and gateway and gateway subnet and then recreate the gateway subnet with greater IP range and then deploy the gateway and connection. If you had hub and spoke archetecture, you can create another hub and just switch the connection which would have lesser down time.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Share via

Migrate ExpressRoute

0 additional answers