You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/networking/connectivty-interoperability-control-plane.md
+26-50Lines changed: 26 additions & 50 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,99 +15,75 @@ This article describes the control plane analysis of the [test setup](./connecti
15
15
16
16
Control plane analysis essentially examines routes that are exchanged between networks within a topology. Control plane analysis can help you understand how different networks view the topology.
17
17
18
-
## Hub and spoke VNet perspective
18
+
## Hub and spoke virtual network perspective
19
19
20
-
The following figure illustrates the network from the perspective of a hub virtual network (VNet) and a spoke VNet (highlighted in blue). The figure also shows the autonomous system number (ASN) of different networks and routes that are exchanged between different networks:
20
+
The following figure illustrates the network from the perspective of a hub virtual network and a spoke virtual network (highlighted in blue). The figure also shows the autonomous system number (ASN) of different networks and routes that are exchanged between different networks:
21
21
22
-
:::image type="content" source="./media/folder/image.png" alt-text="Alt text here.":::
23
-
![1][1]
22
+
:::image type="content" source="./media/backend-interoperability/hubview.png" alt-text="Diagram of hub and spoke virtual network perspective of the topology.":::
24
23
25
-
The ASN of the VNet's Azure ExpressRoute gateway is different from the ASN of Microsoft Enterprise Edge Routers (MSEEs). An ExpressRoute gateway uses a private ASN (a value of **65515**) and MSEEs use public ASN (a value of **12076**) globally. When you configure ExpressRoute peering, because MSEE is the peer, you use **12076** as the peer ASN. On the Azure side, MSEE establishes eBGP peering with the ExpressRoute gateway. The dual eBGP peering that the MSEE establishes for each ExpressRoute peering is transparent at the control plane level. Therefore, when you view an ExpressRoute route table, you see the VNet's ExpressRoute gateway ASN for the VNet's prefixes.
24
+
The ASN of the virtual network's Azure ExpressRoute gateway is different from the ASN of Microsoft Enterprise edge routers (MSEEs). An ExpressRoute gateway uses a private ASN (a value of **65515**) and MSEEs use public ASN (a value of **12076**) globally. When you configure ExpressRoute peering, because MSEE is the peer, you use **12076** as the peer ASN. On the Azure side, MSEE establishes eBGP peering with the ExpressRoute gateway. The dual eBGP peering that the MSEE establishes for each ExpressRoute peering is transparent at the control plane level. Therefore, when you view an ExpressRoute route table, you see the virtual network's ExpressRoute gateway ASN for the VNet's prefixes.
26
25
27
26
The following figure shows a sample ExpressRoute route table:
28
27
29
-
:::image type="content" source="./media/folder/image.png" alt-text="Alt text here.":::
30
-
![5][5]
28
+
:::image type="content" source="./media/backend-interoperability/exr1-routetable.png" alt-text="Diagram of ExpressRoute 1 route table.":::
31
29
32
30
Within Azure, the ASN is significant only from a peering perspective. By default, the ASN of both the ExpressRoute gateway and the VPN gateway in Azure VPN Gateway is **65515**.
33
31
34
-
## On-premises Location 1 and the remote VNet perspective via ExpressRoute 1
32
+
## On-premises Location 1 and the remote virtual network perspective via ExpressRoute 1
35
33
36
-
Both on-premises Location 1 and the remote VNet are connected to the hub VNet via ExpressRoute 1. They share the same perspective of the topology, as shown in the following diagram:
34
+
Both on-premises Location 1 and the remote virtual network are connected to the hub virtual network via ExpressRoute 1. They share the same perspective of the topology, as shown in the following diagram:
37
35
38
-
:::image type="content" source="./media/folder/image.png" alt-text="Alt text here.":::
39
-
![2][2]
36
+
:::image type="content" source="./media/backend-interoperability/loc1exrview.png" alt-text="Diagram of location 1 and remote virtual network perspective of the topology via ExpressRoute 1.":::
40
37
41
-
## On-premises Location 1 and the branch VNet perspective via a site-to-site VPN
38
+
## On-premises Location 1 and the branch virtual network perspective via a site-to-site VPN
42
39
43
-
Both on-premises Location 1 and the branch VNet are connected to a hub VNet's VPN gateway via a site-to-site VPN connection. They share the same perspective of the topology, as shown in the following diagram:
40
+
Both on-premises Location 1 and the branch virtual network are connected to a hub virtual network's VPN gateway via a site-to-site VPN connection. They share the same perspective of the topology, as shown in the following diagram:
44
41
45
-
:::image type="content" source="./media/folder/image.png" alt-text="Alt text here.":::
46
-
![3][3]
42
+
:::image type="content" source="./media/backend-interoperability/loc1vpnview.png" alt-text="Diagram of location 1 and branch virtual network perspective of the topology via a site-to-site VPN.":::
47
43
48
44
## On-premises Location 2 perspective
49
45
50
-
On-premises Location 2 is connected to a hub VNet via private peering of ExpressRoute 2:
46
+
On-premises Location 2 is connected to a hub virtual network via private peering of ExpressRoute 2:
47
+
48
+
:::image type="content" source="./media/backend-interoperability/loc2view.png" alt-text="Diagram of location 2 perspective of the topology.":::
51
49
52
-
:::image type="content" source="./media/folder/image.png" alt-text="Alt text here.":::
53
-
![4][4]
54
50
55
51
## ExpressRoute and site-to-site VPN connectivity in tandem
56
52
57
53
### Site-to-site VPN over ExpressRoute
58
54
59
-
You can configure a site-to-site VPN by using ExpressRoute Microsoft peering to privately exchange data between your on-premises network and your Azure VNets. With this configuration, you can exchange data with confidentiality, authenticity, and integrity. The data exchange also is anti-replay. For more information about how to configure a site-to-site IPsec VPN in tunnel mode by using ExpressRoute Microsoft peering, see [Site-to-site VPN over ExpressRoute Microsoft peering][S2S-Over-ExR].
55
+
You can configure a site-to-site VPN by using ExpressRoute Microsoft peering to privately exchange data between your on-premises network and your Azure VNets. With this configuration, you can exchange data with confidentiality, authenticity, and integrity. The data exchange also is anti-replay. For more information about how to configure a site-to-site IPsec VPN in tunnel mode by using ExpressRoute Microsoft peering, see [Site-to-site VPN over ExpressRoute Microsoft peering](../expressroute/site-to-site-vpn-over-microsoft-peering.md).
60
56
61
57
The primary limitation of configuring a site-to-site VPN that uses Microsoft peering is throughput. Throughput over the IPsec tunnel is limited by the VPN gateway capacity. The VPN gateway throughput is lower than ExpressRoute throughput. In this scenario, using the IPsec tunnel for highly secure traffic and using private peering for all other traffic helps optimize the ExpressRoute bandwidth utilization.
62
58
63
59
### Site-to-site VPN as a secure failover path for ExpressRoute
64
60
65
61
ExpressRoute serves as a redundant circuit pair to ensure high availability. You can configure geo-redundant ExpressRoute connectivity in different Azure regions. Also, as demonstrated in our test setup, within an Azure region, you can use a site-to-site VPN to create a failover path for your ExpressRoute connectivity. When the same prefixes are advertised over both ExpressRoute and a site-to-site VPN, Azure prioritizes ExpressRoute. To avoid asymmetrical routing between ExpressRoute and the site-to-site VPN, on-premises network configuration should also reciprocate by using ExpressRoute connectivity before it uses site-to-site VPN connectivity.
66
62
67
-
For more information about how to configure coexisting connections for ExpressRoute and a site-to-site VPN, see [ExpressRoute and site-to-site coexistence][ExR-S2S-CoEx].
63
+
For more information about how to configure coexisting connections for ExpressRoute and a site-to-site VPN, see [ExpressRoute and site-to-site coexistence](../expressroute/expressroute-howto-coexist-resource-manager.md).
68
64
69
65
## Extend back-end connectivity to spoke VNets and branch locations
70
66
71
67
### Spoke VNet connectivity by using VNet peering
72
68
73
-
Hub and spoke VNet architecture is widely used. The hub is a VNet in Azure that acts as a central point of connectivity between your spoke VNets and to your on-premises network. The spokes are VNets that peer with the hub, and which you can use to isolate workloads. Traffic flows between the on-premises datacenter and the hub through an ExpressRoute or VPN connection. For more information about the architecture, see [Implement a hub-spoke network topology in Azure][Hub-n-Spoke].
69
+
Hub and spoke VNet architecture is widely used. The hub is a VNet in Azure that acts as a central point of connectivity between your spoke VNets and to your on-premises network. The spokes are VNets that peer with the hub, and which you can use to isolate workloads. Traffic flows between the on-premises datacenter and the hub through an ExpressRoute or VPN connection. For more information about the architecture, see [Implement a hub-spoke network topology in Azure](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke).
74
70
75
-
In VNet peering within a region, spoke VNets can use hub VNet gateways (both VPN and ExpressRoute gateways) to communicate with remote networks.
71
+
In virtual network peering within a region, spoke virtual networks can use hub virtual network gateways (both VPN and ExpressRoute gateways) to communicate with remote networks.
76
72
77
73
### Branch VNet connectivity by using site-to-site VPN
78
74
79
-
You might want branch VNets, which are in different regions, and on-premises networks to communicate with each other via a hub VNet. The native Azure solution for this configuration is site-to-site VPN connectivity by using a VPN. An alternative is to use a network virtual appliance (NVA) for routing in the hub.
75
+
You might want branch virtual networks, which are in different regions, and on-premises networks to communicate with each other via a hub VNet. The native Azure solution for this configuration is site-to-site VPN connectivity by using a VPN. An alternative is to use a network virtual appliance (NVA) for routing in the hub.
80
76
81
-
For more information, see [What is VPN Gateway?][VPN] and [Deploy a highly available NVA][Deploy-NVA].
77
+
For more information, see [What is VPN Gateway?](../vpn-gateway/vpn-gateway-about-vpngateways.md) and [Deploy a highly available NVA](/azure/architecture/reference-architectures/dmz/nva-ha).
82
78
83
79
## Next steps
84
80
85
-
Learn about [data plane analysis][Data-Analysis] of the test setup and Azure network monitoring feature views.
81
+
Learn about [data plane analysis](./connectivty-interoperability-data-plane.md) of the test setup and Azure network monitoring feature views.
82
+
83
+
See the [ExpressRoute FAQ](../expressroute/expressroute-faqs.md) to:
86
84
87
-
See the [ExpressRoute FAQ][ExR-FAQ] to:
88
85
- Learn how many ExpressRoute circuits you can connect to an ExpressRoute gateway.
86
+
89
87
- Learn how many ExpressRoute gateways you can connect to an ExpressRoute circuit.
90
-
- Learn about other scale limits of ExpressRoute.
91
-
92
-
93
-
<!--Image References-->
94
-
[1]: ./media/backend-interoperability/hubview.png"Hub and spoke VNet perspective of the topology"
95
-
[2]: ./media/backend-interoperability/loc1exrview.png"Location 1 and remote VNet perspective of the topology via ExpressRoute 1"
96
-
[3]: ./media/backend-interoperability/loc1vpnview.png"Location 1 and branch VNet perspective of the topology via a site-to-site VPN"
97
-
[4]: ./media/backend-interoperability/loc2view.png"Location 2 perspective of the topology"
0 commit comments