Creating MCR Connections to Azure using ExpressRoute

You can create a VXC from an MCR to Microsoft Azure ExpressRoute through the Portal. You can create the VXC to AWS from the MCR and establish either private or Microsoft peering.

To connect to ExpressRoute using MCR, you need an ExpressRoute service key obtained from the Azure Resource Manager (ARM) portal. Follow the steps in the Microsoft topic Tutorial: Create and modify an ExpressRoute circuit to get this key.

To create a VXC from an MCR to Azure

  1. In the Portal, go to the Services page and select the MCR you want to use.
  2. Add a VXC connection for the port.
    If this is the first connection for the Megaport, click the Microsoft Azure tile. The tile is a shortcut to the configuration page. Alternatively, click +Connection, click Cloud, and click Azure ExpressRoute.

    Add connection

  3. Add the ExpressRoute service key into the field in the right hand panel.
    The Portal verifies the key and then displays the available port locations based on the ExpressRoute region.

  4. Select the connection point for your first connection.
  5. Select one or both of the peering types: Private and Microsoft.

    Peering type

  6. Specify these connection details:

    • Name your connection – The name of your VXC to be shown in the Megaport Portal.

    • Invoice Reference – This is an optional field. It can be any text, such as a PO number or billing reference number.

    • Rate Limit – This is the speed of your connection in Mbps. The rate limit for the VXC will be capped at the maximum allowable based on the ExpressRoute service key.

    Connection details

  7. Continue with the default settings and click Next through the next screens to add the item to your cart, check out, and deploy.

The Megaport system takes about five minutes to deploy and configure the required peering types.

Inspecting the configuration

Once the VXC connection deploys successfully, it is attached to the MCR on the Megaport Portal dashboard:

VXC connection

Click the VXC title to display the details of this connection.

In the Configure A End tab of the VXC detail, the following information is populated:

VXC details

  • VLANs are set as 100 and 200 by default – 100 for Private peering and 200 for Microsoft.
  • Local ASN: 133937 – This is the default Megaport ASN.
  • Peer ASN: For Microsoft Azure via ExpressRoute, this will be 12076 for all peering types.
  • Local IP and Peer IP – Will reflect the APIPA range for BGP peering (auto-configured) on Private peering, Microsoft peering will display a Megaport assigned public IP range (within
  • BGP Auth – This value is blank by default and is not a mandatory field for ExpressRoute connections as they traverse a private (non Internet) path. However if you do wish to enter one here, you will need to update it manually on the ExpressRoute configuration page to match as for security reasons the values do not synchronize automatically.

Confirming ExpressRoute configuration details

The corresponding ExpressRoute details screen in the Azure portal shows that the Layer 2 connection is up (Provider Status = Provisioned) and Layer 3 for the Private (or Microsoft) peering is similarly configured:

ExpressRoute details

Click the Azure private peering type to display the Private peering configuration. Values for both primary and secondary subnets are provided, regardless of whether only one of these peering locations is established. If you add a second ExpressRoute VXC using this service key, it will inherit the same peering types and automatically configure for the next available IP address allocation within that peering type.

Creating and linking a Virtual Network Gateway

In addition to the ExpressRoute circuit, you need to create a Virtual Network Gateway (VNG) and associate it with both your VNets used for private peering, as well as linking the VNG to your ExpressRoute circuit to provide routing on the Azure side toward the MCR.


The creation of the VNG can take approximately 45 minutes, although this is a one time requirement.

For details, follow the steps in Configure a virtual network gateway for ExpressRoute using the Azure portal to create the VNG (note that Microsoft charges apply per the ExpressRoute Gateways section of the Azure VPN gateway pricing page.

After you create the VNG, you need to associate the ExpressRoute VNG to the ExpressRoute circuit by following Connect a virtual network to an ExpressRoute circuit using the portal guidance.


To confirm the BGP/Layer 3 has successfully come up, return to the Azure private peering blade by clicking the detail line and click Get ARP Records. This function takes about a minute to populate data, but for a successful connection you should see a display similar to the following image indicating MAC addresses resolved on both the On-Prem and Microsoft sides of the connection:

ARP records - primary

Switching to secondary, this currently only shows a value for the Microsoft side of the connection because the VXC to the secondary target has not been configured.

ARP records - secondary

To configure the secondary VXC, create another VXC from your MCR with the same ExpressRoute service key, however this time targeting the secondary router presentation.

Once Layer 3 BGP is active and confirmed, you can view the Route Table as seen by the Microsoft edge devices by clicking Get route table in the Private peering pane. It displays the next hop, weighting, and AS path for the network values. This can also be toggled to view the secondary path route table when both primary and secondary VXCs are active.

Route table - primary

Helpful References

Last update: