> ## Documentation Index
> Fetch the complete documentation index at: https://docs.megaport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting to Microsoft Azure ExpressRoute

> This help topic describes how to create a connection between Megaport and Microsoft Azure ExpressRoute.

export const Anchor = ({name}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Anchor -';
  if (name === undefined || name === null || name === 'undefined') {
    console.error(`${errorPrefix} \`name\` must have a value — rendering an empty string instead`);
    return <></>;
  }
  const raw = typeof name === 'string' ? name : JSON.stringify(name);
  const id = raw.replace(/\s+/g, '-').replace(/[^A-Za-z0-9_-]/g, '').replace(/-+/g, '-').replace(/^-+|-+$/g, '');
  if (!id) {
    console.error(`${errorPrefix} \`name\` "${name}" sanitizes to an empty id — rendering an empty string instead`);
    return <></>;
  }
  return <a style={{
    scrollMarginTop: 'var(--scroll-mt)'
  }} id={id}></a>;
};

export const Gloss = ({term, anchor, langDir = 'en'}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Gloss -';
  if (typeof term !== 'string') {
    term = String(term);
  }
  if (typeof anchor !== 'string') {
    anchor = String(anchor);
  }
  if (!term || term === 'undefined') {
    console.error(`${errorPrefix} the \`term\` property is required — rendering an empty string instead`);
    return <></>;
  }
  if (!anchor || anchor === 'undefined') {
    console.error(`${errorPrefix} the \`anchor\` property is required — rendering an empty string instead`);
    return <></>;
  }
  const lang = langDir === 'en' ? '/' : '/' + langDir + '/';
  const glossaryPage = lang + 'glossary/#' + anchor;
  return <a href={glossaryPage}>{term}</a>;
};

export const Image = ({src, alt = '', caption, width, height, shadow}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Image -';
  if (typeof src !== 'string') {
    src = String(src);
  }
  if (!src || src === 'undefined') {
    console.error(`${errorPrefix} \`src\` is required — rendering an empty string instead`);
    return <></>;
  }
  const img = <img className={['mega-image-style', shadow ? 'shadow' : ''].join(' ')} src={src} alt={alt} width={width} height={height} style={{
    display: 'block'
  }} />;
  return caption ? <figure>
      {img}
      <figcaption style={{
    textAlign: 'center',
    width
  }}>{caption}</figcaption>
    </figure> : img;
};

export const Link = ({href, children}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Link -';
  if (typeof href !== 'string') {
    href = String(href);
  }
  if (!href || href === 'undefined') {
    console.error(`${errorPrefix} the \`href\` property is required — rendering an empty string instead`);
    return <></>;
  }
  if (href.includes('{') || href.toUpperCase().includes('%7B')) {
    console.error(`${errorPrefix} could not resolve a variable in href "${href}" — rendering an empty string instead`);
    return <></>;
  }
  const isExternal = (/^https?:\/\//).test(href);
  return <a href={href} className="link" target={isExternal ? '_blank' : undefined} rel={isExternal ? 'noreferrer' : undefined}>
      {children ?? href}
      {isExternal && <span className="sr-only"> (opens in a new tab)</span>}
    </a>;
};

Megaport makes it easy to provision fast, secure, and private connections between your data center and Microsoft Azure and provides dedicated access to Azure private and Microsoft public resources from hundreds of locations worldwide.

## Azure ExpressRoute connection overview

Megaport offers two types of connection to <Gloss term="ExpressRoute" anchor="micro-azure" />: you can order virtual cross-connections to the Microsoft Cloud through Megaport or you can connect directly to the Microsoft Cloud through point-to-point Ethernet links (ExpressRoute Direct).

This topic describes connecting to Azure through a VXC. For more information about a direct connection, see [Configuring a Microsoft Azure ExpressRoute Direct Connection](/cloud/megaport/microsoft/expressroute-direct).

When connecting to the Microsoft Cloud (Azure) through an ExpressRoute with Megaport, the VXC forms the Layer 2 component of the connection and Layer 3 BGP connectivity is established directly between the customer
and Azure.

There are two elements involved with an ExpressRoute connection. The first is your
[ExpressRoute plan](https://azure.microsoft.com/en-au/pricing/details/expressroute/)
and is billed directly from Microsoft. (Make sure to select the correct
region and currency for accurate pricing). The second is the VXC with
Megaport to connect to your ExpressRoute location.

To check the latency and price of connecting to a particular Azure Partner location, start the procedure to [add a connection to Microsoft Azure](#azure-vxc) but instead of providing a **Microsoft Azure Service Key**, click **View all Azure Partner locations**. You can proceed to the Connection Details page without a service key and review the pricing of the selected port. To place an order for a Microsoft Azure connection, you need to provide a service key.
　　　　<Image src="/images/snippets/cloud/connections/azure-new-conn-all-locations.png" alt="The new connection 'Select Port' page with the Microsoft Azure Provider selected. A list of ports are shown, with their location, zone, and expected latency" shadow={true} width={600} />

Each ExpressRoute subscription includes two Virtual Ports on the Microsoft Cloud side. Microsoft offers an SLA on its ExpressRoute connectivity, but to comply you must deploy ExpressRoute VXCs to each Microsoft virtual port for redundancy.

Megaport supports ExpressRoute access to both peering interfaces: Azure
Private and Microsoft (Public) peering. Azure Private does not require
approval and is available instantly, but Microsoft (Public) peering
requires manual validation of public IP space by Microsoft, and some
public endpoints (such as Office 365) require additional validation.
Both of these peering interfaces are delivered through a single VXC
using 802.1ad configuration. When provisioning an ExpressRoute circuit, you can connect multiple VNETs to a single circuit (up to 10 by default, but more are possible depending on your plan).

This image shows a typical ExpressRoute deployment.

<Image src="/images/cloud/megaport/microsoft/azure-connect-model.png" alt="ExpressRoute deployment" width={900} />

<Note>
  The VXC connecting to Microsoft contains two "inner" VLANs. These
  are referred to as the C-Tagged VLANs and are configured in the Azure
  console. The "outer" VLAN tag is called the S-Tag and is the VLAN
  assigned to the VXC in the Megaport Portal.
</Note>

## ExpressRoute Metro

Megaport supports ExpressRoute Metro. ExpressRoute Metro is the [high resiliency](/cloud/megaport/microsoft/azure-diversity) version of ExpressRoute. It provides a low-latency geo-diverse access solution in defined metropolitan locations, using private connections between your on-premises networks and Azure workloads in designated ExpressRoute data center peering locations. For more information about creating an ExpressRoute Metro connection using Megaport, see [ExpressRoute Metro](/cloud/megaport/microsoft/expressroute-metro).

## Creating an ExpressRoute connection

To deploy an ExpressRoute connection, you need to choose your ExpressRoute plan
and deploy the ExpressRoute circuit in the Azure Portal. When deployed, you get a service key. Copy the service key and log in to the Megaport Portal.

<Anchor name="azure-vxc" />

**To create a connection to ExpressRoute** <Anchor name="ERconnect" />

1. In the <Link href="https://portal.megaport.com">Megaport Portal</Link>, go to the **Services** page and select the Port you want to use.

   If you haven't already created a Port, see [Creating a Port](/connections/creating-port).

2. Add a VXC connection for the Port.\
   Click **+Connection**, click **Cloud**, then click **Microsoft Azure**.
   <Image src="/images/cloud/azure/azure-new-connection.png" alt="The new connection 'Select Port' page with the Microsoft Azure Provider selected" shadow={true} width={700} />

3. Add the ExpressRoute service key into the **Microsoft Azure Service Key** field.

   The Portal verifies the key then displays the available port locations based on the Peering Location chosen when creating the ExpressRoute in the Azure Portal. For example, if your ExpressRoute service is deployed in Peering Location Sydney, you can only select the Sydney locations.

   <Note>
     If you are creating a VXC for ExpressRoute Metro, the Ports available in your chosen metro will be shown. You will have to create a VXC for each Port.
   </Note>

4. Select the connection point for your first connection.

   Some helpful resource links appear on the configuration screen, including the Azure Resource Manager console and links to tutorial videos.

5. Click **Next**.

6. Specify the connection details:

   * **Connection Name** -- The name of your VXC to be shown in the <Link href="https://portal.megaport.com">Megaport Portal</Link>.

   * **Service Level Reference** (optional) -- Specify a unique identifying number for your Megaport service to be used for billing purposes, such as a cost center number, unique customer ID, or purchase order number. The service level reference number appears for each service under the Product section of the invoice. You can also edit this field for an existing service.

   * **Rate Limit** -- The speed of your connection in Mbps. It is auto-populated from the configuration in the Azure console.

   * **VXC State** -- Select **Enabled** or **Shut Down** to define the initial state of the connection. For more information, see [Shutting Down a VXC for Failover Testing](/connections/shut-down-vxc).

     <Note>
       If you select **Shut Down**, traffic will not flow through this service and it will behave as if it was down on the Megaport network. Billing for this service will remain active and you will still be charged for this connection.
     </Note>

   * **Preferred A-End VLAN** -- By default Q-in-Q is enabled. Specify an unused VLAN ID for this connection (for ExpressRoute this is the S-Tag for your data center). This must be a unique VLAN ID for this connection and can range from 2 to 4093. Enabling Q-in-Q has the benefit of deploying both Microsoft and private peering and both primary and secondary Azure ExpressRoute circuits but your routing and switching hardware must support Q-in-Q to be capable of terminating dual tags at the customer end.

     For clarity, your on-premises device is configured with the inner (C-Tag) and outer (S-Tag) tags. A corresponding outer tag is configured in the Megaport Portal as described above. The inner tag is provisioned in the Microsoft Azure Portal under the ExpressRoute peering VLAN ID.

     You must use untagged VLANs if you are creating a MACsec connection.

   * **Minimum Term** -- Select No Minimum Term, 12 Months, 24 Months, 36 Months, 48 Months, or 60 Months. Longer terms result in a lower monthly rate. *12 Months* is selected by default. Take note of the information on the screen to avoid early termination fees (ETF).

     Enable the [Minimum Term Renewal](/portal-admin/auto-renew/#auto-renew) option for services with a 12, 24, 36, 48 or 60-month term to automatically renew the contract at the same discounted price and term length at the end of the contract. If you don't renew the contract, at the end of the term,  the contract will automatically roll over to month-to-month contract for the following billing period, at the same price, without term discounts.

     For more information, see [VXC Pricing and Contract Terms](/finance/vxc-pricing) and [VXC, Megaport Internet, and IX Billing](/finance/billing-details).

   * **Resource Tags** -- You can use resource tags to add your own reference metadata to a Megaport service.\
     To add a tag:
     1. Click **Add Tags**.
     2. Click  **Add New Tag**.
     3. Enter details into the fields:
        * **Key** -- string maximum length 128. Valid values are a-z 0-9 \_ : . / \ -
        * **Value** -- string maximum length 256. Valid values are a-z A-Z 0-9 \_ : . @ / + \ - (space)
     4. Click **Save**.
        If you already have resource tags for that service, you can manage them by clicking **Manage Tags**.
     <Warning>
       Never include sensitive information in a resource tag. Sensitive information includes commands that return existing tag definitions and information that will identify a person or company.
     </Warning>

7. Click **Next**.

8. To deploy a second connection (and this is recommended), repeat these steps, reusing the service key. Adding a second connection ensures that you receive the Azure ExpressRoute SLA. Azure does not provide an SLA for a single connection.

9. Click **Next**.

10. Click **Review Order** to proceed through the checkout process, or click **Save** to save the configured services before placing the order.

11. Review the Important Information section and confirm agreement with the Service Agreements.

    If you do not have a promotion code, skip to the **Order Now** step. If you do have a promotion code, enter it into the **Enter discount code** field then click **Apply**. Alternatively, if a code already appears in the **Discounts** field, verify it is correct and click **Apply**.

    The promotional discount appears below the Standard Term discount.  This discount is not reflected in the Monthly Rate shown here, it is applied at the time of billing.  If an invalid or expired code causes an error with your order, contact your Megaport Account Manager for a replacement code.

    <Image src="/images/snippets/add-promo-code.png" alt="Add Promo Code" shadow={true} width={750} />

    If you entered an incorrect promotion code, you can remove it by clicking **Remove**.

12. Click **Order Now**.

## Connecting to ExpressRoute on equipment that does not support Q-in-Q

Q-in-Q is a technology that not all organizations use. If your equipment does not support Q-in-Q, this section describes your options.

### Configure single Azure peering VLAN

You can configure the VXC with a single tag VLAN solution. You configure peering in Azure with the Port VLAN (A-End) and the peer VLAN (B-End). Note that you can have only one peering type (private or Microsoft) per VXC with single Azure peering VLAN, so you need at least two VXCs to use both peering types.

<Image src="/images/cloud/megaport/microsoft/azure-single-peering-vlan.png" alt="Single Azure peering VLAN" shadow={true} width={400} />

<Tip>
  We recommend using single Azure peering VLAN. This option provides full functionality and the simplest implementation. With single Azure peering VLAN, you can use both private and Microsoft peering with a single ExpressRoute circuit without the need for Q-in-Q capable equipment, an MCR, or an untagged port.
</Tip>

<Note>
  You can reuse an Azure service key multiple times to provision the primary and secondary VXCs and both peerings.
</Note>

For example, if your environment does not support Q-in-Q but you want to use both private and Microsoft peering, you can provision 4 VXCs with single Azure peering VLAN:

* VXC 1 - The primary private peering with B-End VLAN 100.
* VXC 2 - The secondary private peering with B-End VLAN 100.
* VXC 3 - The primary Microsoft peering with B-End VLAN 200, reusing the primary option.
* VXC 4 - The secondary Microsoft peering with B-End VLAN 200, reusing the secondary option.

### Other options for connecting to ExpressRoute on equipment that does not support Q-in-Q

* You can remove the Q-in-Q requirement by dedicating a Port to Microsoft Azure by untagging the connection (selecting **Untagged** for the preferred A-End VLAN). Megaport will still correctly apply or strip the outer VLAN S-Tag depending on the traffic direction. This means you can only deploy a single VXC on this Port, so it does not scale well and you will not receive the Azure SLA. However, an untagged connection can be useful as a temporary solution.

* Deploy a Megaport Cloud Router (MCR) to take care of Q-in-Q for you.

<Note>
  For more information about Q-in-Q, see [Configuring Q-in-Q](/connections/q-in-q).
</Note>

## Enabling the single Azure peering VLAN

By enabling Azure peering VLAN, you can specify a single Azure peering VLAN that will match with the value that you configure (in step 8) for the selected peering type configuration for the Azure ExpressRoute configuration (via the Microsoft Azure Portal).

**To enable the single Azure peering VLAN**

1. Follow steps 1 through 5 in the procedure [To create a connection to ExpressRoute](#ERconnect).

2. Under Azure peering VLAN, enable the Configure single Azure peering VLAN option.

   <Image src="/images/cloud/megaport/microsoft/azure-peering-vlan-200.png" alt="Azure peering VLAN" shadow={true} width={500} />

3. Enter the peering VLAN tag for the ExpressRoute peering required, from 2 to 4093.
   Megaport uses this to set a peering VLAN tag that maps directly back to the ExpressRoute peering VLAN ID on the B-End. The tag must be a valid ExpressRoute VLAN ID, and it must match the VLAN ID of the Azure B-End of the VXC to configure the correct pairing.

4. Click **Next**.\
   A summary page appears that includes the monthly cost.

5. Click **Back** to make changes or click **Add VXC**.

6. To deploy a second connection (and this is recommended), create a second VXC. Enter the same service key, select the other connection target, and enter the same Peering VLAN ID for the ExpressRoute peering configured in step 3.

7. Click **Next** and proceed through the ordering process.

8. Configure the peer in the Azure Portal, matching the C-Tag VLAN ID to the single Azure peering VLAN tag entered in the Megaport Portal.

   This image shows where the VLAN C-Tag is configured in the Azure Portal.

   <Image src="/images/cloud/megaport/microsoft/azure-console-c-tag.png" alt="Azure peering VLAN" shadow={true} width={500} />

9. Configure your on-premises equipment.

**To change an existing single Azure peering VLAN**

1. On the Services page, click the gear icon next to the connection in the Megaport Portal.
2. Change the single Azure peering VLAN ID.
3. Click **Save**.
4. Click **Next**.
5. Configure the peer in the Azure Portal, matching the C-Tag VLAN ID to the single Azure peering VLAN tag entered in the Megaport Portal.

**To verify the single Azure peering VLAN**

* On the Services page, click the gear icon next to the connection in the Megaport Portal.\
  The Connection Details page shows the single Azure peering VLAN value.

## Converting an untagged VXC to a tagged VXC

An existing Azure service on an untagged VXC can now be tagged, allowing you to instantly order additional services on the existing Port without adding any more physical Ports.

<Callout icon="triangle-exclamation" color="red">
  Converting an untagged VXC to a tagged VXC will cause a service disruption.
</Callout>

**To convert an existing untagged VXC to a tagged VXC**

1. On the Services page, click the gear icon next to the connection in the Megaport Portal.
2. Select **Tagged**.
3. Enter the Preferred A-End VLAN tag for the customer Megaport-facing VLAN.
4. Enable the Configure single Azure peering VLAN option.
5. Enter the Peering VLAN ID for the ExpressRoute Peering, from 2 to 4093.\
   Megaport uses this to set a Peering VLAN tag that maps directly back to the ExpressRoute peering VLAN ID on the B-End. The tag must be a valid Azure ExpressRoute VLAN ID, and it must match the VLAN ID of the Azure B-End of the VXC to configure the correct pairing.
6. Click **Save**.
7. Click **Next**.
8. Configure the peer in the Azure Portal, matching the C-Tag VLAN ID to the single Azure peering VLAN tag entered in the Megaport Portal.

## Deleting an ExpressRoute connection

You might need to delete an ExpressRoute connection from time to time. ExpressRoute connections cannot be removed directly from the Megaport Portal if there is active BGP peering on the Azure side. Therefore, follow these steps to successfully delete an ExpressRoute connection.

**To delete an ExpressRoute connection**

1. Delete the peering on the ExpressRoute connection in the Azure Portal (Private or Microsoft).
2. Delete the VXC in the Megaport Portal.\
   For more information, see [Terminating a VXC](/connections/terminating-vxc).
3. Delete the ExpressRoute connection in the Azure Portal.\
   This will release the network resources reserved between Megaport and Azure.

## Helpful references

* [Azure Paired Regions - HA Design](/cloud/megaport/microsoft/azure-ha-design)
* [Azure Resource Manager Console](https://portal.azure.com/)
* [Enabling Cloud-Native VPN/Encryption Options Over Dedicated Cloud Connectivity Paths](/encryption/cloud-native-vpn-encryption)
* [Q-in-Q Router Configuration Samples](https://docs.microsoft.com/en-us/azure/expressroute/expressroute-config-samples-routing)
* [What is Azure ExpressRoute?](https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction)