Designing Azure virtual networks that use ExpressRoute for primary private connectivity and site-to-site VPN as backup or for branches, focusing on routing, BGP and failover
In this lesson we cover how to design an Azure virtual network that uses both site-to-site VPN and ExpressRoute simultaneously. This dual-connectivity pattern is common when organizations require resilient hybrid networking—using ExpressRoute for private, high-bandwidth links to primary on-premises sites, and VPN tunnels for backup connectivity or smaller remote sites.
The Azure virtual network (VNet) can host both an ExpressRoute connection and a VPN gateway.
ExpressRoute delivers private, high-throughput connectivity to a primary datacenter through a connectivity provider.
A VPN gateway terminates IPsec/IKE site-to-site tunnels (and optionally point-to-site connections) and typically uses a public IP address that on-premises VPN devices connect to.
Both connection types can operate in parallel. Use ExpressRoute as the primary path and site-to-site VPN as a backup or for smaller remote sites that do not have direct ExpressRoute connectivity.
When you design this pattern you’ll commonly see a dual-gateway setup: one gateway for ExpressRoute and a distinct gateway for VPN. Each gateway is purpose-built and configured to suit its connection type.
VPN gateway
Terminates IPsec/IKE tunnels from remote sites.
Has a public IP address for external tunnel endpoints.
Supports BGP for dynamic routing with on-premises devices (recommended for failover).
ExpressRoute circuit
Connects privately via your service provider.
Is linked to the VNet using an ExpressRoute circuit and virtual network connection.
Uses private peering (or Microsoft peering when needed) and typically uses BGP for route exchange.
When implementing a dual-gateway design, ensure you plan routing and failover behavior carefully. Failover from ExpressRoute to VPN is possible, but it requires appropriate routing and monitoring configuration (for example, BGP and route priorities or automated failover mechanisms). Test your failover plan to ensure the VPN path is activated as expected during an ExpressRoute outage.
Use BGP between Azure and on-premises devices to advertise prefixes and enable automatic failover.
Prefer ExpressRoute routes by setting appropriate route metrics or AS path prepending on VPN routes so they are only preferred when ExpressRoute is down.
Implement health probes and monitoring to trigger failover or route changes when connectivity degrades.
Test failover scenarios (provider outage, gateway failure, route withdrawal) to validate that VPN tunnels become active as intended.
This dual approach gives you flexibility and a strong foundation for high availability in hybrid architectures. Deploy and test both connectivity methods to ensure your routing, failover, and monitoring work together as intended.
