# Azure VPN Gateway and ExpressRoute > Chapter 21 of the Courseiva AZ-900 curriculum — https://courseiva.com/learn/az-900/azure-vpn-gateway **Official objective:** 2.3 — Azure Architecture Services ## Introduction This chapter covers Azure VPN Gateway and Azure ExpressRoute — two ways to connect on-premises networks to Azure. AZ-900 tests this under objective 2.3, as part of describing Azure networking services. ## A Private Tunnel vs. a Dedicated Private Road Imagine two ways to connect a company's office to a remote warehouse. One option is a secure, encrypted tunnel that runs through the regular public road system — reliable and much cheaper to set up, but still sharing the underlying roads with everyone else, even though the tunnel itself is private. The other option is a dedicated private road built directly between the two locations, bypassing the public roads entirely — more consistent and often faster, but more expensive and involved to establish. Azure VPN Gateway is like the encrypted tunnel through public roads (using the internet, encrypted for privacy); Azure ExpressRoute is like the dedicated private road (a direct, private connection that doesn't traverse the public internet at all). ## Core explanation ### Azure VPN Gateway Azure VPN Gateway creates an encrypted connection between an on-premises network (or an individual device) and an Azure Virtual Network, using the public internet as the underlying transport but encrypting the traffic so it remains private. It's a relatively quick and cost-effective way to establish connectivity between on-premises infrastructure and Azure. ### Azure ExpressRoute Azure ExpressRoute provides a private, dedicated connection between an on-premises network and Azure, that doesn't travel over the public internet at all. This generally offers more consistent performance and can meet requirements where organizations don't want their traffic to traverse the public internet, even in encrypted form — but it requires more setup and is a more involved, dedicated connection to establish. ### How they compare VPN Gateway is generally faster and simpler to set up, using existing internet connectivity, making it a common choice for smaller-scale or less performance-sensitive connections. ExpressRoute offers a private, dedicated connection with generally more consistent performance, suited to larger organizations or workloads with stricter connectivity requirements — at the cost of more setup complexity. ### Why hybrid connectivity matters Many organizations don't move everything to the cloud at once — they maintain some on-premises infrastructure while extending into Azure. VPN Gateway and ExpressRoute are the two primary ways Azure supports connecting those on-premises environments securely to Azure resources. ## Real-world context A small business extending some workloads into Azure while keeping a modest on-premises presence uses VPN Gateway, since it's quicker and less expensive to set up for their relatively lower-traffic connectivity needs. A large enterprise with strict performance and consistency requirements for its hybrid infrastructure uses ExpressRoute instead, since the dedicated, private connection avoids the variability of the public internet and better suits their scale and requirements — accepting the additional setup involved for that benefit. ## Exam focus Objective 2.3 expects candidates to distinguish between VPN Gateway (encrypted connection over the public internet) and ExpressRoute (private, dedicated connection not using the public internet). A common wrong answer is assuming both options work the same way, just with different pricing — they use fundamentally different underlying connectivity (public internet vs. dedicated private connection). Another common trap is assuming ExpressRoute is always the "better" choice — it's more suited to specific needs around performance consistency and avoiding the public internet, not universally superior for every scenario. Stable terms: **VPN Gateway**, **ExpressRoute**. Knowing that VPN Gateway uses the internet (encrypted) while ExpressRoute uses a private, dedicated connection is the single most important distinction for this topic. Memory trick: VPN Gateway = encrypted tunnel over the public internet. ExpressRoute = private, dedicated connection that skips the public internet entirely. ## Step by step 1. **Assess connectivity requirements** — Consider whether the organization needs a quick, cost-effective connection (favoring VPN Gateway) or requires a private, dedicated connection with more consistent performance (favoring ExpressRoute). 2. **Set up VPN Gateway for simpler needs** — VPN Gateway is configured to create an encrypted connection over the internet between the on-premises network and an Azure Virtual Network. 3. **Set up ExpressRoute for dedicated needs** — ExpressRoute involves working with a connectivity provider to establish a private, dedicated connection that doesn't use the public internet. 4. **Connect on-premises resources securely to Azure** — Once established, either connection lets on-premises resources communicate with Azure resources as if they were part of the same private network. ## Comparisons ### Azure VPN Gateway vs Azure ExpressRoute **Azure VPN Gateway:** - Encrypted connection over the public internet - Generally quicker and less costly to set up - Suited to smaller-scale or less performance-sensitive needs **Azure ExpressRoute:** - Private, dedicated connection, not using the public internet - Generally more consistent performance - Suited to larger-scale or stricter connectivity requirements ## Common misconceptions - **Misconception:** VPN Gateway and ExpressRoute both use the public internet, just with different security. **Reality:** VPN Gateway uses the public internet with encryption. ExpressRoute uses a private, dedicated connection that doesn't traverse the public internet at all — a fundamentally different underlying connection type. - **Misconception:** ExpressRoute is always the better choice. **Reality:** ExpressRoute suits specific needs around performance consistency and avoiding the public internet, but requires more setup and cost. VPN Gateway is often a perfectly appropriate, simpler choice for smaller-scale needs. - **Misconception:** You need both VPN Gateway and ExpressRoute for hybrid connectivity. **Reality:** They're alternative approaches to the same general problem — an organization typically chooses one based on its specific needs, rather than requiring both. ## Key takeaways - Azure VPN Gateway creates an encrypted connection between on-premises networks and Azure over the public internet. - Azure ExpressRoute provides a private, dedicated connection between on-premises networks and Azure, not using the public internet. - VPN Gateway is generally quicker and less costly; ExpressRoute generally offers more consistent performance for stricter needs. - Both are approaches to hybrid connectivity — connecting on-premises infrastructure securely to Azure resources. ## FAQ **What's the difference between VPN Gateway and ExpressRoute?** VPN Gateway creates an encrypted connection over the public internet between on-premises networks and Azure. ExpressRoute provides a private, dedicated connection that doesn't use the public internet at all, generally offering more consistent performance at the cost of more setup complexity. **Which one should an organization choose?** It depends on their needs — VPN Gateway is quicker and less costly, suiting smaller-scale or less performance-sensitive connections. ExpressRoute suits organizations with stricter performance or connectivity requirements, willing to invest in a more dedicated setup. **Do these services replace an organization's on-premises network entirely?** No — they're used for hybrid connectivity, letting an organization keep some infrastructure on-premises while securely connecting it to resources running in Azure, rather than requiring a full migration away from on-premises infrastructure. --- Interactive version with quiz and diagrams: https://courseiva.com/learn/az-900/azure-vpn-gateway