Designlet: Using Azure ExpressRoute with Azure VMware Solution for On-premises Connectivity
When an Azure VMware Solution private cloud is deployed, it initially has no external connectivity. Additional native Azure services are required to establish a connection to an on-premises environment. Azure ExpressRoute provides private and secure connectivity from an on-premises environment into Azure VMware Solution through a high bandwidth, low latency connection. The use of Azure ExpressRoute Global Reach is recommended to establish full interconnectivity (bi-directionally) between an Azure VMware Solution private cloud and an on-premises environment.
Summary and Considerations
Planning and Implementation
An Azure ExpressRoute can be created from the Azure portal or using alternative methods such as Azure PowerShell, CLI, or ARM template. Follow the steps below are when using the Azure portal.
The following steps assume a service provider has been selected, Azure VMware Solution private cloud and a Virtual Network Gateway are deployed
- In the Azure Portal, select Create a resource > Networking > ExpressRoute. If not available on screen, use the search services and marketplace option.
- Note: Alternatively use the search option at the top of the Azure portal and search for “ExpressRoute circuits”
- From the Create ExpressRoute page, Provide the necessary information, and click Next: Configuration
- Resource Group
- ExpressRoute Circuit name
- Fill out the ExpressRoute configuration tab and click Review + Create
- Port Type [Provider or Direct]
- Create new or import from classic circuit
- Provider Information [Service provider granting the connection service]
- Peering location [physical peering location]
- SKU [ ExpressRoute type of Standard or Premium add-on]
- Billing Model [metered or unlimited]
- Review the ExpressRoute information, and click Create
- The ExpressRoute circuit is now created, select go to resource group which will take you to the Overview page. On this page copy the service key that will be used to when configuring the connection on the service provider side.
- Once connectivity is configured from the service provider, check the ExpressRoute overview page, provider status property should now be “provisioned” [this may take some time to complete, check periodically for status change]
In the following steps, create an authorization key and retrieve the ExpressRoute ID for the Azure VMware Solution private cloud internal ExpressRoute. These items will be used to connect the ExpressRoute to the virtual network gateway in Azure.
- Go to the Azure VMware Solution private cloud
- Click on Connectivity and select the ExpressRoute tab
- Click on the + Request an authorization key and enter a Name
- Click the copy icon next to the authorization key which was just created. This authorization key will be used to connect internal Azure VMware Solution ExpressRoute to the virtual network gateway
- The ExpressRoute ID will also be needed for the Peer circuit URI field in the next section
Go to the virtual network gateway blade, connect the internal Azure VMware Solution ExpressRoute to the virtual network gateway. This establishes connectivity from the Azure VMware Solution private cloud to the Azure Virtual Network.
- Click on Connections in the Virtual network gateway blade and click +Add
- Enter a connection name and select “ExpressRoute” from Connection type drop down
- Click on the Redeem authorization tick-box and paste the authorization key from the previous section
- For the Peer circuit URI field, use the ExpressRoute ID under the Azure VMware solution private cloud > connectivity > ExpressRoute tab [from the previous section] and Click OK.
Notice the virtual network gateway successfully is created, the connection type is ExpressRoute, and the peer listed is the Azure VMware Solution internal ExpressRoute. Connectivity between Azure and Azure VMware solution is now in place. Even though connectivity to Azure from on-premises via an ExpressRoute is in place there is not a path to the Azure VMware Solution service within Azure. ExpressRoute Global Reach will establish this connectivity.
Note: To test internal connectivity to Azure VMware Solution a jump server or bastion host can be deployed within Azure to connect to vCenter Server or NSX-T manager.
Azure ExpressRoute Global Reach
Azure ExpressRoute Global Reach establishes a connection between ExpressRoute circuits between Azure VMware Solution to a customer’s on-premises environment.
The next steps are required to generate an authorization to be used by Azure ExpressRoute Global Reach to connect the Azure VMware Solution ExpressRoute to the on-premises ExpressRoute.
- Go to the created ExpressRoute circuit page and select “Authorizations”
- Click into the Enter Name field under the Name column and provide the name for the Global Reach Authorization that will be created, press Enter > click Save at the top
- Copy both the Global Reach authorization key and return to the connectivity page in the Azure VMware Solution private cloud and select on ExpressRoute Global Reach tab.
- Click the + Add and select the ExpressRoute circuit from the dropdown
- Provide the Global Reach authorization key from the ExpressRoute authorization page, and click Create
Notice there is a circuit now in the On-prem cloud connections list with a connected state. This indicates that there is an ExpressRoute Global Reach connection established successfully between the Azure VMware Solution ExpressRoute and the customer data center ExpressRoute.