Networking: ExpressRoute and PrivateLink

Question 1

ExpressRoute connection models - colocated cloud exchange

Answer 1

If you are colocated in a facility with a cloud exchange, you order virtual cross-connections to the Microsoft cloud through the colocation provider’s Ethernet exchange.

Question 2

ExpressRoute connection models - point to point Ethernet

Answer 2

You connect your on-premises datacenters/offices to the Microsoft cloud through point-to-point Ethernet links. Point-to-point Ethernet providers offer Layer 2 connections, or managed Layer 3 connections between your site and the Microsoft cloud

Question 3

ExpressRoute connection models - Any-to-any (IPVPN) networks

Answer 3

You integrate your WAN with the Microsoft cloud.

IPVPN providers, typically Multiprotocol Label Switching (MPLS) VPN, offer any-to-any connectivity between your branch offices and datacenters.

The Microsoft cloud can be interconnected to your WAN to make it appear just like any other branch office. WAN providers typically offer managed Layer 3 connectivity.

Question 4

Azure Private Link

Answer 4

provides private connectivity from a virtual network to Azure platform as a service (PaaS), customer-owned, or Microsoft partner services. It simplifies the network architecture and secures the connection between endpoints in Azure by eliminating data exposure to the public internet.

Question 5

Azure Private Link: Private connectivity

Answer 5

Traffic remains on the Microsoft network, with no public internet access. Connect privately to services running in other Azure regions. Private Link is global and has no regional restrictions.

Question 6

Azure Private Link: Integration with on-premises and peered networks.

Answer 6

Access private endpoints over private peering or VPN tunnels from on-premises or peered virtual networks. Microsoft hosts the traffic, so you don’t need to set up public peering or use the internet to migrate your workloads to the cloud.

Question 7

Azure Private Link: Protection against data exfiltration for Azure resources.

Answer 7

Use Private Link to map private endpoints to Azure PaaS resources. When there is a security incident within your network, only the mapped resource would be accessible, eliminating the threat of data exfiltration.