First a bit of context:

I have a Saas system on Azure that consists of a bunch of Paas Cloud Service nodes (web & worker roles) and App Service nodes (web apps, web jobs). For compliance reasons I have to store some customers' data inside an on-premise database. I would like to connect to this database via ExpressRoute for bandwidth and predictability reasons. I'll choose a hosting partner (for this database) that supports ExpressRoute.


Can I access an on-premise resource (f.ex a SQL database) from Azure via ExpressRoute without the necessity of adding all my services (cloud services and app services) into a Virtual Network on Azure?


I've contacted Microsoft Azure support with this question. My conversation with them led to 2 answers which I would like to share here.

First Answer: "So regarding your doubts, in order to implement an Express Route you’ll need to have a Gateway linked to the dedicated circuit and to have a VNET linked to the gateway. Your PaaS instances will also need to be deployed within that VNET so you can access them. I think we can do some workarounds to overcome this limitation (I’ll need a bit of time to perform some testing on my side to perform a proof of concept though if you wish me to do it). To have everything moved to a VNET would be the solution that would cause you less trouble in the future in my opinion and definitely the recommended one."

Then I asked how to do it when one has compute nodes on both Classic and ARM deployment models.

Second Answer: "What you need to do step by step:

  1. Create a VNET in ARM and move all the PaaS ARM instances there.
  2. Create a VNET in Classic mode and move all the PaaS classic instances there.
  3. Create an ARM Dynamic Gateway ( or Route Based Gateway ) and link it to the ARM VNET.
  4. Create an Classic Dynamic Gateway ( or Route Based Gateway ) and link it to the Classic VNET.
  5. Enable a VNET to VNET connection between both VNETs.
  6. Request the deployment for ExpressRoute and wait for the circuits to be provisioned an enabled.
  7. On the Azure Side you’ll need to create a new Gateway for the dedicated circuits that you just had provisioned.
  8. That gateway needs to be linked to the ARM VNET as well.
  9. This should link all the dots on your environment!"

Image - ExpressRoute topology with Classic and ARM VNETs

| improve this answer | |

It appears you can use Azure Express Route without a VPN, but your access would be limited to the using the public peering routes, not the private peering - https://azure.microsoft.com/en-us/documentation/articles/expressroute-circuit-peerings/

You can't initiate access from Azure to your on-prem via public peering - only the other way around, which I don't think meets your needs.

| improve this answer | |
  • In the last sentence of your answer, I think you meant public peering right? Because the documentation says private peering is bi-directional, which makes sense. – Hakan Tuncer Apr 5 '16 at 8:25
  • Yes... sorry, typo! I'll edit. – Jennelle Crothers Apr 6 '16 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.