FREE STUDY NOTES · AZ-700

ExpressRoute Global Reach, FastPath and ExpressRoute Direct compared

What each ExpressRoute feature does, which SKUs and gateways it needs, and where it fits on a circuit.

From Ultra Transcenders AZ-700 by Tony Rough (publishing soon)

These three features are easy to confuse because all of them sound like “faster” or “bigger” ExpressRoute. Each solves a different problem, and each has a scenario it does not address. Figure 7.1 shows where each peering leads and where Global Reach and FastPath fit on the circuit.

On-premises site A connects through a connectivity provider to an ExpressRoute circuit that ends at a peering location on the Microsoft edge (MSEE). Azure private peering leads to an ExpressRoute gateway in the VNet's GatewaySubnet and then to the VMs; a dashed FastPath line goes straight to the VMs, bypassing the gateway. Microsoft peering, which needs a route filter, leads to Microsoft 365 and Azure PaaS public endpoints. Global Reach links this circuit to site B's circuit so the two sites talk over the Microsoft backbone. — Figure 7.1: Where an ExpressRoute circuit’s peerings lead, with FastPath and Global Reach

Feature	What it does	Not for
Global Reach	Links two ExpressRoute circuits so on-premises sites exchange traffic over the Microsoft backbone; configured on Azure private peering	Not supported on ExpressRoute Local
FastPath	Sends on-premises traffic straight to VMs, bypassing the ExpressRoute gateway in the data path	Site-to-site links; faster failover
ExpressRoute Direct	Physical 10/100 Gbps port offering	Linking sites to each other

Global Reach between circuits in the same geopolitical region needs no Premium upgrade; Premium is only for other geopolitical regions or higher route limits.
FastPath needs Ultra Performance, ErGw3AZ, or ErGwScale with at least 10 scale units; Standard/ErGw1AZ and High Performance/ErGw2AZ don’t support it.
FastPath to same-region peered VNets applies to ExpressRoute Direct circuits.

Get the whole book

This note is one section of Ultra Transcenders AZ-700: Designing and Implementing Microsoft Azure Networking Solutions, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

Amazon.co.ukKindle: coming soonPaperback: coming soon

Amazon.comKindle: coming soonPaperback: coming soon

Publishing soon on Amazon in Kindle and paperback editions.

About the book · Free AZ-700 glossary · All AZ-700 study notes

More AZ-700 study notes

Azure subnet sizing: the five reserved addresses and the smallest subnet
How many usable addresses each prefix gives in Azure, why five are always reserved, and how to size subnets for gateways, Bastion and VMs.
Hybrid DNS with Azure DNS Private Resolver: inbound endpoints, outbound endpoints and rulesets
Resolving Azure private zones from on-premises and on-premises names from Azure, with subnet sizing and ruleset rules.
Gateway transit in hub-and-spoke networks: Allow gateway transit and Use remote gateways
Where each peering setting goes, what spokes can reach, and why peering isn't transitive.
How Azure selects routes: longest prefix match, UDRs and forced tunnelling
Longest prefix match, system routes versus user-defined routes, and how a 0.0.0.0/0 route forces internet traffic on-premises.
Choosing an Azure load-balancing service: Load Balancer, Application Gateway, Front Door or Traffic Manager
A decision guide by traffic type (HTTP or not) and scope (regional or global).
Private endpoint DNS: how privatelink zones resolve a service to its private IP
The CNAME chain from a public service name to a private endpoint, zone groups and zone links.
How NSG rules are evaluated: priorities, default rules and stateful flows
Rule order, the default rules, and what happens to a flow between subnets and to return traffic.