ExpressRoute offers a private connection that is facilitated by a connectivity provider. ExpressRoute connections don't go over the public internet; instead, they use a more reliable connection. These types of connections offer lower latencies, higher security, and faster speeds than connections that go over the internet. Also, Microsoft provides stronger SLAs for the ExpressRoute connection. You can use these to extend your on-premises networks to Azure and Office 365. Connections can be made from an any-to-any (IP VPN) network, a virtual cross-connection at a colocation facility, and a point-to-point Ethernet network connection.

ExpressRoute uses a virtual network gateway, which is configured with a gateway type of ExpressRoute instead of VPN. By default, the traffic is not encrypted, but you can create a solution that encrypts the traffic that goes over the ExpressRoute circuit.

The following diagram shows an ExpressRoute connection from an on-premises environment to Azure:

Now that we have looked at the different types of VPN connections you can configure, we are going to create and configure an Azure VPN gateway.