Menu

Lumen help

Creating a connection between Microsoft Azure and Microsoft Azure Gov

You can create a Dynamic Connection to connect Microsoft Azure to Microsoft Azure Gov. To create the connection, you'll need ExpressRoute service keys from Microsoft. Be sure to have that information handy to type in (or copy/paste). Microsoft Azure Gov requires two EVCs to make the connection (which Control Center will create when you build the connection). You'll only be billed for one; the other is for redundancy.

Azure Gov also requires Q-in-Q style tagging (known as double-stacked tags or 802.1ad) at the NNI. This provides layer-2 flexibility by allowing multiple VLAN tags to be inserted into a single frame. Inner VLAN tags (C-Tags) that identify your traffic are inserted inside of the outer VLAN tags (S-Tags) provided by the service provider. The S-Tag becomes a single VLAN that carries multiple VLANs within it. A single VXC carries the bundled VLAN tags between the two network endpoints.

 

For Dynamic Connections to Microsoft Azure, your equipment must support 802.1ad (Q-in-Q). We recommend configuring your router for Q-in-Q before creating your Dynamic Connection in Control Center. Q-in-Q can be difficult to set up. Use the example below to help you set up Q-in-Q.

Here’s an example below with a Cisco router.

You’ll assign the outer tag in Control Center and the inner tag in the Azure portal (peering VLAN).

‘Primary EVC VLAN – 100 - Control Center
‘Secondary EVC VLAN – 200 - Control Center
‘Private Peering – VLAN 300 - Azure portal
‘MSFT Peering – VLAN 400 - Azure portal


interface GigabitEthernet0/1.100300

  encapsulation dot1Q 100 second-dot1q 300 ‘Azure Private primary peer
  description "Cloud Connect"
  ip address xxx.xxx.xxx.xxx 255.255.255.252


interface GigabitEthernet0/1.200300

  encapsulation dot1Q 200 second-dot1q 300
‘Azure Private secondary peer
  description "Cloud Connect"
  ip address xxx.xxx.xxx.xxx 255.255.255.252


interface GigabitEthernet0/1.100400
  encapsulation dot1Q 100 second-dot1q 400
‘MSFT primary peer
  description "Cloud Connect"
  ip address xxx.xxx.xxx.xxx 255.255.255.252


interface GigabitEthernet0/1.200400
  encapsulation dot1Q 200 second-dot1q 400
‘MSFT secondary peer
  description "Cloud Connect"
  ip address xxx.xxx.xxx.xxx 255.255.255.252

Note: You can only use a service key that isn't assigned to an active connection. The ExpressRoute service key is a unique service key and is different from the service key for your cloud service from Azure.

To create a connection between Microsoft Azure and Microsoft Azure Gov:

Dynamic Connections (showing list view)
Dynamic Connections (Create Connection)
  1. In the From Connection Type field, select Microsoft (Azure).
  1. In the To Connection Type field, select Microsoft (Azure Gov).
dynamic connections create connection google to google select endpoints
  1. Fill in the information for the connection:

    1. Fill in the two ExpressRoute Service Key fields with the service keys provided by Microsoft. (Note: You can only use a service key that isn't assigned to an active connection. The ExpressRoute service key is a unique service key and is different from the service key for your cloud service from Azure.)

      Once you fill in the ExpressRoute service key, Control Center retrieves connection information from Microsoft.

    2. In the Billing Method field, select whether you want hourly or monthly billing.

    3. In the Class of Service field, select whether you want BasicEnhanced, or Dedicated. (Higher classes of service offer higher availability SLAs and allow you to increase traffic prioritization for your EVC.)

    4. In the Bandwidth field, select the bandwidth for the connection. By default, Control Center selects the lowest bandwidth associated with the service key you entered. You can adjust the bandwidth up/down based on your needs.

      Control Center displays pricing for the bandwidth you selected.

    5. In the Connection Name field, type a name for the connection you're creating.
  1. Click Next.
  1. Review your connection information and then click the I agree with the terms and conditions checkbox. (To enable the checkbox, scroll to the bottom of the terms and conditions.)