Menu

Lumen help

Adding a connection from your location to Microsoft Azure

Using NaaS Manager, you can add a Lumen® Ethernet On‑Demand connection from your location (from your list of available UNIs) to Microsoft Azure. To add the connection, you'll need an ExpressRoute service key from Microsoft (which you receive when you create an ExpressRoute circuit using the Azure portal). Be sure to have that information handy to type in (or copy/paste). Microsoft Azure requires two EVCs to make the connection (which NaaS Manager will create when you build the connection). You'll only be billed for one; the other is for redundancy.


Azure also requires Q‑in‑Q style tagging (known as double‑stacked tags or 802.1ad) at the NNI. This provides layer‑2 flexibility by allowing multiple VLAN tags to be inserted into a single frame. Inner VLAN tags (C‑Tags) that identify your traffic are inserted inside of the outer VLAN tags (S‑Tags) provided by the service provider. The S‑Tag becomes a single VLAN that carries multiple VLANs within it. A single VXC carries the bundled VLAN tags between the two network endpoints. 


For Ethernet On‑Demand connections to Microsoft Azure, your equipment must support 802.1ad (Q‑in‑Q). We recommend configuring your router for Q‑in‑Q before creating your Ethernet On‑Demand connection in NaaS Manager. Q‑in‑Q can be difficult to set up. Use the example below to set up Q‑in‑Q. 

Here’s an example below with a Cisco router.

You’ll assign the outer tag in NaaS Manager and the inner tag in the Azure portal (peering VLAN).

‘Primary EVC VLAN – 100 - NaaS Manager
‘Secondary EVC VLAN – 200 - NaaS Manager
‘Private Peering – VLAN 300 - Azure portal
‘MSFT Peering – VLAN 400 - Azure portal


interface GigabitEthernet0/1.100300
  encapsulation dot1Q 100 second-dot1q 300 ‘Azure Private primary peer
  description "Cloud Connect"
  ip address xxx.xxx.xxx.xxx 255.255.255.252


interface GigabitEthernet0/1.200300
  encapsulation dot1Q 200 second-dot1q 300 ‘Azure Private secondary peer
  description "Cloud Connect"
  ip address xxx.xxx.xxx.xxx 255.255.255.252


interface GigabitEthernet0/1.100400
  encapsulation dot1Q 100 second-dot1q 400 ‘MSFT primary peer
  description "Cloud Connect"
  ip address xxx.xxx.xxx.xxx 255.255.255.252


interface GigabitEthernet0/1.200400
  encapsulation dot1Q 200 second-dot1q 400 ‘MSFT secondary peer
  description "Cloud Connect"
  ip address xxx.xxx.xxx.xxx 255.255.255.252

There are three steps to successfully create and use your Ethernet On‑Demand connection to Azure:

1. Create the ExpressRoute circuit
2. Create the connection in NaaS Manager
3. Finish provisioning the ExpressRoute circuit

Note: You can only use a service key that isn't assigned to an active connection. The ExpressRoute service key is a unique service key and is different from the service key for your cloud service from Azure.

Step 1: Create the ExpressRoute circuit

To create an ExpressRoute circuit in the Azure portal: 

  1. Go to the Azure portal and sign in.
  1. On the Azure portal menu, click + Create a resource. 
  1. Search for ExpressRoute, then click Create.
  1. Select a Resource group. If you don't have a resource group, click Create new, type a name, then click OK.  
  1. Select a Region. NaaS Manager uses the region you to list the available on ramps when you create the On-Demand connection. 
  1. Type a Name. 
  1. Click Next. 
  1. Fill in the Configuration.

    1. Select Provider for Port type. 

    2. Click Provider, then select CenturyLink Cloud Provider from the list.

    3. Select a Peering location. NaaS Manager uses the location you select here to list the available on ramps when you create the On-Demand connection. 

    4. Select a Bandwidth. This is the maximum bandwidth you can use for the On-Demand connection.  

    5. Leave SKU, Billing model, and Allow classic operations at the default settings. 
  1. Click Next.
  1. Add tags to categorize resources if needed, then click Next. 
  1. Review the ExpressRoute, then click Create. 
  1. Go to All resources and select the ExpressRoute circuit you created.  
  1. On Overview, click the copy icon next to the Service key. You will paste this when creating the On-Demand connection. 

Once you create the ExpressRoute circuit, the Azure portal shows Not provisioned in the Provider status field and Enabled in the Circuit status field. Learn more about ExpressRoute circuit status 

Step 2: Create the connection in NaaS Manager

To create the connection in NaaS Manager:

  1. Click Services.

    Control Center shows the Services console. Use the console to access an inventory of your services, check the status of orders, and manage your services.
Services console
  1. In the Service Managers box, click Network-as-a-Service (NaaS).
     

The NaaS Manager Overview lists connection options. 

NaaS Manager Overview tab
  1. Click Create Connection for Ethernet On-Demand.
  1. From the Customer Account and Billing Account lists, select the customer number and billing account number you want to add Ethernet On-Demand to.
  1. In the Connection Name field, type a name for the connection you're creating. (Be sure to use something memorable. This name will appear on your invoice.) 
  1. In the From Location field, select Customer Site/Building. 
  1. Fill in the information your location (UNI):

    1. In the Port Location field, search for the connection origination endpoint and select it from the list. 

    2. In the Ce‑vlan field, type an unused VLAN ID between 1 and 4094. (If you type in a VLAN ID and it's already in use, NaaS Manager highlights it in red.) The two Ethernet virtual circuits (EVCs) are tagged with different VLAN IDs: one for the primary connection and one for the secondary connection. Those VLAN IDs are the outer 802.1Q Ethernet header. The inner 802.1Q Ethernet header is mapped to a specific ExpressRoute routing domain/peering.

      Learn more about peering requirements
      Learn more about creating peering
  1. In the To Location field, select Cloud Provider. 
  1. Fill in the information for the connection:

    1. In the Cloud Provider field, select Azure. 

    2. In the ExpressRoute Service Key field, type or copy and paste your ExpressRoute service key provided by Microsoft. (Note: You can only use a service key that isn't assigned to an active connection. The ExpressRoute service key is a unique service key and is different from the service key for your cloud service from Azure.)

      Once you fill in the ExpressRoute service key, NaaS Manager retrieves connection information from Microsoft. 

    3. If you'd like to use a second port for redundancy, do the following:

      1. In the Enable port redundancy? field, select Yes.

        NaaS Manager adds a Secondary Port Location field (next to the Primary Port Location field) so you can select the redundancy location.

      2. In the Secondary Port Location fields select the connection origination endpoint. 

      3. In the Secondary Ce‑vlan field, type an unused VLAN ID between 1 and 4094. (If you type in a VLAN ID and it's already in use, NaaS Manager highlights it in red.) 
NaaS Ethernet On-Demand connection from your location to Azure
  1. Click CONTINUE. 
  1. In the Class of Service field, select whether you want Basic, Enhanced, or Dedicated. (Higher classes of service offer higher availability SLAs and allow you to increase traffic prioritization for your EVC.) 

    • Basic (best effort): The service may be oversubscribed on the Lumen network. 

    • Enhanced (mid class): Enhanced EVCs (ethernet virtual circuits) can still be oversubscribed like Basic class of service EVCs; however, traffic is marked with an internal class of service marking which will prioritize your traffic over best-effort traffic during times of congestion. For EVCs with this class of service, bandwidth is not reserved on the Lumen network and traffic will not take priority over real-time traffic in the network.

    • Dedicated (real time): The quality of service offering with the highest priority on the Lumen network. In addition, Lumen reserves the bandwidth for this EVC across the network on each ring that the EVC touches. Once it is dedicated to you, that bandwidth (and the corresponding CE-VLANs) sits in reserve regardless of how much bandwidth you use.
  1. Use the Billing Method buttons to select whether you want monthly or hourly billing for the connection.

    NaaS Manager shows pricing for the billing method you selected.  
  1. In the Select Bandwidth field, select the bandwidth for the connection. Bandwidth options vary based on location. (You can't change the bandwidth once you create the connection. If you need to choose a different bandwidth after creating a connection, disconnect the connection and create a new one.)
  1. Click CONTINUE.
  1. Review your connection information, then click SUBMIT ORDER. 

    NaaS Manager creates the request for the connection and places it in the Pending Activation status. From here, you can view the status of the connection. 

Step 3: Finish provisioning the ExpressRoute circuit with Azure

To finish provisioning the ExpressRoute circuit: 

  1. Once the connection is in Active status, view the details for the information you need to take back to the Azure portal to finish setting up the connection and creating the Azure private peering. 
  1. Complete the provisioning of your ExpressRoute circuit:

    1. Go to the Azure portal and sign in.

    2. Select the ExpressRoute you created. 

    3. In the Peer ASN field, type 3549.

    4. In the Subnets field, select the IPv4 radio button.

    5. In the IPv4 Primary subnet field, type (or copy/paste) the information in the Primary Router Peer IP field in your connection details.

    6. In the IPv4 Secondary subnet field, type (or copy/paste) the information in the Secondary Router Peer IP field. 

    7. Leave the Enable IPv6 Peering checkbox, IPv6 Primary subnet field, and IPv6 Secondary subnet field empty. (Lumen doesn't use IPv6 for connections.)

    8. In the VLAN ID field, type (or copy/paste) the information in the VLAN ID field in your connection details.

    9. If you want to use an MD5 hash, type (or copy/paste) the information in the BGP Auth Key field in your connection details into the Shared key field.
  1. Click Save.

    The Azure portal provisions the ExpressRoute circuit and shows Provisioned in the Provider Status field.