Skip to content

Creating MCR Connections to Azure using ExpressRoute

You can create a VXC from an MCR to Microsoft Azure ExpressRoute through the Megaport ONE Portal. You can create the VXC to Azure from the MCR and establish either private or Microsoft peering.

To connect to ExpressRoute using MCR, you need an ExpressRoute service key obtained from the Azure Resource Manager (ARM) portal. Follow the steps in the Microsoft topic Tutorial: Create and modify an ExpressRoute circuit to get this key.

To create a VXC from an MCR to Azure

  1. In the Megaport ONE Portal, choose Networking > Services.
  2. Select the MCR you want to use.
  3. Click Actions and choose Add Connection.
    Add Connection
  4. Choose Cloud Virtual Cross Connect as the Connection Type.
  5. Choose Microsoft Azure as the Cloud Provider.
  6. Specify the Azure Configuration details:
    • Azure ExpressRoute Service Key – Add the ExpressRoute service key. The Portal verifies the key and then displays the available port locations based on the ExpressRoute region.
    • Available Azure Ports – Select the connection point for your first connection. VXC connection
  7. Specify the Connection Details:
    • VXC Name – The name of your VXC to be shown in the Megaport ONE Portal.
    • Rate Limit – This is the speed of your connection in Mbps. The rate limit for the VXC will be capped at the maximum allowable based on the ExpressRoute service key.
    • Peering Type (optional) – Select one or both of the peering types: Private and Microsoft.
  8. Specify the Billing Details:

    • Service Level Reference (optional) – Specify a unique identifying number for the VXC to be used for billing purposes, such as a cost center number or a unique customer ID. The service level reference number appears for each service under the Product section of the invoice. You can also edit this field for an existing service.


      Partner-managed accounts can apply a Partner Deal to a service.

    • Promo Code – If you have a promo code, enter it and click Add Code.

  9. Click Create Connection.

  10. Click Confirm to acknowledge the MCR connection details and deploy the VXC.
    The Megaport system takes about five minutes to deploy and configure the required peering types.

Viewing the configuration

Once the VXC connection deploys successfully, it is attached to the MCR on the Megaport ONE Portal MCRs page:

VXC connection

  1. Click the VXC to display the details of this connection.

  2. Select the VXC Configuration and A-End Configuration tabs to view this information:

    • VLANs are 100 and 200 by default – 100 for Private peering and 200 for Microsoft.
    • Local ASN: 133937 – This is the default Megaport autonomous system number (ASN).
    • Peer ASN: For Microsoft Azure via ExpressRoute, 12076 for all peering types.
    • Local IP and Peer IP – Reflects the APIPA range for BGP peering (auto-configured) on Private peering. Microsoft peering displays a Megaport-assigned public IP range (within
    • BGP Password – Blank by default; this field is not mandatory for ExpressRoute connections because they traverse a private (non-Internet) path. However, if you enter a BGP password, you also need to update it manually on the ExpressRoute configuration page to match. The passwords do not synchronize automatically for security reasons.

Confirming ExpressRoute configuration details

The corresponding ExpressRoute details screen in the Azure portal shows that the Layer 2 connection is up (Provider Status = Provisioned) and Layer 3 for the Private (or Microsoft) peering is similarly configured:

ExpressRoute details

  • Click the Azure private peering type to display the Private peering configuration.

Values for both primary and secondary subnets are provided, regardless of whether only one of these peering locations is established. If you add a second ExpressRoute VXC using this service key, it will inherit the same peering types and automatically configure for the next available IP address allocation within that peering type.

Creating and linking a Virtual Network Gateway

In addition to the ExpressRoute circuit, you need to create a Virtual Network Gateway (VNG) and associate it with both VNets used for private peering, as well as linking the VNG to your ExpressRoute circuit to provide routing on the Azure side toward the MCR.


The creation of the VNG can take approximately 45 minutes, although this is a one-time requirement.

For details, follow the steps in Configure a virtual network gateway for ExpressRoute using the Azure portal to create the VNG (note that Microsoft charges apply per the ExpressRoute Gateways section of the Azure VPN gateway pricing page.

After you create the VNG, you need to associate the ExpressRoute VNG to the ExpressRoute circuit by following Connect a virtual network to an ExpressRoute circuit using the portal guidance.


How do I confirm the BGP configuration?

To confirm a successful BGP/Layer 3 configuration, return to Azure private peering, click the detail line and then click Get ARP Records.

This function takes about a minute to populate data. For a successful connection you see a display similar to this image, indicating that the MAC addresses have resolved on both the On-Prem and Microsoft sides of the connection:

ARP records - primary

After switching from primary to secondary, this display currently only shows a value for the Microsoft side of the connection, because the VXC to the secondary target has not been configured.

ARP records - secondary

To configure the secondary VXC, create another VXC from your MCR with the same ExpressRoute service key; however, this time target the secondary router presentation.

Once Layer 3 BGP is active and confirmed, you can view the Route Table as seen by the Microsoft edge devices by clicking Get route table in the Private peering pane. It displays the next hop, weighting, and AS path for the network values. You can toggle the display to view the secondary path route table when both primary and secondary VXCs are active.

Route table - primary

My public prefix configuration is the “verifying” state. What can I do?

When you create a public circuit and you specify public peer IP addresses, you need approval from the Microsoft Azure team (private circuits do not require this authorization and are available within minutes). Before approving public peer IP prefixes or public ASNs, the Azure team needs to verify the ownership by confirming that the advertised public prefixes and peer ASN are assigned to the organization listed in your Azure account. If you are getting the public prefixes from another entity, and the assignment is not recorded with the Internet Routing Registry, the validation will not complete.


If the public virtual interface state is in the verifying or validation needed state for more than 72 hours, check the email address registered to your Azure account. You might have received an email from the Azure team if the owner of the BGP ASN or one of your advertised routes does not match your account details.

If the BGP ASN or an advertised route does not match your account, collect the documents that show the public prefixes are assigned to your organization by the entity that is listed as the prefix owner in the routing registry. Submit these documents for manual validation by opening a support ticket for the Azure team.

Helpful references

Last update: 2023-06-28