Azure ExpressRoute vs VPN Gateway: the honest comparison
Azure ExpressRoute vs VPN Gateway: the honest comparison
Azure ExpressRoute 与 VPN Gateway：深度对比分析
Your datacenter needs to talk to Azure. You can send that traffic through an encrypted tunnel over the public internet, or over a private circuit that never touches it. That single choice — shared road or private rail — decides cost, speed, and reliability. 你的数据中心需要与 Azure 进行通信。你可以通过公共互联网上的加密隧道传输流量，也可以通过一条完全不经过公共互联网的私有线路进行传输。这一选择——共享公路还是私有铁路——决定了成本、速度和可靠性。
Almost every organization moving to Azure keeps something on-premises, and those two worlds have to connect privately. Azure gives you two hybrid-connectivity options, and they take opposite routes to the same destination: VPN Gateway and ExpressRoute. Understanding them is really understanding one question — does your traffic ride the public internet, protected by encryption, or a dedicated line that bypasses it entirely? 几乎每个迁移到 Azure 的组织都会保留部分本地基础设施，而这两个世界必须通过私有方式连接。Azure 提供了两种混合连接选项，它们通往同一目的地，但路径截然不同：VPN Gateway 和 ExpressRoute。理解它们的核心在于回答一个问题：你的流量是经由加密保护的公共互联网，还是通过完全绕过互联网的专用线路？
VPN Gateway: an encrypted tunnel over the internet
VPN Gateway：互联网上的加密隧道
Microsoft’s description is exact: Azure VPN Gateway “can be used to send encrypted traffic between an Azure virtual network and on-premises locations over the public Internet.” Your traffic still travels the ordinary internet, but inside an IPsec/IKE tunnel, so it is private even though the road is shared. 微软的描述非常精准：Azure VPN Gateway“可用于在 Azure 虚拟网络和本地位置之间通过公共互联网发送加密流量”。你的流量依然在普通互联网上传输，但被封装在 IPsec/IKE 隧道内，因此即使道路是共享的，流量依然是私密的。
It comes in a few shapes: site-to-site (your datacenter’s VPN device to Azure), point-to-site (an individual remote worker to the VNet), and VNet-to-VNet. It is quick to stand up, needs no third party, and is inexpensive — the pragmatic default for dev/test and small-to-medium production links. 它有几种形式：站点到站点（Site-to-Site，连接数据中心 VPN 设备与 Azure）、点到站点（Point-to-Site，连接远程个人用户与虚拟网络）以及虚拟网络到虚拟网络（VNet-to-VNet）。它部署迅速、无需第三方参与且成本低廉，是开发/测试环境及中小型生产链路的务实之选。
ExpressRoute: a private, dedicated circuit
ExpressRoute：私有专用线路
ExpressRoute takes the other road entirely. It “lets you extend your on-premises networks into the Microsoft cloud over a private connection with the help of a connectivity provider.” The defining fact: because ExpressRoute connections do not go over the public internet, they offer “more reliability, faster speeds, consistent latencies, and higher security than typical connections over the internet.” ExpressRoute 则选择了完全不同的路径。它“允许你在连接服务提供商的帮助下，通过私有连接将本地网络扩展到微软云”。其核心特征在于：由于 ExpressRoute 连接不经过公共互联网，因此相比典型的互联网连接，它提供了“更高的可靠性、更快的速度、一致的延迟以及更高的安全性”。
You are not tunnelling through shared roads; you have a private rail line into Microsoft’s network, arranged through a connectivity provider. That extra reliability and consistency costs more and takes longer to provision — but for a bank, a hospital, or a latency-sensitive enterprise workload, it is the answer. 你不再是在共享公路上建立隧道，而是通过连接服务提供商安排了一条直通微软网络的“私有铁路”。这种额外的可靠性和一致性意味着更高的成本和更长的配置周期——但对于银行、医院或对延迟敏感的企业工作负载来说，这是最佳方案。
| Feature | VPN Gateway | ExpressRoute |
|---|---|---|
| Path | Public internet (encrypted tunnel) | Private dedicated circuit |
| Reliability & latency | Best-effort internet | More reliable, consistent latency |
| Setup | Fast, self-service | Via a connectivity provider |
| Cost | Lower | Higher |
| Best for | Dev/test, small-medium prod, remote users | Enterprise, regulated, latency-sensitive |
| 特性 | VPN Gateway | ExpressRoute |
|---|---|---|
| 路径 | 公共互联网（加密隧道） | 私有专用线路 |
| 可靠性与延迟 | 尽力而为的互联网 | 更可靠，延迟更稳定 |
| 设置 | 快速，自助服务 | 通过连接服务提供商 |
| 成本 | 较低 | 较高 |
| 适用场景 | 开发/测试、中小型生产、远程用户 | 企业级、受监管行业、延迟敏感型 |
A VPN tunnels privately through the public road. ExpressRoute gives you a private road of your own. Same destination, very different guarantees. They are not mutually exclusive. The grown-up pattern often uses both: ExpressRoute as the primary private connection, with a site-to-site VPN as a secure failover path if the circuit goes down. Microsoft supports this coexistence directly. So the question is not always “which one” — sometimes it is “ExpressRoute with a VPN safety net.” VPN 是在公共道路上开辟的一条私密隧道，而 ExpressRoute 则是为你提供了一条专属的私有道路。目的地相同，但保障机制截然不同。它们并非互斥，成熟的架构往往两者并用：以 ExpressRoute 作为主要私有连接，并配置站点到站点 VPN 作为线路中断时的安全故障转移路径。微软直接支持这种共存模式。因此，问题并不总是“二选一”，有时答案是“以 ExpressRoute 为主，以 VPN 为安全保障”。
How to choose
如何选择
- Getting started, dev/test, or a small-to-medium workload where good-enough internet connectivity is fine? VPN Gateway. Fast, cheap, no provider to involve. 起步阶段、开发/测试或对互联网连接质量要求尚可的中小型工作负载？ 选择 VPN Gateway。快速、便宜，无需第三方介入。
- Remote individual users needing into the VNet? A point-to-site VPN. 远程个人用户需要访问虚拟网络？ 选择点到站点（Point-to-Site）VPN。
- Enterprise scale, strict reliability or latency needs, regulated industry, or heavy sustained data transfer? ExpressRoute — the private, consistent circuit is worth the cost and the lead time. 企业级规模、严格的可靠性或延迟需求、受监管行业或持续的大规模数据传输？ 选择 ExpressRoute——私有且稳定的线路值得投入成本和等待配置时间。
- Mission-critical link that cannot go dark? ExpressRoute primary, VPN failover. 关键任务链路，绝不能中断？ 以 ExpressRoute 为主，VPN 为故障转移。
The mistake is treating them as “cheap one vs expensive one.” They are “shared road with a lock” versus “your own private line,” and the right pick follows from how much reliability, consistency, and privacy the workload genuinely demands. Say “a site-to-site VPN for now, and ExpressRoute when we need consistent latency and an SLA on the connection — with the VPN kept as failover” and you are talking hybrid networking like an architect. 将它们简单地视为“便宜货与昂贵货”是错误的。它们分别是“带锁的共享公路”与“你自己的私有线路”，正确的选择取决于工作负载对可靠性、一致性和隐私的真实需求。如果你能说出“目前先用站点到站点 VPN，等我们需要稳定的延迟和连接 SLA 时再上 ExpressRoute，并将 VPN 保留作为故障转移”，那么你已经像架构师一样在思考混合网络了。
Questions people also ask
常见问题解答
Is ExpressRoute more secure than VPN Gateway? ExpressRoute 比 VPN Gateway 更安全吗？ ExpressRoute keeps traffic off the public internet, which removes a whole class of exposure a VPN carries by design. But an ExpressRoute circuit is not encrypted by default. For data that must be encrypted in transit, add MACsec on the circuit or run an IPsec VPN over ExpressRoute. VPN Gateway is encrypted from the start, just over a shared path. ExpressRoute 让流量避开了公共互联网，消除了 VPN 设计上固有的一类暴露风险。但 ExpressRoute 线路默认是不加密的。对于必须在传输过程中加密的数据，可以在线路上添加 MACsec 或在 ExpressRoute 之上运行 IPsec VPN。VPN Gateway 从一开始就是加密的，只是路径是共享的。
Can you use ExpressRoute and VPN Gateway together? 可以同时使用 ExpressRoute 和 VPN Gateway 吗？ Yes, and Azure supports the coexistence directly. The common pattern runs ExpressRoute as the primary private circuit and a site-to-site VPN as the failover path, so if the circuit drops, traffic falls back to an encrypted tunnel over the internet instead of going dark. 可以，Azure 直接支持这种共存。常见的模式是将 ExpressRoute 作为主要私有线路，将站点到站点 VPN 作为故障转移路径，这样如果线路中断，流量会回退到互联网上的加密隧道，而不是直接断连。
How much does ExpressRoute cost compared to a VPN Gateway? 与 VPN Gateway 相比，ExpressRoute 的成本如何？ ExpressRoute costs more. Its tiers run from a metered Local option up to Standard around $300 a month for 1 Gbps, plus a Premium add-on, before you add the connectivity provider’s own charges. A VPN Gateway has a much lower flat cost since it rides the internet you already pay for and needs no third-party provider. ExpressRoute 成本更高。其层级从按量计费的本地选项到每月约 300 美元的 1 Gbps 标准版不等，此外还有高级附加组件，这还不包括连接服务提供商收取的费用。VPN Gateway 的固定成本要低得多，因为它利用了你已经支付费用的互联网，且无需第三方提供商。
What is the difference between ExpressRoute and a site-to-site VPN? ExpressRoute 和站点到站点 VPN 有什么区别？ A site-to-site VPN connects your on-premises network to Azure through an encrypted tunnel over the public internet. ExpressRoute connects the same two networks through a private circuit arranged with a connectivity provider, bypassing the internet entirely for more consistent latency and reliability. 站点到站点 VPN 通过公共互联网上的加密隧道将你的本地网络连接到 Azure。ExpressRoute 则通过与连接服务提供商安排的私有线路连接这两个网络，完全绕过互联网，从而获得更稳定的延迟和可靠性。
Which is faster, ExpressRoute or VPN Gateway? ExpressRoute 和 VPN Gateway 哪个更快？ ExpressRoute is faster and more consistent. Because it does not share the public internet’s congestion and routing variability, it delivers predictable latency and higher throughput. A VPN Gateway’s speed depends on internet conditions between your site and Azure, which vary and can degrade under load. ExpressRoute 更快且更稳定。因为它不与公共互联网共享拥塞和路由波动，所以能提供可预测的延迟和更高的吞吐量。VPN Gateway 的速度取决于你站点与 Azure 之间的互联网状况，这些状况会波动，并在负载过高时出现性能下降。