Configure ExpressRoute Global Reach using the Azure portal

This article helps you configure ExpressRoute Global Reach using PowerShell. For more information, see ExpressRouteRoute Global Reach.

Before you begin

Before you start configuration, confirm the following criteria:

  • You understand ExpressRoute circuit provisioning workflows.
  • Your ExpressRoute circuits are in a provisioned state.
  • Azure private peering is configured on your ExpressRoute circuits.
  • If you want to run PowerShell locally, verify that the latest version of Azure PowerShell is installed on your computer.

Identify circuits

  1. From a browser, navigate to the Azure portal and sign in with your Azure account.

  2. Identify the ExpressRoute circuits that you want use. You can enable ExpressRoute Global Reach between the private peering of any two ExpressRoute circuits, as long as they're located in the supported countries/regions. The circuits are required to be created at different peering locations.

    • If your subscription owns both circuits, you can choose either circuit to run the configuration in the following sections.
    • If the two circuits are in different Azure subscriptions, you need authorization from one Azure subscription. Then you pass in the authorization key when you run the configuration command in the other Azure subscription.

    Screenshot of ExpressRoute circuits list.

Enable connectivity

Enable connectivity between your on-premises networks. There are separate sets of instructions for circuits that are in the same Azure subscription, and circuits that are different subscriptions.

ExpressRoute circuits in the same Azure subscription

  1. Select the Azure private peering configuration.

    Screenshot of ExpressRoute overview page.

  2. Select Add Global Reach to open the Add Global Reach configuration page.

    Enable global reach from private peering

  3. On the Add Global Reach configuration page, give a name to this configuration. Select the ExpressRoute circuit you want to connect this circuit to and enter in a /29 IPv4 for the Global Reach subnet. We use IP addresses in this subnet to establish connectivity between the two ExpressRoute circuits. Don’t use the addresses in this subnet in your Azure virtual networks, or in your on-premises network. Select Add to add the circuit to the private peering configuration.

    Screenshot of adding Global Reach in private peering.

  4. Select Save to complete the Global Reach configuration. When the operation completes, you'll have connectivity between your two on-premises networks through both ExpressRoute circuits.

    Screenshot of saving private peering configurations.

ExpressRoute circuits in different Azure subscriptions

If the two circuits aren't in the same Azure subscription, you'll need authorization. In the following configuration, authorization is generated from circuit 2's subscription. The authorization key is then passed to circuit 1.

  1. Generate an authorization key.

    Screenshot of generating authorization key.

    Make a note of the circuit resource ID of circuit 2 and the authorization key.

  2. Select the Azure private peering configuration.

    Screenshot of private peering on overview page.

  3. Select Add Global Reach to open the Add Global Reach configuration page.

    Screenshot of add Global Reach in private peering.

  4. On the Add Global Reach configuration page, give a name to this configuration. Check the Redeem authorization box. Enter the Authorization Key and the ExpressRoute circuit ID generated and obtained in Step 1. Then provide a /29 IPv4 for the Global Reach subnet. We use IP addresses in this subnet to establish connectivity between the two ExpressRoute circuits. Don’t use the addresses in this subnet in your Azure virtual networks, or in your on-premises network. Select Add to add the circuit to the private peering configuration.

    Screenshot of Add Global Reach with authorization key.

  5. Select Save to complete the Global Reach configuration. When the operation completes, you'll have connectivity between your two on-premises networks through both ExpressRoute circuits.

    Screenshot of saving private peering configuration with Global Reach.

Verify the configuration

Verify the Global Reach configuration by selecting Private peering under the ExpressRoute circuit configuration. When configured correctly your configuration should look as followed:

Screenshot of Global Reach configured.

Disable connectivity

To disable connectivity between an individual circuit, select the delete button next to the Global Reach name to remove connectivity between them. Then select Save to complete the operation.

Screenshot showing how to disable Global Reach.

After the operation is complete, you no longer have connectivity between your on-premises network through your ExpressRoute circuits.

Next steps