Question

Contoso has an ExpressRoute circuit with private peering connecting their on-premises datacenter to an Azure virtual network. A new compliance requirement mandates that all traffic traversing the ExpressRoute connection between on-premises and Azure must be encrypted, while continuing to use the existing ExpressRoute circuit as the transport path. Which solution meets this requirement with the least additional cost and complexity?

Accepted Answer

Configure a site-to-site IPsec VPN tunnel over the ExpressRoute private peering, terminating on the VPN gateway in the virtual network.

Answer

Enable Microsoft peering on the circuit and route the traffic through Microsoft peering instead of private peering.

Answer

Migrate the circuit to ExpressRoute Direct and enable MACsec encryption on the ExpressRoute gateway.

Answer

Deploy Azure Firewall Premium in the hub virtual network to encrypt traffic arriving over the ExpressRoute connection.