Understanding the implementation of encryption over ExpressRoute

Securing data in transit is important to mitigate security threats such as eavesdropping attacks and data theft. By default, ExpressRoute provides private connectivity but not secure (or encrypted) connectivity. For highly regulated organizations in areas such as banking and government, this may not be sufficient to meet their data security requirements, which is why Microsoft offers two optional solutions for encrypting data in transit on an ExpressRoute circuit—point-to-point encryption with MACsec and end-to-end encryption with IPsec.

Let’s start with MACsec, which is only supported for the ExpressRoute Direct implementation. MACsec stands for Media Access Control Security. It is a Layer 2 encryption implementation that can be used to encrypt physical links. Once we configure it, the BGP data traffic and customer data traffic is encrypted in hardware on the routers between our network devices and Microsoft...