Connect ExpressRoute to Azure Virtual WAN

Prerequisites

Before you begin, ensure you have the following:

An active Azure subscription.
An existing ExpressRoute circuit with Microsoft peering enabled.
Permissions: Owner or Network Contributor on the subscription.
Azure CLI 2.45+ or Azure PowerShell 7.4+ installed.

The ExpressRoute circuit must be in the same Azure region as the Virtual Hub you plan to create.

Create a Virtual WAN

Run the following Azure CLI command to create a Virtual WAN:

az network vwan create \
  --resource-group MyResourceGroup \
  --name MyVirtualWAN \
  --location eastus \
  --type Standard

Replace MyResourceGroup and MyVirtualWAN with your own names.

Create a Virtual Hub

Associate the hub with your Virtual WAN and attach the ExpressRoute circuit later:

az network vhub create \
  --resource-group MyResourceGroup \
  --name MyHub \
  --address-prefix 10.0.0.0/24 \
  --vwan MyVirtualWAN \
  --location eastus

Take note of the hub's resource ID for the next step.

Link ExpressRoute circuit

Link the existing ExpressRoute circuit to the hub:

az network vhub connection create \
  --resource-group MyResourceGroup \
  --name ExpressRouteConnection \
  --vhub-name MyHub \
  --remote-vnet null \
  --express-route-circuit /subscriptions/<subscription-id>/resourceGroups/MyResourceGroup/providers/Microsoft.Network/expressRouteCircuits/MyCircuit \
  --peering MicrosoftPeering

After the command succeeds, the connection status will be Provisioning. Verify with:

az network vhub connection show \
  --resource-group MyResourceGroup \
  --vhub-name MyHub \
  --name ExpressRouteConnection \
  --query provisioningState

Validate the connection

Use Azure Network Watcher to run a connectivity check between a VM in the hub and a resource on the ExpressRoute network:

az network watcher test-connectivity \
  --resource-group MyResourceGroup \
  --source-resource MyHubVM \
  --dest-address 10.1.2.0 \
  --dest-port 80

A successful result shows ConnectionStatus: "Connected".

Clean up resources

If you need to remove the setup, execute:

az network vhub connection delete \
  --resource-group MyResourceGroup \
  --vhub-name MyHub \
  --name ExpressRouteConnection

az network vhub delete \
  --resource-group MyResourceGroup \
  --name MyHub

az network vwan delete \
  --resource-group MyResourceGroup \
  --name MyVirtualWAN

Make sure you no longer need the ExpressRoute circuit before deleting it.