Day 1: Create ExpressRoute Circuits in Azure¶
File: terraform/02-expressroute/circuits.tf
terraform {
required_version = ">= 1.5.0"
required_providers {
azurerm = { source = "hashicorp/azurerm", version = "~> 3.85.0" }
}
}
provider "azurerm" { features {} }
data "azurerm_resource_group" "networking" { name = "abhavtech-networking" }
# Circuit: Mumbai (Tata Communications)
resource "azurerm_express_route_circuit" "mumbai" {
name = "er-abhavtech-mumbai"
resource_group_name = data.azurerm_resource_group.networking.name
location = "centralindia"
service_provider_name = "Tata Communications"
peering_location = "Mumbai"
bandwidth_in_mbps = 10000
sku { tier = "Premium"; family = "MeteredData" }
tags = { region = "APAC", hub_site = "mumbai" }
}
## Circuit: London (BT)
resource "azurerm_express_route_circuit" "london" {
name = "er-abhavtech-london"
resource_group_name = data.azurerm_resource_group.networking.name
location = "uksouth"
service_provider_name = "BT"
peering_location = "London"
bandwidth_in_mbps = 10000
sku { tier = "Premium"; family = "MeteredData" }
tags = { region = "EMEA", hub_site = "london" }
}
## Circuit: New Jersey (AT&T)
resource "azurerm_express_route_circuit" "new_jersey" {
name = "er-abhavtech-nj"
resource_group_name = data.azurerm_resource_group.networking.name
location = "eastus"
service_provider_name = "AT&T"
peering_location = "New York"
bandwidth_in_mbps = 10000
sku { tier = "Premium"; family = "MeteredData" }
tags = { region = "Americas", hub_site = "new-jersey" }
}
## Microsoft Peering: Mumbai
resource "azurerm_express_route_circuit_peering" "mumbai_microsoft" {
peering_type = "MicrosoftPeering"
express_route_circuit_name = azurerm_express_route_circuit.mumbai.name
resource_group_name = data.azurerm_resource_group.networking.name
peer_asn = 65000
primary_peer_address_prefix = "169.254.200.0/30"
secondary_peer_address_prefix = "169.254.200.4/30"
vlan_id = 4001
microsoft_peering_config {
advertised_public_prefixes = ["10.252.0.0/16"]
}
}
## Microsoft Peering: London
resource "azurerm_express_route_circuit_peering" "london_microsoft" {
peering_type = "MicrosoftPeering"
express_route_circuit_name = azurerm_express_route_circuit.london.name
resource_group_name = data.azurerm_resource_group.networking.name
peer_asn = 65001
primary_peer_address_prefix = "169.254.201.0/30"
secondary_peer_address_prefix = "169.254.201.4/30"
vlan_id = 4002
microsoft_peering_config {
advertised_public_prefixes = ["10.252.0.0/16"]
}
}
## Microsoft Peering: New Jersey
resource "azurerm_express_route_circuit_peering" "nj_microsoft" {
peering_type = "MicrosoftPeering"
express_route_circuit_name = azurerm_express_route_circuit.new_jersey.name
resource_group_name = data.azurerm_resource_group.networking.name
peer_asn = 65002
primary_peer_address_prefix = "169.254.202.0/30"
secondary_peer_address_prefix = "169.254.202.4/30"
vlan_id = 4003
microsoft_peering_config {
advertised_public_prefixes = ["10.252.0.0/16"]
}
}
output "mumbai_service_key" {
value = azurerm_express_route_circuit.mumbai.service_key
sensitive = true
}
output "london_service_key" {
value = azurerm_express_route_circuit.london.service_key
sensitive = true
}
output "nj_service_key" {
value = azurerm_express_route_circuit.new_jersey.service_key
sensitive = true
}
cd terraform/02-expressroute
terraform init && terraform apply -auto-approve
## Retrieve service keys for carriers
terraform output -raw mumbai_service_key # → Send to Tata Communications
terraform output -raw london_service_key # → Send to BT
terraform output -raw nj_service_key # → Send to AT&T
## Monitor provisioning state
watch -n 60 'az network express-route show \
--name er-abhavtech-mumbai \
--resource-group abhavtech-networking \
--query serviceProviderProvisioningState -o tsv'
## Progresses: NotProvisioned → Provisioning → Provisioned
Day 2: BGP Configuration on Hub C8500-12X Routers¶
Mumbai Hub (MUM-HUB-01)¶
! ============================================================================
! MUMBAI C8500-12X - EXPRESSROUTE BGP CONFIGURATION
! ============================================================================
hostname MUM-HUB-01
! ExpressRoute Primary (Tata handoff - VLAN 4001)
interface TenGigabitEthernet0/0/2
description TATA-EXPRESSROUTE-PRIMARY-HANDOFF
no ip address
no shutdown
interface TenGigabitEthernet0/0/2.4001
description AZURE-EXPRESSROUTE-MSFT-PRIMARY
encapsulation dot1Q 4001
ip address 169.254.200.2 255.255.255.252
no shutdown
! ExpressRoute Secondary (VLAN 4001 - redundant path)
interface TenGigabitEthernet0/0/3
description TATA-EXPRESSROUTE-SECONDARY-HANDOFF
no ip address
no shutdown
interface TenGigabitEthernet0/0/3.4001
description AZURE-EXPRESSROUTE-MSFT-SECONDARY
encapsulation dot1Q 4001
ip address 169.254.200.6 255.255.255.252
no shutdown
! BGP Configuration
router bgp 65000
bgp log-neighbor-changes
bgp router-id 10.252.1.1
neighbor 169.254.200.1 remote-as 12076
neighbor 169.254.200.1 description MSFT-ER-MUMBAI-PRIMARY
neighbor 169.254.200.1 ebgp-multihop 2
neighbor 169.254.200.1 update-source TenGigabitEthernet0/0/2.4001
neighbor 169.254.200.1 timers 10 30
neighbor 169.254.200.5 remote-as 12076
neighbor 169.254.200.5 description MSFT-ER-MUMBAI-SECONDARY
neighbor 169.254.200.5 ebgp-multihop 2
neighbor 169.254.200.5 update-source TenGigabitEthernet0/0/3.4001
neighbor 169.254.200.5 timers 10 30
address-family ipv4
network 10.252.0.0 mask 255.255.0.0
neighbor 169.254.200.1 activate
neighbor 169.254.200.1 route-map MSFT-PREFIXES-IN in
neighbor 169.254.200.1 route-map MSFT-PREFIXES-OUT out
neighbor 169.254.200.1 route-map SET-LOCALPREF-PRIMARY in
neighbor 169.254.200.1 maximum-prefix 800 80
neighbor 169.254.200.5 activate
neighbor 169.254.200.5 route-map MSFT-PREFIXES-IN in
neighbor 169.254.200.5 route-map MSFT-PREFIXES-OUT out
neighbor 169.254.200.5 route-map SET-LOCALPREF-SECONDARY in
neighbor 169.254.200.5 maximum-prefix 800 80
exit-address-family
London Hub (LON-HUB-01)¶
hostname LON-HUB-01
interface TenGigabitEthernet0/0/2.4002
description BT-EXPRESSROUTE-MSFT-PRIMARY
encapsulation dot1Q 4002
ip address 169.254.201.2 255.255.255.252
no shutdown
interface TenGigabitEthernet0/0/3.4002
description BT-EXPRESSROUTE-MSFT-SECONDARY
encapsulation dot1Q 4002
ip address 169.254.201.6 255.255.255.252
no shutdown
router bgp 65001
bgp router-id 10.252.16.1
neighbor 169.254.201.1 remote-as 12076
neighbor 169.254.201.1 description MSFT-ER-LONDON-PRIMARY
neighbor 169.254.201.1 ebgp-multihop 2
neighbor 169.254.201.1 update-source TenGigabitEthernet0/0/2.4002
neighbor 169.254.201.5 remote-as 12076
neighbor 169.254.201.5 description MSFT-ER-LONDON-SECONDARY
neighbor 169.254.201.5 ebgp-multihop 2
neighbor 169.254.201.5 update-source TenGigabitEthernet0/0/3.4002
address-family ipv4
network 10.252.0.0 mask 255.255.0.0
neighbor 169.254.201.1 activate
neighbor 169.254.201.1 route-map MSFT-PREFIXES-IN in
neighbor 169.254.201.1 route-map MSFT-PREFIXES-OUT out
neighbor 169.254.201.1 route-map SET-LOCALPREF-PRIMARY in
neighbor 169.254.201.5 activate
neighbor 169.254.201.5 route-map MSFT-PREFIXES-IN in
neighbor 169.254.201.5 route-map MSFT-PREFIXES-OUT out
neighbor 169.254.201.5 route-map SET-LOCALPREF-SECONDARY in
exit-address-family
New Jersey Hub (NJ-HUB-01)¶
hostname NJ-HUB-01
interface TenGigabitEthernet0/0/2.4003
description ATT-EXPRESSROUTE-MSFT-PRIMARY
encapsulation dot1Q 4003
ip address 169.254.202.2 255.255.255.252
no shutdown
interface TenGigabitEthernet0/0/3.4003
description ATT-EXPRESSROUTE-MSFT-SECONDARY
encapsulation dot1Q 4003
ip address 169.254.202.6 255.255.255.252
no shutdown
router bgp 65002
bgp router-id 10.252.32.1
neighbor 169.254.202.1 remote-as 12076
neighbor 169.254.202.1 description MSFT-ER-NJ-PRIMARY
neighbor 169.254.202.1 ebgp-multihop 2
neighbor 169.254.202.1 update-source TenGigabitEthernet0/0/2.4003
neighbor 169.254.202.5 remote-as 12076
neighbor 169.254.202.5 description MSFT-ER-NJ-SECONDARY
neighbor 169.254.202.5 ebgp-multihop 2
neighbor 169.254.202.5 update-source TenGigabitEthernet0/0/3.4003
address-family ipv4
network 10.252.0.0 mask 255.255.0.0
neighbor 169.254.202.1 activate
neighbor 169.254.202.1 route-map MSFT-PREFIXES-IN in
neighbor 169.254.202.1 route-map MSFT-PREFIXES-OUT out
neighbor 169.254.202.1 route-map SET-LOCALPREF-PRIMARY in
neighbor 169.254.202.5 activate
neighbor 169.254.202.5 route-map MSFT-PREFIXES-IN in
neighbor 169.254.202.5 route-map MSFT-PREFIXES-OUT out
neighbor 169.254.202.5 route-map SET-LOCALPREF-SECONDARY in
exit-address-family
Day 3: Route Filtering and Prefix Lists¶
Apply this configuration to all three hub routers:
! ============================================================================
! OFFICE 365 PREFIX LISTS (Applied to all hub sites: Mumbai, London, NJ)
! Source: https://endpoints.office.com/endpoints/worldwide
! ============================================================================
! Exchange Online prefixes
ip prefix-list O365-ALL seq 10 permit 13.107.0.0/17 le 32
ip prefix-list O365-ALL seq 20 permit 13.107.64.0/18 le 32
ip prefix-list O365-ALL seq 30 permit 13.107.128.0/22 le 32
ip prefix-list O365-ALL seq 40 permit 13.107.136.0/22 le 32
! Teams (Real-time media - critical for MOS score)
ip prefix-list O365-ALL seq 50 permit 20.190.128.0/18 le 32
ip prefix-list O365-ALL seq 60 permit 40.92.0.0/14 le 32
ip prefix-list O365-ALL seq 70 permit 40.96.0.0/13 le 32
ip prefix-list O365-ALL seq 80 permit 40.104.0.0/15 le 32
ip prefix-list O365-ALL seq 90 permit 40.107.0.0/17 le 32
ip prefix-list O365-ALL seq 100 permit 40.108.128.0/17 le 32
ip prefix-list O365-ALL seq 110 permit 40.126.0.0/18 le 32
! SharePoint and OneDrive
ip prefix-list O365-ALL seq 120 permit 52.96.0.0/14 le 32
ip prefix-list O365-ALL seq 130 permit 52.104.0.0/14 le 32
ip prefix-list O365-ALL seq 140 permit 52.108.0.0/14 le 32
! Teams media (Azure Relay)
ip prefix-list O365-ALL seq 150 permit 52.112.0.0/14 le 32
ip prefix-list O365-ALL seq 160 permit 52.120.0.0/14 le 32
! Azure Active Directory
ip prefix-list O365-ALL seq 170 permit 104.47.0.0/17 le 32
ip prefix-list O365-ALL seq 180 permit 104.146.128.0/17 le 32
! Deny everything else from Microsoft
ip prefix-list O365-ALL seq 999 deny 0.0.0.0/0 le 32
! Corporate network to advertise to Microsoft
ip prefix-list ABHAVTECH-TO-MSFT seq 10 permit 10.252.0.0/16
ip prefix-list ABHAVTECH-TO-MSFT seq 999 deny 0.0.0.0/0 le 32
! ============================================================================
! ROUTE-MAPS
! ============================================================================
! Inbound: Accept ONLY Office 365 prefixes
route-map MSFT-PREFIXES-IN permit 10
match ip address prefix-list O365-ALL
route-map MSFT-PREFIXES-IN deny 999
! Outbound: Advertise ONLY corporate network
route-map MSFT-PREFIXES-OUT permit 10
match ip address prefix-list ABHAVTECH-TO-MSFT
route-map MSFT-PREFIXES-OUT deny 999
! Primary circuit: Preferred path
route-map SET-LOCALPREF-PRIMARY permit 10
set local-preference 200
! Secondary circuit: Backup path
route-map SET-LOCALPREF-SECONDARY permit 10
set local-preference 100