How to Establish a Private Connection Between Vultr and Azure Using Direct Connect via Megaport

Establish a secure, low-latency Vultr–Azure private connection using Direct Connect and Megaport.

Vultr Direct Connect allows you to establish a dedicated, private network connection between your Vultr infrastructure and external environments, including public cloud providers. This connection bypasses the public internet to deliver predictable performance, enhanced security, and low, consistent latency. It is well suited for hybrid cloud architectures, high-throughput workloads, and latency-sensitive applications.

This guide outlines the process of creating a private, low-latency connection between Vultr and Microsoft Azure using Direct Connect hosted through Megaport. It covers provisioning a dedicated Megaport port, creating a Virtual Cross Connect (VXC), configuring Azure ExpressRoute private peering, attaching the Azure ExpressRoute connection to Vultr Direct Connect, and validating end-to-end connectivity.

Prerequisites

Before you begin, ensure you:

Have access to the Megaport Portal with sufficient permissions to create a port and a Virtual Cross Connect (VXC).
Have access to the Microsoft Azure Portal with permissions to create and manage an ExpressRoute circuit and private peering.
Have access to the Vultr Customer Portal to create and manage Direct Connect and related networking resources.
Have Border Gateway Protocol (BGP) enabled on your Vultr account.
Understand VLAN configuration, Autonomous System Numbers (ASNs), and basic BGP routing concepts.

Gather Information About the Vultr Datacenter

Vultr operates multiple datacenters worldwide that you can use to establish a private connection to Microsoft Azure. This section documents how to gather the required Vultr datacenter information before provisioning connectivity through Megaport.

Note

Megaport does not support all Vultr datacenter locations. Before you proceed, contact Vultr Support to confirm Megaport availability for your preferred region.

Log in to the Vultr Customer Portal.
Select Support from the left navigation menu.
Click Open Ticket to create a new support request.
From the available options, toggle the last option to display all fields.
Under Category, select General Support.

Use the below template to open a support ticket to request the Vultr Direct Connect setup.

text

Subject: Request to Set Up Vultr Direct Connect Hosted via Megaport Partner ([REGION] Region)

Hello Vultr Team,

I would like to set up a Hosted via Partner Direct Connect connection using Megaport.
I plan to connect the X-REGION Vultr datacenter to the Y-REGION Microsoft Azure region using ExpressRoute.

Please share the required details to create a Megaport port for this location and let me know
what information you need from my side to proceed with the connection.

Thank you for your assistance.

Best regards,
[Your Name]

Note

Vultr Support Team generally responds within 24 business hours.

Vultr Support provides supported datacenter locations, Megaport availability, and the information required to provision the port. After the port is created, they may request additional details such as VLAN configuration, bandwidth requirements, and primary contact information to complete the Direct Connect setup.

Request a Dedicated Port from Megaport

After you receive the Vultr datacenter details for the region where you plan to establish the connection, request a dedicated port from Megaport. This port serves as the physical entry point for the private connection between Vultr and Microsoft Azure via ExpressRoute.

Log in to your Megaport Portal.
Navigate to Services and click Create Port.
Search for the Vultr datacenter location provided by Vultr Support.
Select the required port speed (1G, 10G, or 100G) based on your bandwidth needs.
Enter a Port Name and select a Minimum Term.
(Optional) Configure Port Diversity to improve availability and resiliency.

Note

Port Diversity provisions two physically diverse ports, commonly referred to as RED and BLUE. Each port uses separate infrastructure paths. If one diversity path experiences an issue, the other remains operational, providing high availability (HA).
Click Add Tags to apply resource tags, then click Next.
Click Add Port, review the order under Configured Services in the left navigation pane, click Review Order, and submit the request.

Note

Port provisioning typically takes 12 to 48 hours to complete.
After Megaport provisions the port and marks it as Active, download the Letter of Authorization (LOA) and share it with the Vultr Support team so they can complete the physical cross-connect between the Megaport port and the Vultr rack. Provide the following details with the LOA:
- The VPC UUID or Instance UUID where Vultr attaches the Direct Connect.
- The VLAN ID configured on the Megaport port.
Note

Ensure that at least one instance is running in the VPC whose UUID you provide. Vultr assigns a VXLAN ID only when an active instance exists. Keep at least one instance running in the VPC at all times to preserve the VXLAN ID. If all instances in the VPC are deleted, the VXLAN ID is released, the Direct Connect becomes inactive, and Vultr must reconfigure the connection for new instances.

Create an Azure ExpressRoute Circuit

An ExpressRoute circuit represents the private connectivity link between Microsoft Azure and your connectivity provider. The circuit is later connected to Megaport, which delivers the Layer 2 connection to Vultr.

Log in to the Microsoft Azure Portal.
In the search bar, type ExpressRoute, then select ExpressRoute circuits.
Click + Create.
On the Configuration tab, configure the following settings:
Project details:
- Subscription: Select the Azure subscription to use.
- Resource group: Select an existing resource group or click Create new.
Resiliency:
- Maximum resiliency (Recommended): Resiliency across two or more distinct edge locations, each with redundant physical links.
- High resiliency: Metro model offering resiliency across distinct edge locations, each with a single physical link.
- Standard resiliency: Physical link redundancy within one edge location only.
Note

Select the resiliency level based on availability requirements and budget. Maximum resiliency provides the highest fault tolerance, while Standard resiliency is suitable for non-critical or development workloads.

ExpressRoute circuit:
- Region: Select the Azure region where the ExpressRoute circuit is created.
- Circuit name: Enter a descriptive name for the ExpressRoute circuit.
- Port type: Select Provider.
- Peering location: Select the Azure peering location that corresponds to the Megaport location connected to the Vultr datacenter.
- Provider: Select Megaport.
- Bandwidth: Select the required bandwidth for the ExpressRoute circuit.
Note

Downgrading the circuit bandwidth is not supported after provisioning. Select a bandwidth that matches your expected traffic requirements. Sustained overutilization can cause packet loss and performance degradation.
- SKU:
  - Local: Limits routing to the local Azure region.
  - Standard: Enables regional and global connectivity through Azure ExpressRoute.
  - Premium: Enables global connectivity and additional route limits.
- Billing model:
  - Metered: Charges outbound data transfer at a pre-determined rate.
  - Unlimited: Includes outbound data transfer for a fixed monthly fee.
  Note
  
  Downgrading from Unlimited to Metered is not supported after the circuit is created.
Click Next, then enable alert rules to receive notifications when the connection degrades.
Click Next, add any required tags, and then click Review + create.
After validation completes successfully, click Create to provision the ExpressRoute circuit.

Note

ExpressRoute circuit provisioning can take up to 10 minutes.

Configure and Connect the Megaport Port to the Azure ExpressRoute Circuit

A Virtual Cross Connect (VXC) links the Megaport port to the Azure ExpressRoute circuit and provides the Layer 2 path required for private connectivity. This connection allows traffic to flow directly between Microsoft Azure and the Vultr Direct Connect attachment without traversing the public internet.

In the Megaport Portal, navigate to Services and select the port created in the previous section.
Click + Connection, then choose Cloud as the connection type.
From the list of providers, select Microsoft Azure.
Paste the Service Key in the Microsoft Azure Service Key field.
From the available Azure ports for the selected location, choose the port that matches your Megaport port diversity (RED or BLUE), then click Next.
Enter a descriptive Connection Name to identify the VXC.
Select the required Rate Limit (bandwidth). Ensure this value matches the bandwidth configured on the ExpressRoute circuit.
Configure the VLAN ID to segment the connection traffic.
Select a Minimum Term. Longer commitment terms typically reduce costs.
Under Azure peering VLAN, enable Configure single Azure peering VLAN, then enter the same VLAN ID used for the VXC.

Note

Q-in-Q VLAN tagging is required when connecting to Azure ExpressRoute using Megaport. If your equipment does not support Q-in-Q, enable Configure single Azure peering VLAN to use a single-tag VLAN model. This configuration applies the same VLAN ID to both the port VLAN (A-End) and the Azure peer VLAN (B-End). When using a single Azure peering VLAN, only one peering type (either Private peering or Microsoft peering) is supported per VXC. To use both peering types, provision separate VXCs.
Click Next, review the configuration and pricing, then click Add VXC to create the Virtual Cross Connect.
Review the order under the Configured Services section in the left navigation pane and submit the order.

Note

Megaport typically completes VXC provisioning within 10–30 minutes. When provisioning completes, the Provider status changes to Provisioned, indicating that Azure has accepted the Service Key and the Layer 2 connection between Megaport and the ExpressRoute circuit is active.

Configure Azure ExpressRoute Private Peering

Azure ExpressRoute peerings define how traffic is routed over the private connection. For connectivity between Azure and Vultr, configure Private peering, which enables Layer 3 routing using Border Gateway Protocol (BGP) over the ExpressRoute circuit.

In the Microsoft Azure Portal, navigate to ExpressRoute circuits.
Select the ExpressRoute circuit created earlier.
In the left navigation pane, click Settings.
Select Peerings, then choose Azure private.
Configure the following private peering settings:
- Peer ASN: Enter the Vultr customer ASN provided by Vultr Support (for example, 64515).
- Subnets: Select Both if you plan to configure IPv4 and IPv6. Otherwise, select IPv4 or IPv6 based on your requirements.
- IPv4 primary subnet: Enter an IPv4 /30 subnet for BGP peering (example: 169.254.100.12/30).
- IPv4 secondary subnet: Enter a different IPv4 /30 subnet for BGP peering (example: 169.254.100.24/30).
- IPv6 primary subnet: Enter an IPv6 /126 subnet if IPv6 peering is enabled.
- IPv6 secondary subnet: Enter a different IPv6 /126 subnet if IPv6 peering is enabled.
- VLAN ID: Enter the same VLAN ID configured on the Megaport VXC.
- Shared key: Leave this field blank.
Click Save to apply the private peering configuration.

Note

Azure may take 5–10 minutes to complete the peering configuration.
After the peering is created, verify that the Status for Azure private shows Enabled.

Configure BGP Routing Between Vultr and Azure

Vultr automatically establishes the Border Gateway Protocol (BGP) session once the correct peer IP address is assigned to the instance. No manual BGP daemon configuration is required on the Vultr instance.

In the Microsoft Azure Portal, open the ExpressRoute circuit.
Select Peerings, then open Azure private.
Click View route table summary.
Note the following values:
- Neighbor Primary IP
- Neighbor Secondary IP
These values represent the IP addresses assigned to the ExpressRoute peering interfaces.
In the Vultr Customer Portal, deploy an Ubuntu-based instance in the VPC attached to Direct Connect.
Connect to the instance using SSH.
console
```
$ ssh USERNAME@SERVER-IP
```
Replace USERNAME and SERVER-IP with your actual values.
Identify the network interface connected to the Vultr VPC.
console
```
$ ip addr
```
Assign the Neighbor Primary IP address to the VPC interface.
console
```
$ sudo ip addr add NEIGHBOR-IP/30 dev INTERFACE-NAME
```
From the /30 subnet, assign the customer-side IP to the Vultr interface. Do not assign the Microsoft router IP.

Replace:
- NEIGHBOR-IP with the Neighbor Primary IP from the Azure route table summary.
- INTERFACE-NAME with your actual network interface name (for example, enp8s0).
Repeat this step for the Neighbor Secondary IP if your circuit uses multiple links.

Note

When Standard resiliency is configured, Azure provisions a single physical link. In this case, only the primary subnet and Neighbor Primary IP are available.
Verify that the IP address is assigned successfully.
console
```
$ ip addr show INTERFACE-NAME
```
In the ExpressRoute peering view, open ARP records.
Identify the IP address associated with the Microsoft interface.
Test connectivity by pinging the Microsoft router IP. Replace MICROSOFT-IP with the IP address labeled Microsoft in the Azure ARP records.
console
```
$ ping MICROSOFT-IP
```
Output:
```
64 bytes from MICROSOFT-IP: icmp_seq=1 ttl=64 time=273 ms
64 bytes from MICROSOFT-IP: icmp_seq=2 ttl=64 time=273 ms
64 bytes from MICROSOFT-IP: icmp_seq=3 ttl=64 time=273 ms
```
Successful replies confirm that the Vultr instance can exchange traffic with Azure over the private ExpressRoute connection.

Note

This IP assignment is temporary and resets after a reboot. To make it persistent, update the corresponding Netplan file in /etc/netplan and add the IP under the interface addresses list. Refer to this guide for detailed instructions on assigning multiple IPs to a network interface.

Conclusion

You have successfully established a private network connection between Vultr and Microsoft Azure using Azure ExpressRoute hosted through Megaport. This setup provisions a dedicated Layer 2 path, configures Azure ExpressRoute private peering, and enables BGP routing for secure, low-latency communication between both environments. The connection bypasses the public internet and provides predictable performance suitable for hybrid cloud architectures and latency-sensitive workloads

Cobra Softwares Blog