Please check the common activation start step.

New Private IP VPN

For customer provided Network Address Translation (NAT) the main Verizon SCI Welcome Kit advises to use a new Private IP VPN for example “B” (it can be any name).

Note: You can verify in Verizon Dynamic Network Manager portal “VPN” menu to which Private IP VPN your SCI Customer Connection is connected. In case it shows the wrong Private IP VPN ask your Verizon Account Team to re-connect it to your Private IP VPN “B”.

The Private IP VPN “B” provides the transport of the Microsoft public peering traffic to your on-premise Network Address Translation (NAT) device.

Multi VRF

In case your on-premise NAT device functions as a NAT router between to Private IP VPNs like the VPN “B” and an existing VPN “A” then use Multi VRF on the access circuit from Private IP to the on-premise NAT device.

Routes to Microsoft

For customer provided NAT you will need to advertise your own registered IP address ranges (called “prefixes”) from your on-premise NAT device into Private IP VPN “B”. The address ranges need to be entered in your SCI Customer Connection “Advertised Prefix” list. The list is part of your Microsoft ExpressRoute circuit configuration and functions as an allowed prefix list filter on Microsoft side.

Validation

You can check the Microsoft validation status of the prefix list by pressing the “View Connection Details” on your SCI Customer Connection. You can also verify the status in your Azure Account. In case it shows “Configured” all prefixes are validated by Microsoft. In case it shows “Validation Needed” then one or more prefixes still require validation. You then open a ticket with Microsoft to validate your first or added prefix(es). As long as a specific prefix is not validated the prefix will not be accepted by your ExpressRoute circuit.

Before activating the SCI Customer Connection for Azure ExpressRoute Microsoft peering, please read the online Microsoft documentation about “how to configure route filters for Microsoft peering”.

In the Azure portal you will need to create route filters and add your ExpressRoute circuit to the specific route filter. Make sure you first activate your SCI customer connection as it configures the required Microsoft peering. Because only ExpressRoute circuits with Microsoft peering configured can be added to a filter.

Note: To attach specific route filters with Microsoft 365 services you must request Microsoft authorization. Please read the online Microsoft documentation about “Azure ExpressRoute for Microsoft 365” or contact your Microsoft account team.

Maximum routes

Each Azure specific route filter will add routing prefixes to your Private IP VPN “B”. When the total amount of your existing routing prefixes plus the extra received Microsoft services routing prefixes exceeds your Private IP VPN “B” maximum routes then you need to contact your Verizon Account Team for a Private IP VPN “B” maximum routes upgrade.

Your Private IP VPN “B” by default is limited to 1250 routing prefixes. You can check the current limit in the SCI Customer Connection Dynamic Network Manager portal “Network Settings” menu.

With the help of the “Diagnostics” menu and router command “show ip route vrf” you can check your current amount of routing prefixes.

The Microsoft services routing prefixes will be distributed into your Private IP VPN “B” connected locations like your on-premise Network Address Translation device. Which enables the locations to initiate network traffic towards Microsoft services.

The SCI Customer Connection provides a “Click to Establish Connection” button. By pressing the button, the activation screen pops up.

In the below Activation screen enter your ExpressRoute circuit Service Key in the Microsoft Service Key field.Enter as well your registered IP address ranges (prefixes) with Microsoft in the “Advertised Prefix” list. In this optional step, enter as well your registered IP address ranges (prefixes) with Microsoft in the “Advertised Prefix”.

The validation process checks if your ExpressRoute circuit Service Key can be used in combination with your SCI Customer Connection. It compares the available Verizon ExpressRoute network interfaces with your ExpressRoute circuit network interfaces.

1. In case there is no network interface match in the peering location you have entered an ExpressRoute circuit Service Key from a different location. Please read the “Preparation” section to provide an ExpressRoute circuit in your SCI Customer Connection partner location.
2. In case there is a network interface mismatch but the interfaces exist in the peering location you need to press the “Confirm” button to update your SCI Customer Connection.
3. In case there is a Microsoft service provider VLAN identifier mismatch you need to press the “Confirm” button to update your SCI Customer Connection.

When you press the “Confirm Activation” button the Microsoft peering part of the ExpressRoute circuit in Azure will be configured according to the SCI Customer Connection details.

Note: The process sets the ExpressRoute circuit Provider status to “Provisioned” and configures the Azure Microsoft peering BGP configuration.

You can close the Activation screen to return to the SCI Customer Connection. The Microsoft Status will show your ExpressRoute circuit Provider status “Provisioned”. You can press the “BGP Status” button to confirm that both Primary and Secondary BGP states are “Up”.

You can press the “View Connection Details” to verify the Microsoft validation status of your “Advertised Prefix” list and modify the list when needed.

For a correct working connection, you need to have the prefix list in state “Configured” and have the prefixes advertised by BGP. This can be verified by using the diagnostic command “advertised-routes” in your SCI Customer Connection “Diagnostics” menu.

The peering information will show for Microsoft the Status “Provisioned” with the IP /30 subnets of your Secure Cloud Interconnect Customer Connection.

Note: You can now start adding the ExpressRoute circuit to your created ExpressRoute route filters. Only then your SCI Customer Connection will receive Microsoft service routing prefixes.

Please check the common activation end step.