Establish connection to a VNET via an ExpressRoute circuit

{"type": "microsoft.network/networksecuritygroups", "apiversion": "2019-12-01", "name": "[parameters('backendnetworksecuritygroupname')]", "location": "[parameters('location')]", "dependson": ["[resourceid('microsoft.compute/proximityplacementgroups", parameters('proximityplacementgroupname'))]"], "properties": {}}{"type": "microsoft.network/networksecuritygroups", "apiversion": "2019-12-01", "name": "[parameters('midtiernetworksecuritygroupname')]", "location": "[parameters('location')]", "dependson": ["[resourceid('microsoft.compute/proximityplacementgroups", parameters('proximityplacementgroupname'))]"], "properties": {}}{"type": "microsoft.network/networksecuritygroups", "apiversion": "2019-12-01", "name": "[parameters('frontendnetworksecuritygroupname')]", "location": "[parameters('location')]", "dependson": ["[resourceid('microsoft.compute/proximityplacementgroups", parameters('proximityplacementgroupname'))]"], "properties": {"securityrules": [{"name": "allow_http_from_ip_or_range_forwebhttp", "type": "microsoft.network/networksecuritygroups/securityrules", "properties": {"protocol": "*", "sourceportrange": "*", "destinationportrange": "80", "sourceaddressprefix": "[parameters('allowfrontendconnectionfromiporcidrblock')]", "destinationaddressprefix": "*", "access": "allow", "priority": 500, "direction": "inbound"}}, {"name": "allow_ssh_from_ip_or_range_for_jumpboxssh", "type": "microsoft.network/networksecuritygroups/securityrules", "properties": {"protocol": "*", "sourceportrange": "*", "destinationportrange": "22", "sourceaddressprefix": "[parameters('allowfrontendconnectionfromiporcidrblock')]", "destinationaddressprefix": "*", "access": "allow", "priority": 510, "direction": "inbound"}}, {"name": "allow_https_from_ip_or_range_for_bastion", "type": "microsoft.network/networksecuritygroups/securityrules", "properties": {"protocol": "*", "sourceportrange": "*", "destinationportrange": "443", "sourceaddressprefix": "[parameters('allowfrontendconnectionfromiporcidrblock')]", "destinationaddressprefix": "*", "access": "allow", "priority": 520, "direction": "inbound"}}, {"name": "allow_ssh_to_vnet_for_bastion", "type": "microsoft.network/networksecuritygroups/securityrules", "properties": {"protocol": "*", "sourceportrange": "*", "destinationportrange": "22", "sourceaddressprefix": "*", "destinationaddressprefix": "virtualnetwork", "access": "allow", "priority": 530, "direction": "outbound"}}, {"name": "allow_rdp_to_vnet_for_bastion", "type": "microsoft.network/networksecuritygroups/securityrules", "properties": {"protocol": "*", "sourceportrange": "*", "destinationportrange": "3389", "sourceaddressprefix": "*", "destinationaddressprefix": "virtualnetwork", "access": "allow", "priority": 540, "direction": "outbound"}}, {"name": "allow_https_to_azurecloud_for_bastion", "type": "microsoft.network/networksecuritygroups/securityrules", "properties": {"protocol": "*", "sourceportrange": "*", "destinationportrange": "443", "sourceaddressprefix": "*", "destinationaddressprefix": "azurecloud", "access": "allow", "priority": 550, "direction": "outbound"}}, {"name": "allow_management_from_gateway_manager_for_appgateway", "type": "microsoft.network/networksecuritygroups/securityrules", "properties": {"protocol": "*", "sourceportrange": "*", "destinationportrange": "65200-65535", "sourceaddressprefix": "gatewaymanager", "destinationaddressprefix": "*", "access": "allow", "priority": 560, "direction": "inbound"}}, {"name": "allow_https_from_gateway_manager_for_appgateway", "type": "microsoft.network/networksecuritygroups/securityrules", "properties": {"protocol": "*", "sourceportrange": "*", "destinationportrange": "443", "sourceaddressprefix": "gatewaymanager", "destinationaddressprefix": "*", "access": "allow", "priority": 570, "direction": "inbound"}}]}}{"type": "microsoft.network/virtualnetworks", "apiversion": "2019-12-01", "name": "[parameters('virtualnetworkname')]", "location": "[parameters('location')]", "dependson": ["[resourceid('microsoft.network/networksecuritygroups", parameters('backendnetworksecuritygroupname'))]", "[resourceid('microsoft.network/networksecuritygroups", parameters('midtiernetworksecuritygroupname'))]", "[resourceid('microsoft.compute/proximityplacementgroups", parameters('proximityplacementgroupname'))]"], "properties": {"addressspace": {"addressprefixes": ["10.2.0.0/16"]}, "subnets": [{"name": "gatewaysubnet", "properties": {"addressprefix": "10.2.0.224/27"}}, {"name": "azurebastionsubnet", "properties": {"addressprefix": "10.2.0.192/27", "networksecuritygroup": {"id": "[resourceid('microsoft.network/networksecuritygroups", parameters('frontendnetworksecuritygroupname'))]"}}}, {"name": "frontendsubnet", "properties": {"addressprefix": "10.2.0.160/27", "networksecuritygroup": {"id": "[resourceid('microsoft.network/networksecuritygroups", parameters('frontendnetworksecuritygroupname'))]"}}}, {"name": "appgatewaysubnet", "properties": {"addressprefix": "10.2.0.128/27", "networksecuritygroup": {"id": "[resourceid('microsoft.network/networksecuritygroups", parameters('frontendnetworksecuritygroupname'))]"}}}, {"name": "backendsubnet", "properties": {"addressprefix": "10.2.1.0/24", "networksecuritygroup": {"id": "[resourceid('microsoft.network/networksecuritygroups", parameters('backendnetworksecuritygroupname'))]"}}}, {"name": "midtiersubnet", "properties": {"addressprefix": "10.2.0.0/28", "networksecuritygroup": {"id": "[resourceid('microsoft.network/networksecuritygroups", parameters('midtiernetworksecuritygroupname'))]"}}}]}}