On-premises to on-premises:
Private network, Public internet, VPN
On-premises to Microsoft Azure:
Public internet, ExpressRoute (Microsoft peering)
Details
Azure Site Recovery (ASR) replicates data to an Azure storage account or managed disks, over a public endpoint. Thus protected data can only be replicated over the public internet with ExpressRoute (Microsoft peering). Replication over a site-to-site VPN isnt supported.
When failing back from Azure to VMware vSphere, data from Azure is copied back to the on-premises VM for whoch private access is required. This means for failback a VPN or ExpressRoute is required.