Hybrid Cloud Networking

Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, ExpressRoute, Interconnect, and FastConnect.

Purpose

Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP, OCI).

When to Use

• Connect on-premises to cloud
• Extend datacenter to cloud
• Implement hybrid active-active setups
• Meet compliance requirements
• Migrate to cloud gradually

Connection Options

AWS Connectivity

1. Site-to-Site VPN

• IPSec VPN over internet
• Up to 1.25 Gbps per tunnel
• Cost-effective for moderate bandwidth
• Higher latency, internet-dependent

resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "main-vpn-gateway"
  }
}

resource "aws_customer_gateway" "main" {
  bgp_asn    = 65000
  ip_address = "203.0.113.1"
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "main" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.main.id
  type                = "ipsec.1"
  static_routes_only  = false
}

2. AWS Direct Connect

• Dedicated network connection
• 1 Gbps to 100 Gbps
• Lower latency, consistent bandwidth
• More expensive, setup time required

Reference: See references/direct-connect.md

Azure Connectivity

1. Site-to-Site VPN

resource "azurerm_virtual_network_gateway" "vpn" {
  name                = "vpn-gateway"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "VpnGw1"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

2. Azure ExpressRoute

• Private connection via connectivity provider
• Up to 100 Gbps
• Low latency, high reliability
• Premium for global connectivity

GCP Connectivity

1. Cloud VPN

• IPSec VPN (Classic or HA VPN)
• HA VPN: 99.99% SLA
• Up to 3 Gbps per tunnel

2. Cloud Interconnect

• Dedicated (10 Gbps, 100 Gbps)
• Partner (50 Mbps to 50 Gbps)
• Lower latency than VPN

OCI Connectivity

1. IPSec VPN Connect

• IPSec VPN with redundant tunnels
• Dynamic routing through DRG
• Good fit for branch offices and migration phases

2. OCI FastConnect

• Private dedicated connectivity through Oracle or partner edge
• Suitable for predictable throughput and lower-latency hybrid traffic
• Commonly paired with DRG for hub-and-spoke designs

Hybrid Network Patterns

Pattern 1: Hub-and-Spoke

On-Premises Datacenter
         ↓
    VPN/Direct Connect
         ↓
    Transit Gateway (AWS) / vWAN (Azure)
         ↓
    ├─ Production VPC/VNet
    ├─ Staging VPC/VNet
    └─ Development VPC/VNet

Pattern 2: Multi-Region Hybrid

On-Premises
    ├─ Direct Connect → us-east-1
    └─ Direct Connect → us-west-2
            ↓
        Cross-Region Peering

Pattern 3: Multi-Cloud Hybrid

On-Premises Datacenter
    ├─ Direct Connect → AWS
    ├─ ExpressRoute → Azure
    ├─ Interconnect → GCP
    └─ FastConnect → OCI

Routing Configuration

BGP Configuration

On-Premises Router:
- AS Number: 65000
- Advertise: 10.0.0.0/8

Cloud Router:
- AS Number: 64512 (AWS), 65515 (Azure), provider-assigned for GCP/OCI
- Advertise: Cloud VPC/VNet CIDRs

Route Propagation

• Enable route propagation on route tables
• Use BGP for dynamic routing
• Implement route filtering
• Monitor route advertisements

Security Best Practices

1. Use private connectivity (Direct Connect/ExpressRoute/Interconnect/FastConnect)
2. Implement encryption for VPN tunnels
3. Use VPC endpoints to avoid internet routing
4. Configure network ACLs and security groups
5. Enable VPC Flow Logs for monitoring
6. Implement DDoS protection
7. Use PrivateLink/Private Endpoints
8. Monitor connections with CloudWatch/Azure Monitor/Cloud Monitoring/OCI Monitoring
9. Implement redundancy (dual tunnels)
10. Regular security audits

High Availability

Dual VPN Tunnels

resource "aws_vpn_connection" "primary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.primary.id

…