/hybrid-cloud-networking

name: hybrid-cloud-networking
description: Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.

Hybrid Cloud Networking

Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, ExpressRoute, Interconnect, and FastConnect.

Purpose

Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP, OCI).

When to Use

• Connect on-premises to cloud
• Extend datacenter to cloud
• Implement hybrid active-active setups
• Meet compliance requirements
• Migrate to cloud gradually

Connection Options

AWS Connectivity

1. Site-to-Site VPN

• IPSec VPN over internet
• Up to 1.25 Gbps per tunnel
• Cost-effective for moderate bandwidth
• Higher latency, internet-dependent

resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "main-vpn-gateway"
  }
}

resource "aws_customer_gateway" "main" {
  bgp_asn    = 65000
  ip_address = "203.0.113.1"
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "main" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.main.id
  type                = "ipsec.1"
  static_routes_only  = false
}

2. AWS Direct Connect

• Dedicated network connection
• 1 Gbps to 100 Gbps
• Lower latency, consistent bandwidth
• More expensive, setup time required

**Reference:** See `references/direct-connect.md`

Azure Connectivity

1. Site-to-Site VPN

resource "azurerm_virtual_network_gateway" "vpn" {
  name                = "vpn-gateway"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "VpnGw1"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

2. Azure ExpressRoute

• Private connection via connectivity provider
• Up to 100 Gbps
• Low latency, high reliability
• Premium for global connectivity

GCP Connectivity

1. Cloud VPN

• IPSec VPN (Classic or HA VPN)
• HA VPN: 99.99% SLA
• Up to 3 Gbps per tunnel

2. Cloud Interconnect

• Dedicated (10 Gbps, 100 Gbps)
• Partner (50 Mbps to 50 Gbps)
• Lower latency than VPN

OCI Connectivity

1. IPSec VPN Connect

• IPSec VPN with redundant tunnels
• Dynamic routing through DRG
• Good fit for branch offices and migration phases

2. OCI FastConnect

• Private dedicated connectivity through Oracle or partner edge
• Suitable for predictable throughput and lower-latency hybrid traffic
• Commonly paired with DRG for hub-and-spoke designs

Hybrid Network Patterns

Pattern 1: Hub-and-Spoke

On-Premises Datacenter
         ↓
    VPN/Direct Connect
         ↓
    Transit Gateway (AWS) / vWAN (Azure)
         ↓
    ├─ Production VPC/VNet
    ├─ Staging VPC/VNet
    └─ Development VPC/VNet

Pattern 2: Multi-Region Hybrid

On-Premises
    ├─ Direct Connect → us-east-1
    └─ Direct Connect → us-west-2
            ↓
        Cross-Region Peering

Pattern 3: Multi-Cloud Hybrid

On-Premises Datacenter
    ├─ Direct Connect → AWS
    ├─ ExpressRoute → Azure
    ├─ Interconnect → GCP
    └─ FastConnect → OCI

Routing Configuration

BGP Configuration

On-Premises Router:
- AS Number: 65000
- Advertise: 10.0.0.0/8

Cloud Router:
- AS Number: 64512 (AWS), 65515 (Azure), provider-assigned for GCP/OCI
- Advertise: Cloud VPC/VNet CIDRs

Route Propagation

• Enable route propagation on route tables
• Use BGP for dynamic routing
• Implement route filtering
• Monitor route advertisements

Security Best Practices

1. **Use private connectivity** (Direct Connect/ExpressRoute/Interconnect/FastConnect) 2. **Implement encryption** for VPN tunnels 3. **Use VPC endpoints** to avoid internet routing 4. **Configure network ACLs** and security groups 5. **Enable VPC Flow Logs** for monitoring 6. **Implement DDoS protection** 7. **Use PrivateLink/Private Endpoints** 8. **Monitor connections** with CloudWatch/Azure Monitor/Cloud Monitoring/OCI Monitoring 9. **Implement redundancy** (dual tunnels) 10. **Regular security audits**

High Availability

Dual VPN Tunnels

resource "aws_vpn_connection" "primary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.primary.id
  type                = "ipsec.1"
}

resource "aws_vpn_connection" "secondary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.secondary.id
  type                = "ipsec.1"
}

Active-Active Configuration

• Multiple connections from different locations
• BGP for automatic failover
• Equal-cost multi-path (ECMP) routing
• Monitor health of all connections

Monitoring and Troubleshooting

Key Metrics

• Tunnel status (up/down)
• Bytes in/out
• Packet loss
• Latency
• BGP session status

Troubleshooting

# AWS VPN
aws ec2 describe-vpn-connections
aws ec2 get-vpn-connection-telemetry

# Azure VPN
az network vpn-connection show
az network vpn-connection show-device-config-script

# OCI IPSec VPN
oci network ip-sec-connection list
oci network cpe list

Cost Optimization

1. **Right-size connections** based on traffic 2. **Use VPN for low-bandwidth** workloads 3. **Consolidate traffic** through fewer connections 4. **Minimize data transfer** costs 5. **Use dedicated private links** for high bandwidth 6. **Implement caching** to reduce traffic

Related Skills

• `multi-cloud-architecture` - For architectur