Hybrid Cloud Networking

# Hybrid Cloud Networking

Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, and ExpressRoute.

Do not use this skill when

- The task is unrelated to hybrid cloud networking

- You need a different domain or tool outside this scope

Instructions

- Clarify goals, constraints, and required inputs.

- Apply relevant best practices and validate outcomes.

- Provide actionable steps and verification.

- If detailed examples are required, open `resources/implementation-playbook.md`.

Purpose

Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP).

Use this skill when

- Connect on-premises to cloud

- Extend datacenter to cloud

- Implement hybrid active-active setups

- Meet compliance requirements

- Migrate to cloud gradually

Connection Options

AWS Connectivity

#### 1. Site-to-Site VPN

- IPSec VPN over internet

- Up to 1.25 Gbps per tunnel

- Cost-effective for moderate bandwidth

- Higher latency, internet-dependent

resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "main-vpn-gateway"
  }
}

resource "aws_customer_gateway" "main" {
  bgp_asn    = 65000
  ip_address = "203.0.113.1"
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "main" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.main.id
  type                = "ipsec.1"
  static_routes_only  = false
}

#### 2. AWS Direct Connect

- Dedicated network connection

- 1 Gbps to 100 Gbps

- Lower latency, consistent bandwidth

- More expensive, setup time required

**Reference:** See `references/direct-connect.md`

Azure Connectivity

#### 1. Site-to-Site VPN

resource "azurerm_virtual_network_gateway" "vpn" {
  name                = "vpn-gateway"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "VpnGw1"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

#### 2. Azure ExpressRoute

- Private connection via connectivity provider

- Up to 100 Gbps

- Low latency, high reliability

- Premium for global connectivity

GCP Connectivity

#### 1. Cloud VPN

- IPSec VPN (Classic or HA VPN)

- HA VPN: 99.99% SLA

- Up to 3 Gbps per tunnel

#### 2. Cloud Interconnect

- Dedicated (10 Gbps, 100 Gbps)

- Partner (50 Mbps to 50 Gbps)

- Lower latency than VPN

Hybrid Network Patterns

Pattern 1: Hub-and-Spoke

On-Premises Datacenter
         ↓
    VPN/Direct Connect
         ↓
    Transit Gateway (AWS) / vWAN (Azure)
         ↓
    ├─ Production VPC/VNet
    ├─ Staging VPC/VNet
    └─ Development VPC/VNet

Pattern 2: Multi-Region Hybrid

On-Premises
    ├─ Direct Connect → us-east-1
    └─ Direct Connect → us-west-2
            ↓
        Cross-Region Peering

Pattern 3: Multi-Cloud Hybrid

On-Premises Datacenter
    ├─ Direct Connect → AWS
    ├─ ExpressRoute → Azure
    └─ Interconnect → GCP

Routing Configuration

BGP Configuration

On-Premises Router:
- AS Number: 65000
- Advertise: 10.0.0.0/8

Cloud Router:
- AS Number: 64512 (AWS), 65515 (Azure)
- Advertise: Cloud VPC/VNet CIDRs

Route Propagation

- Enable route propagation on route tables

- Use BGP for dynamic routing

- Implement route filtering

- Monitor route advertisements

Security Best Practices

1. **Use private connectivity** (Direct Connect/ExpressRoute)

2. **Implement encryption** for VPN tunnels

3. **Use VPC endpoints** to avoid internet routing

4. **Configure network ACLs** and security groups

5. **Enable VPC Flow Logs** for monitoring

6. **Implement DDoS protection**

7. **Use PrivateLink/Private En