Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.
Add this skill
npx mdskills install sickn33/hybrid-cloud-networkingComprehensive multi-cloud networking guide with detailed examples and architecture patterns
1---2name: hybrid-cloud-networking3description: Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.4---56# Hybrid Cloud Networking78Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, and ExpressRoute.910## Do not use this skill when1112- The task is unrelated to hybrid cloud networking13- You need a different domain or tool outside this scope1415## Instructions1617- Clarify goals, constraints, and required inputs.18- Apply relevant best practices and validate outcomes.19- Provide actionable steps and verification.20- If detailed examples are required, open `resources/implementation-playbook.md`.2122## Purpose2324Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP).2526## Use this skill when2728- Connect on-premises to cloud29- Extend datacenter to cloud30- Implement hybrid active-active setups31- Meet compliance requirements32- Migrate to cloud gradually3334## Connection Options3536### AWS Connectivity3738#### 1. Site-to-Site VPN39- IPSec VPN over internet40- Up to 1.25 Gbps per tunnel41- Cost-effective for moderate bandwidth42- Higher latency, internet-dependent4344```hcl45resource "aws_vpn_gateway" "main" {46 vpc_id = aws_vpc.main.id47 tags = {48 Name = "main-vpn-gateway"49 }50}5152resource "aws_customer_gateway" "main" {53 bgp_asn = 6500054 ip_address = "203.0.113.1"55 type = "ipsec.1"56}5758resource "aws_vpn_connection" "main" {59 vpn_gateway_id = aws_vpn_gateway.main.id60 customer_gateway_id = aws_customer_gateway.main.id61 type = "ipsec.1"62 static_routes_only = false63}64```6566#### 2. AWS Direct Connect67- Dedicated network connection68- 1 Gbps to 100 Gbps69- Lower latency, consistent bandwidth70- More expensive, setup time required7172**Reference:** See `references/direct-connect.md`7374### Azure Connectivity7576#### 1. Site-to-Site VPN77```hcl78resource "azurerm_virtual_network_gateway" "vpn" {79 name = "vpn-gateway"80 location = azurerm_resource_group.main.location81 resource_group_name = azurerm_resource_group.main.name8283 type = "Vpn"84 vpn_type = "RouteBased"85 sku = "VpnGw1"8687 ip_configuration {88 name = "vnetGatewayConfig"89 public_ip_address_id = azurerm_public_ip.vpn.id90 private_ip_address_allocation = "Dynamic"91 subnet_id = azurerm_subnet.gateway.id92 }93}94```9596#### 2. Azure ExpressRoute97- Private connection via connectivity provider98- Up to 100 Gbps99- Low latency, high reliability100- Premium for global connectivity101102### GCP Connectivity103104#### 1. Cloud VPN105- IPSec VPN (Classic or HA VPN)106- HA VPN: 99.99% SLA107- Up to 3 Gbps per tunnel108109#### 2. Cloud Interconnect110- Dedicated (10 Gbps, 100 Gbps)111- Partner (50 Mbps to 50 Gbps)112- Lower latency than VPN113114## Hybrid Network Patterns115116### Pattern 1: Hub-and-Spoke117```118On-Premises Datacenter119 ↓120 VPN/Direct Connect121 ↓122 Transit Gateway (AWS) / vWAN (Azure)123 ↓124 ├─ Production VPC/VNet125 ├─ Staging VPC/VNet126 └─ Development VPC/VNet127```128129### Pattern 2: Multi-Region Hybrid130```131On-Premises132 ├─ Direct Connect → us-east-1133 └─ Direct Connect → us-west-2134 ↓135 Cross-Region Peering136```137138### Pattern 3: Multi-Cloud Hybrid139```140On-Premises Datacenter141 ├─ Direct Connect → AWS142 ├─ ExpressRoute → Azure143 └─ Interconnect → GCP144```145146## Routing Configuration147148### BGP Configuration149```150On-Premises Router:151- AS Number: 65000152- Advertise: 10.0.0.0/8153154Cloud Router:155- AS Number: 64512 (AWS), 65515 (Azure)156- Advertise: Cloud VPC/VNet CIDRs157```158159### Route Propagation160- Enable route propagation on route tables161- Use BGP for dynamic routing162- Implement route filtering163- Monitor route advertisements164165## Security Best Practices1661671. **Use private connectivity** (Direct Connect/ExpressRoute)1682. **Implement encryption** for VPN tunnels1693. **Use VPC endpoints** to avoid internet routing1704. **Configure network ACLs** and security groups1715. **Enable VPC Flow Logs** for monitoring1726. **Implement DDoS protection**1737. **Use PrivateLink/Private Endpoints**1748. **Monitor connections** with CloudWatch/Monitor1759. **Implement redundancy** (dual tunnels)17610. **Regular security audits**177178## High Availability179180### Dual VPN Tunnels181```hcl182resource "aws_vpn_connection" "primary" {183 vpn_gateway_id = aws_vpn_gateway.main.id184 customer_gateway_id = aws_customer_gateway.primary.id185 type = "ipsec.1"186}187188resource "aws_vpn_connection" "secondary" {189 vpn_gateway_id = aws_vpn_gateway.main.id190 customer_gateway_id = aws_customer_gateway.secondary.id191 type = "ipsec.1"192}193```194195### Active-Active Configuration196- Multiple connections from different locations197- BGP for automatic failover198- Equal-cost multi-path (ECMP) routing199- Monitor health of all connections200201## Monitoring and Troubleshooting202203### Key Metrics204- Tunnel status (up/down)205- Bytes in/out206- Packet loss207- Latency208- BGP session status209210### Troubleshooting211```bash212# AWS VPN213aws ec2 describe-vpn-connections214aws ec2 get-vpn-connection-telemetry215216# Azure VPN217az network vpn-connection show218az network vpn-connection show-device-config-script219```220221## Cost Optimization2222231. **Right-size connections** based on traffic2242. **Use VPN for low-bandwidth** workloads2253. **Consolidate traffic** through fewer connections2264. **Minimize data transfer** costs2275. **Use Direct Connect** for high bandwidth2286. **Implement caching** to reduce traffic229230## Reference Files231232- `references/vpn-setup.md` - VPN configuration guide233- `references/direct-connect.md` - Direct Connect setup234235## Related Skills236237- `multi-cloud-architecture` - For architecture decisions238- `terraform-module-library` - For IaC implementation239
Full transparency — inspect the skill content before installing.