Learn Cloud Computing - Hybrid Cloud & Multi-Cloud Connectivity

#Introduction

In episode 17 we discussed FinOps — how to keep cloud costs efficient and under control. But there's a fundamental question we haven't answered: what if your company isn't one hundred percent in the cloud yet? Many real-world organizations still have on-premise data centers: legacy servers running ERP systems, databases that regulations require to stay in specific locations, or applications too expensive and risky to move all at once.

Industry reality is never "all or nothing". Almost every large company operates in hybrid cloud mode — some workloads in the cloud, some still in their own data center — and more and more choose multi-cloud — using two or more cloud providers at once. If each part of the system runs in a different place, what brings them all to life is connectivity: the bridge connecting your data center to the VPC in the cloud.

In this episode we'll discuss the two major families of hybrid connectivity: IPsec Site-to-Site VPN, which is encrypted but travels over the public internet, and dedicated private connections, which use private fiber paths without touching the internet. We'll close with a comparison of connectivity services on AWS, GCP, and Azure.

#Why Hybrid Cloud & Multi-Cloud Are Needed

Before diving into the technical side, understand the business reasons first. There are three main drivers:

Gradual migration. Moving thousands of servers in one night is an operational nightmare. The realistic path is shifting workloads gradually while the old systems keep running and serving users. During that transition, the two worlds must be securely connected.

Compliance and regulation. Payment card data, medical records, or government data is often required to remain in specific geographic locations. Cloud regions can be far from the location regulations require; your on-premise data center can be the only qualifying place for certain data.

Resilience and vendor independence. Placing all infrastructure with one provider means one outage at that provider stops everything. Multi-cloud also gives bargaining power in price negotiations and lets you leverage each provider's strengths. The consequences are more complex, but for critical workloads many companies are willing to pay it.

#Two Families of Hybrid Connectivity

All hybrid connectivity solutions essentially fall into two families: going over the public internet with encryption, or using a dedicated private path that never touches the internet.

#IPsec Site-to-Site VPN

IPsec Site-to-Site VPN builds an encrypted tunnel between the VPN device in your data center (an on-premise router or firewall) and a VPN gateway in the cloud, over the public internet.

The most fitting analogy: the internet is a busy public highway that can be intercepted. IPsec is a private tunnel built through that highway. From the outside, people can still see vehicles entering and leaving the highway — but the contents and direction of travel are sealed inside a tunnel that only the two ends holding the same keys can open. The advantages are real: cheap, fast to set up (hours to days), and all traffic is automatically encrypted by the protocol. The drawbacks are clear too: traffic still uses public internet infrastructure, so latency isn't guaranteed and bandwidth is limited by the quality of your office internet connection.

IPsec works in two phases. The concept matters because all VPN devices — StrongSwan, Cisco firewalls, even cloud VPN gateways — use exactly the same parameters:

On AWS, a VPN gateway is created through the AWS Site-to-Site VPN service. The following CLI command creates a VPN connection linking the customer gateway (on-premise side) to the virtual private gateway (AWS side):

aws ec2 create-vpn-connection \
  --customer-gateway-id cgw-0123456789abcdef0 \
  --type ipsec.1 \
  --vpn-gateway-id vgw-0abcdef1234567890

The command above produces two tunnels, each with a different IP endpoint and PSK. These two tunnels are what get configured on the on-premise VPN device; if one tunnel drops, the other keeps carrying traffic — that's why site-to-site VPNs always come in pairs for high availability. Note that --type ipsec.1 here is the AWS connection type name, not the IPsec protocol version — don't confuse it with IKEv2.

#Dedicated Private Connection

The second family is a private optical fiber path connecting your data center directly to the cloud provider's network — never passing through the public internet. On AWS this service is called AWS Direct Connect, on GCP Cloud Interconnect (Dedicated or Partner), and on Azure Azure ExpressRoute.

Continuing the analogy above: if IPsec is a tunnel in the middle of a public highway, a dedicated connection is building your own private railway. No other vehicles on that path, no public traffic queues, and capacity can be sized to your needs — from hundreds of Mbps to hundreds of Gbps. Because the path doesn't share with public traffic, latency is more consistent and lower, which is critical for database replication or latency-sensitive workloads.

The consequences also make sense: more expensive, and provisioning takes much longer. The telecom provider must physically pull fiber from your location to the cloud provider's peering point, so the process usually takes weeks to months, not hours. You can't "turn on" a dedicated connection instantly like a VPN.

One thing is often misunderstood. A private connection doesn't automatically mean encrypted: packets travel on a network controlled by the cloud provider and the telecom, not on the open internet — that's about the path, not cryptography. If your regulations require end-to-end encryption, still add an encryption layer on top, such as MACsec for Direct Connect or an IPsec tunnel "riding" over the private path.

#Comparing Site-to-Site VPN vs Dedicated Connection

#Comparing the Big 3 Cloud Connectivity Services

Every provider offers the same service pair: one VPN-based over the internet, one dedicated-connection-based.

The concepts are identical, the names and implementation details differ. On GCP, Cloud VPN supports two simultaneously active tunnels (High Availability VPN), and Cloud Interconnect comes in two options: Dedicated Interconnect for dedicated fiber ports and Partner Interconnect provided through third-party telecom providers — useful when your location isn't reachable by a direct port. On Azure, VPN Gateway supports active-active configurations, while ExpressRoute has the ExpressRoute Local option for connecting to only one specific region at a lower cost.

#Conclusion

In this episode 18 you understood that hybrid connectivity is built from two families: IPsec Site-to-Site VPN — cheap, fast to set up, automatically encrypted, but dependent on public internet conditions — and dedicated private connections like Direct Connect, Cloud Interconnect, and ExpressRoute — stable and high-capacity, but expensive and slow to provision.

The key points to take with you:

• Hybrid cloud and multi-cloud aren't just trends, they're the reality of gradual migration, compliance, and resilience.
• IPsec parameters are conceptually the same across all vendors: IKE version, PSK, encryption algorithms, and tunnel CIDR.
• VPN over the public internet is always encrypted; a private path isn't necessarily encrypted.
• Dedicated connections win on stability and bandwidth, but cost more and take longer to build.
• The common production pattern: dedicated as primary, VPN as backup.
• Service names differ between providers, the concept is one: AWS Site-to-Site VPN/Direct Connect, GCP Cloud VPN/Interconnect, Azure VPN Gateway/ExpressRoute.

All this connectivity has one goal: keeping the system alive and interconnected. The big question arises next — what happens when connections, servers, or even an entire region die? In the next episode, episode 19, we'll discuss Disaster Recovery & Business Continuity: the RPO and RTO metrics, four recovery strategies from backup-and-restore to multi-region active-active, and how to build a plan so the business keeps running during a disaster. Stay tuned!