NetworkTools
Sign In
1VPC Design2Security Groups & NACLs3Virtual Routers4Hybrid Connectivity5Cloud Load Balancing6Cloud DNS & CDN7Container Networking
← Back to Cloud Networking

Learning Objectives

  • Compare AWS Direct Connect, Site-to-Site VPN, and Client VPN
  • Design hybrid networks that connect on-premises to cloud
  • Understand BGP routing over VPN and Direct Connect

Hybrid Connectivity Options

Connecting your on-premises data center to the cloud requires choosing the right technology for your latency, bandwidth, and reliability requirements. The three main options are Site-to-Site VPN, Direct Connect, and Client VPN.

Site-to-Site VPN uses the public internet with IPsec tunnels. It is quick to set up, inexpensive, and provides adequate security for many workloads. Each VPN connection consists of two tunnels for high availability.

Direct Connect (DX) provides a dedicated physical connection from your data center to the cloud provider. It offers consistent latency, higher bandwidth, and bypasses the public internet entirely. The trade-off is longer provisioning times (weeks) and higher cost.

Hybrid Connectivity with DX and VPN

FiberDirect ConnectOn-prem routerIPsec tunnelsCorporate DCDX LocationAWS VPCTransit GatewayVPN GatewayCustomer GWPrivate Subnet APrivate Subnet B

Match each connectivity option to its best use case.

Hints
  • Think about physical infrastructure vs software
  • Some options require hardware at your location
  • Consider who needs connectivity — whole data center or individual users?
Left
matches to
Right
Left
matches to
Right
Left
matches to
Right
Left
matches to
Right
Left
matches to
Right
Left
matches to
Right
Attempts: 0

BGP Routing in Hybrid Networks

Both Direct Connect and Site-to-Site VPN can use BGP (Border Gateway Protocol) to exchange routes dynamically. BGP automatically detects path failures and reroutes traffic, and it simplifies IP address management by advertising routes directly from your on-premises routers.

On the cloud side, you configure a Virtual Private Gateway or Transit Gateway to establish BGP sessions with your on-premises router. Each session exchanges prefixes: your on-premises network announces its CIDR blocks, and the cloud gateway announces the VPC CIDRs.

Direct Connect Resiliency

A single Direct Connect connection is a single point of failure. Production deployments should use at least two connections, ideally through different DX locations. Combined with a Transit Gateway, you can implement active-active or active-passive failover between connections.

What is the main advantage of Direct Connect over Site-to-Site VPN?

How many VPN tunnels does a typical Site-to-Site VPN configuration use for high availability?

Key Takeaways

  • Site-to-Site VPN: fast to deploy, uses the internet, good for dev/test and backup
  • Direct Connect: dedicated fiber, consistent performance, weeks to provision
  • Client VPN: per-user access from anywhere, ideal for remote workers
  • Use BGP for dynamic route exchange in production hybrid networks
  • Always design for redundancy — at least two VPN tunnels or two DX connections
PreviousVirtual RoutersNextCloud Load Balancing