Hybrid Networking + VPN

Connect on-prem to cloud — Azure · AWS · GCP

Concept

Hybrid networking connects your on-premises data centers to cloud resources. All three clouds support VPN (IPsec) and dedicated interconnect options with varying bandwidth and SLA tiers.

Site-to-Site VPN
VPN Gateway (active/passive or active/active)
Virtual Private Gateway + Customer Gateway
Cloud VPN (HA VPN with 2 interfaces)
Dedicated
ExpressRoute (50 Mbps - 100 Gbps)
Direct Connect (50 Mbps - 100 Gbps)
Dedicated Interconnect (10 Gbps / 100 Gbps)
Partner
ExpressRoute through partner
Direct Connect Partner
Partner Interconnect (50 Mbps - 10 Gbps)
SLA
99.95% (ExpressRoute)
99.9% (Direct Connect)
99.99% (Dedicated Interconnect, 2 circuits)
BGP Required
Yes (for ExpressRoute)
Yes (BGP peering)
Yes (Cloud Router required)

HA VPN Configuration (GCP)

# Create Cloud Router
gcloud compute routers create my-router --network=my-vpc --region=us-central1 --asn=64513

# Create HA VPN gateway
gcloud compute vpn-gateways create my-ha-vpn --network=my-vpc --region=us-central1

# Create 2 tunnels (HA = 2 interfaces with 2 peer IPs each)
gcloud compute vpn-tunnels create tunnel-0 --vpn-gateway=my-ha-vpn --peer-address=203.0.113.1 --shared-secret=SHARED_SECRET --ike-version=2 --router=my-router --region=us-central1 --interface=0

# Create BGP session on Cloud Router
gcloud compute routers add-bgp-peer my-router --peer-name=onprem-peer-0 --interface=tunnel-0 --peer-asn=65001 --peer-ip-address=169.254.1.2

VPN Comparison

○ Azure — Azure VPN Gateway

SKUs: Basic, VpnGw1-5, VpnGw1AZ-5AZ

Max throughput: 10 Gbps (VpnGw5)

Max tunnels: 30 (active/active)

Protocols: IKEv2, OpenVPN, SSTP

○ AWS — AWS Site-to-Site VPN

Throughput: 1.25 Gbps per tunnel

Max tunnels: 10 per VGW

Protocols: IKEv2 (IPsec)

Transit Gateway: Scale to 50 Gbps with ECMP

○ GCP — GCP Cloud VPN

Throughput: 3 Gbps per tunnel (HA VPN)

Max tunnels: 8 per gateway

Protocols: IKEv2 (IPsec)

HA VPN: SLA 99.99% with 2 interfaces