Hybrid Cloud Networking

When to use this skill

Use Hybrid Cloud Networking when an AI agent needs a reusable SKILL.md workflow for this job: Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.

When not to use it

Skip Hybrid Cloud Networking when the task is outside the analysis category, or when a more specific skill in this directory already covers the same workflow with clearer triggers.

How to install

1. Personal install: create ~/.claude/skills/hybrid-cloud-networking/SKILL.md (and any bundled scripts) so Claude Code, Claude Desktop, and compatible agents can load it in every project.
2. Project install: commit the same folder at .claude/skills/hybrid-cloud-networking/ so teammates get the skill with the repo.
3. Restart the agent session after copying files so it re-scans the skills directory, then ask for the task in words that match the skill description.

Full install guide for Claude, Cursor, and Codex

What this skill does

# Hybrid Cloud Networking

Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, ExpressRoute, Interconnect, and FastConnect.

## Purpose

Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP, OCI).

## When to Use

- Connect on-premises to cloud - Extend datacenter to cloud - Implement hybrid active-active setups - Meet compliance requirements - Migrate to cloud gradually

## Connection Options

### AWS Connectivity

#### 1. Site-to-Site VPN

- IPSec VPN over internet - Up to 1.25 Gbps per tunnel - Cost-effective for moderate bandwidth - Higher latency, internet-dependent

```hcl resource "aws_vpn_gateway" "main" { vpc_id = aws_vpc.main.id tags = { Name = "main-vpn-gateway" } }

resource "aws_customer_gateway" "main" { bgp_asn = 65000 ip_address = "203.0.113.1" type = "ipsec.1" }

resource "aws_vpn_connection" "main" { vpn_gateway_id = aws_vpn_gateway.main.id customer_gateway_id = aws_customer_gateway.main.id type = "ipsec.1" static_routes_only = false } ```

#### 2. AWS Direct Connect

- Dedicated network connection - 1 Gbps to 100 Gbps - Lower latency, consistent bandwidth - More expensive, setup time required

**Reference:** See `references/direct-connect.md`

### Azure Connectivity

#### 1. Site-to-Site VPN

```hcl resource "azurerm_virtual_network_gateway" "vpn" { name = "vpn-gateway" location = azurerm_resource_group.main.location resource_group_name = azurerm_resource_group.main.name

type = "Vpn" vpn_type = "RouteBased" sku = "VpnGw1"

ip_configuration { name = "vnetGatewayConfig" public_ip_address_id = azurerm_public_ip.vpn.id private_ip_address_allocation = "Dynamic" subnet_id = azurerm_subnet.gateway.id } } ```

#### 2. Azure ExpressRoute

- Private connection via connectivity provider - Up to 100 Gbps - Low latency, high reliability - Premium for global connectivity

### GCP Connectivity

#### 1. Cloud VPN

- IPSec VPN (Classic or HA VPN) - HA VPN: 99.99% SLA - Up to 3 Gbps per tunnel

#### 2. Cloud Interconnect

- Dedicated (10 Gbps, 100 Gbps) - Partner (50 Mbps to 50 Gbps) - Lower latency than VPN

### OCI Connectivity

#### 1. IPSec VPN Connect

- IPSec VPN with redundant tunnels - Dynamic routing through DRG - Good fit for branch offices and migration phases

#### 2. OCI FastConnect

- Private dedicated connectivity through Oracle or partner edge - Suitable for predictable throughput and lower-latency hybrid traffic - Commonly paired with DRG for hub-and-spoke designs

## Hybrid Network Patterns

### Pattern 1: Hub-and-Spoke

``` On-Premises Datacenter ↓ VPN/Direct Connect ↓ Transit Gateway (AWS) / vWAN (Azure) ↓ ├─ Production VPC/VNet ├─ Staging VPC/VNet └─ Development VPC/VNet ```

### Pattern 2: Multi-Region Hybrid

``` On-Premises ├─ Direct Connect → us-east-1 └─ Direct Connect → us-west-2 ↓ Cross-Region Peering ```

### Pattern 3: Multi-Cloud Hybrid

``` On-Premises Datacenter ├─ Direct Connect → AWS ├─ ExpressRoute → Azure ├─ Interconnect → GCP └─ FastConnect → OCI ```

## Routing Configuration

### BGP Configuration

``` On-Premises Router: - AS Number: 65000 - Advertise: 10.0.0.0/8

Cloud Router: - AS Number: 64512 (AWS), 65515 (Azure), provider-assigned for GCP/OCI - Advertise: Cloud VPC/VNet CIDRs ```

### Route Propagation

- Enable route propagation on route tables - Use BGP for dynamic routing - Implement route filtering - Monitor route advertisements

## Security Best Practices

1. **Use private connectivity** (Direct Connect/ExpressRoute/Interconnect/FastConnect) 2. **Implement encryption** for VPN tunnels 3. **Use VPC endpoints** to avoid internet routing 4. **Configure network ACLs** and security groups 5. **Enable VPC Flow Logs** for monitoring 6. **Implement DDoS protection** 7. **Use PrivateLink/Private Endpoints** 8. **Monitor connections** with CloudWatch/Azure Monitor/Cloud Monitoring/OCI Monitoring 9. **Implement redundancy** (dual tunnels) 10. **Regular security audits**

## High Availability

### Dual VPN Tunnels

```hcl resource "aws_vpn_connection" "primary" { vpn_gateway_id = aws_vpn_gateway.main.id customer_gateway_id = aws_customer_gateway.primary.id type = "ipsec.1" }

resource "aws_vpn_connection" "secondary" { vpn_gateway_id = aws_vpn_gateway.main.id customer_gateway_id = aws_customer_gateway.secondary.id type = "ipsec.1" } ```

### Active-Active Configuration

- Multiple connections from different locations - BGP for automatic failover - Equal-cost multi-path (ECMP) routing - Monitor health of all connections

## Monitoring and Troubleshooting

### Key Metrics

- Tunnel status (up/down) - Bytes in/out - Packet loss - Latency - BGP session status

### Troubleshooting

```bash # AWS VPN aws ec2 describe-vpn-connections aws ec2 get-vpn-connection-telemetry

# Azure VPN az network vpn-connection show az network vpn-connection show-device-config-script

# OCI IPSec VPN oci network ip-sec-connection list oci network cpe list ```

## Cost Optimization

1. **Right-size connections** based on traffic 2. **Use VPN for low-bandwidth** workloads 3. **Consolidate traffic** through fewer connections 4. **Minimize data transfer** costs 5. **Use dedicated private links** for high bandwidth 6. **Implement caching** to reduce traffic

## Related Skills

- `multi-cloud-architecture` - For architecture decisions - `terraform-module-library` - For IaC implementation

Intended uses

• Connect on-premises to cloud
• Extend datacenter to cloud
• Implement hybrid active-active setups
• Meet compliance requirements
• Migrate to cloud gradually