What are the ways to connect an on-prem data center to the cloud, and how do you choose?
Show the answer
Say this first
Three families: an IPsec site-to-site VPN over the internet, a private circuit (AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect), or an SD-WAN overlay that extends into the cloud. VPN is quick and cheap but limited in bandwidth and rides the internet. A private circuit gives steady latency, higher bandwidth and cheaper egress but takes weeks to order. Most enterprises run a circuit as primary and a VPN as backup.
Go deeper
| Site-to-site VPN | Private circuit | SD-WAN into cloud | |
|---|---|---|---|
| Lead time | Minutes | Weeks (cross-connect, provider) | Days |
| Bandwidth | Around 1.25 Gbps per AWS tunnel, scale with ECMP | 50 Mbps to 100 Gbps and up | Depends on appliances |
| Path | Public internet, encrypted | Private, not encrypted by default | Overlay over any transport |
| Latency | Varies with the internet | Predictable | Varies |
| Cost | Hourly per connection | Port hours plus lower egress rates | Licenses plus cloud instances |
How I choose
- Proof of concept or small office: VPN.
- Production data center with steady traffic or latency-sensitive apps: two circuits in two locations, with a VPN as a cheap extra backup.
- Many branches already on SD-WAN: extend the fabric with virtual appliances in a transit VPC or VNet, or the provider's native SD-WAN integration (AWS Transit Gateway Connect, Azure Virtual WAN).
- Compliance requires encryption on the circuit: MACsec where supported, or IPsec over the circuit.
BGP is the routing protocol on every one of these options; static routing exists for VPNs but loses automatic failover.
They will ask next
Is Direct Connect encrypted?
No. It is a private path, not an encrypted one. Use MACsec on supported dedicated connections, or run IPsec over the circuit if the policy demands encryption.
Why keep a VPN if you have two circuits?
It is cheap insurance against a shared failure, such as both circuits in one provider or a misconfiguration that drops both BGP sessions. Make sure the VPN routes are less preferred.
Traps
- Saying a private circuit is encrypted because it is private.
- Proposing a single circuit as "redundant" because the provider has two routers.