# Hybrid Connectivity: VPN and Dedicated Links — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-hybrid

> Compare site-to-site VPN with dedicated connections and explain the role of BGP in exchanging routes.

## Connecting the cloud to the office or data centre

Most companies keep some systems on premises, so the VPC needs a private path home. A **site-to-site VPN** builds encrypted IPsec tunnels over the public internet between a cloud VPN gateway and your on-premises router. It is quick to set up and relatively cheap, but throughput and latency vary with internet conditions. AWS provides two tunnels per VPN connection for redundancy, and you should configure both. A **dedicated connection** (AWS Direct Connect, Google Cloud Interconnect, Azure ExpressRoute) is a private circuit from your data centre or a colocation facility into the provider's network, giving more consistent latency and higher bandwidth at higher cost and with lead time. Both usually exchange routes with **BGP (Border Gateway Protocol)**: each side advertises the prefixes it owns, so routes update automatically when networks change. A common design uses a dedicated link as primary with a VPN as backup, terminating both on a transit gateway.

## Hybrid path

Hybrid traffic leaves the office network, crosses either an encrypted VPN tunnel or a dedicated circuit, and lands on a cloud gateway that routes it into the VPCs.

![Three connected stages from left to right: on-premises network, VPN tunnel or dedicated link, cloud gateway and VPCs.](assets/figures/cloud-networking/section-7-map.svg) — Figure 7.1: on-premises -> VPN or dedicated link -> cloud gateway and VPCs

## Dedicated does not automatically mean encrypted

A private circuit is not the same as encryption. If your compliance rules require encryption in transit, run IPsec over the link or use the provider's link-layer encryption option where supported, or encrypt at the application layer with TLS.

**Quiz:** What does BGP do in a hybrid cloud connection?

- [ ] Encrypts packets inside the tunnel
- [ ] Assigns IP addresses to instances
- [x] Exchanges reachable network prefixes between the two sides
- [ ] Translates private addresses to public ones

*Answer:* Exchanges reachable network prefixes between the two sides. BGP is a routing protocol. Each side advertises its prefixes so routes are learned dynamically instead of typed by hand.