Hybrid Networking

Hybrid Networking Quick Notes

Site-to-Site VPN

• AWS side: Virtual Private Gateway (VGW) or Transit Gateway attachment.
• On-premises side: Customer Gateway (your device’s public IP / ASN).
• Encrypted IPsec over the internet — fast to set up; variable latency.

Direct Connect (DX)

• Dedicated physical pipe into AWS — consistent bandwidth/latency.
• Not encrypted by itself. Need encryption → DX + VPN overlay.
• Private VIF: Into a VPC / TGW (private connectivity).
• Public VIF: Access public AWS services (e.g. S3) over DX.
• Direct Connect Gateway: One DX serving multiple Regions (attach Regional TGWs/VGWs).

Transit Gateway (TGW)

• Hub-and-spoke routing for many VPCs + on-prem attachments.
• Replaces full-mesh peering sprawl.
• Share across accounts with AWS RAM.
• More VPN bandwidth: TGW + ECMP + multiple VPN tunnels.

VPN CloudHub

• Multiple Site-to-Site VPNs (and optionally DX) into the same hub so branches talk to HQ and each other through AWS.
• Classic: DX at HQ, VPN-only branches.

VPC Peering

• Point-to-point; never transitive.
• Fine for two VPCs; painful as a mesh.

VPC Sharing (RAM)

• Share subnets (not “the whole VPC object”) with accounts in the same Organization.
• Often the cheapest private connectivity across accounts in one Region vs TGW mesh.

Shared Services VPC

• Central Directory / tools VPC that spokes consume (usually via TGW) — less admin than Transit-VPC nostalgia or full peering.

Quick Picker

Need: Choose

Encrypted + dedicated + time to set up: DX + VPN

Encrypted quickly: Site-to-Site VPN

Many VPCs + on-prem star: Transit Gateway

Cheapest multi-account private L3 (one Region): RAM subnet sharing

Branches ↔ HQ ↔ each other: VPN CloudHub

DX into multiple Regions: DX Gateway