Cloud Infrastructure

Skill 34 of 183

Hybrid Cloud Networking

Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections.

2 minutes · 441 words · 31 sections

Install

$ npx skills add wshobson/agents --skill hybrid-cloud-networking

$ npx skills add wshobson/agents

» /plugin marketplace add wshobson/agents

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, ExpressRoute, Interconnect, and FastConnect.

Purpose

Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP, OCI).

When to Use

Connect on-premises to cloud
Extend datacenter to cloud
Implement hybrid active-active setups
Meet compliance requirements
Migrate to cloud gradually

Connection Options

AWS Connectivity

1. Site-to-Site VPN

IPSec VPN over internet
Up to 1.25 Gbps per tunnel
Cost-effective for moderate bandwidth
Higher latency, internet-dependent

resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "main-vpn-gateway"
  }
}

resource "aws_customer_gateway" "main" {
  bgp_asn    = 65000
  ip_address = "203.0.113.1"
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "main" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.main.id
  type                = "ipsec.1"
  static_routes_only  = false
}

2. AWS Direct Connect

Dedicated network connection
1 Gbps to 100 Gbps
Lower latency, consistent bandwidth
More expensive, setup time required

Reference: See references/direct-connect.md

Azure Connectivity

1. Site-to-Site VPN

resource "azurerm_virtual_network_gateway" "vpn" {
  name                = "vpn-gateway"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "VpnGw1"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

2. Azure ExpressRoute

Private connection via connectivity provider
Up to 100 Gbps
Low latency, high reliability
Premium for global connectivity

GCP Connectivity

1. Cloud VPN

IPSec VPN (Classic or HA VPN)
HA VPN: 99.99% SLA
Up to 3 Gbps per tunnel

2. Cloud Interconnect

Dedicated (10 Gbps, 100 Gbps)
Partner (50 Mbps to 50 Gbps)
Lower latency than VPN

OCI Connectivity

1. IPSec VPN Connect

IPSec VPN with redundant tunnels
Dynamic routing through DRG
Good fit for branch offices and migration phases

2. OCI FastConnect

Private dedicated connectivity through Oracle or partner edge
Suitable for predictable throughput and lower-latency hybrid traffic
Commonly paired with DRG for hub-and-spoke designs

Hybrid Network Patterns

Pattern 1: Hub-and-Spoke

On-Premises Datacenter
         ↓
    VPN/Direct Connect
         ↓
    Transit Gateway (AWS) / vWAN (Azure)
         ↓
    ├─ Production VPC/VNet
    ├─ Staging VPC/VNet
    └─ Development VPC/VNet

Pattern 2: Multi-Region Hybrid

On-Premises
    ├─ Direct Connect → us-east-1
    └─ Direct Connect → us-west-2
            ↓
        Cross-Region Peering

Pattern 3: Multi-Cloud Hybrid

On-Premises Datacenter
    ├─ Direct Connect → AWS
    ├─ ExpressRoute → Azure
    ├─ Interconnect → GCP
    └─ FastConnect → OCI

Routing Configuration

BGP Configuration

On-Premises Router:
- AS Number: 65000
- Advertise: 10.0.0.0/8

Cloud Router:
- AS Number: 64512 (AWS), 65515 (Azure), provider-assigned for GCP/OCI
- Advertise: Cloud VPC/VNet CIDRs

Route Propagation

Enable route propagation on route tables
Use BGP for dynamic routing
Implement route filtering
Monitor route advertisements

Security Best Practices

Use private connectivity (Direct Connect/ExpressRoute/Interconnect/FastConnect)
Implement encryption for VPN tunnels
Use VPC endpoints to avoid internet routing
Configure network ACLs and security groups
Enable VPC Flow Logs for monitoring
Implement DDoS protection
Use PrivateLink/Private Endpoints
Monitor connections with CloudWatch/Azure Monitor/Cloud Monitoring/OCI Monitoring
Implement redundancy (dual tunnels)
Regular security audits

High Availability

Dual VPN Tunnels

resource "aws_vpn_connection" "primary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.primary.id
  type                = "ipsec.1"
}

resource "aws_vpn_connection" "secondary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.secondary.id
  type                = "ipsec.1"
}

Active-Active Configuration

Multiple connections from different locations
BGP for automatic failover
Equal-cost multi-path (ECMP) routing
Monitor health of all connections

Monitoring and Troubleshooting

Key Metrics

Tunnel status (up/down)
Bytes in/out
Packet loss
Latency
BGP session status

Troubleshooting

# AWS VPN
aws ec2 describe-vpn-connections
aws ec2 get-vpn-connection-telemetry

# Azure VPN
az network vpn-connection show
az network vpn-connection show-device-config-script

# OCI IPSec VPN
oci network ip-sec-connection list
oci network cpe list

Cost Optimization

Right-size connections based on traffic
Use VPN for low-bandwidth workloads
Consolidate traffic through fewer connections
Minimize data transfer costs
Use dedicated private links for high bandwidth
Implement caching to reduce traffic

multi-cloud-architecture - For architecture decisions
terraform-module-library - For IaC implementation

About this skill

Trigger

Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/wshobson/agents, branch main, last pushed 21 September 2026.

Licence

MIT — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

183 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 51 distinct layouts observed: plugins/accessibility-compliance/skills/*/SKILL.md, plugins/agent-teams/skills/*/SKILL.md, plugins/api-scaffolding/skills/*/SKILL.md, plugins/avoid-ai-writing/skills/*/SKILL.md, plugins/backend-development/skills/*/SKILL.md, plugins/before-you-build/skills/*/SKILL.md, plugins/block-no-verify/skills/*/SKILL.md, plugins/blockchain-web3/skills/*/SKILL.md, plugins/brand-landingpage/skills/*/SKILL.md, plugins/business-analytics/skills/*/SKILL.md, plugins/cicd-automation/skills/*/SKILL.md, plugins/cloud-infrastructure/skills/*/SKILL.md, plugins/conductor/skills/*/SKILL.md, plugins/data-engineering/skills/*/SKILL.md, plugins/database-design/skills/*/SKILL.md, plugins/developer-essentials/skills/*/SKILL.md, plugins/dgx-spark-ops/skills/*/SKILL.md, plugins/documentation-generation/skills/*/SKILL.md, plugins/documentation-standards/skills/*/SKILL.md, plugins/dotnet-contribution/skills/*/SKILL.md, plugins/file-conversion/skills/*/SKILL.md, plugins/framework-migration/skills/*/SKILL.md, plugins/frontend-mobile-development/skills/*/SKILL.md, plugins/game-development/skills/*/SKILL.md, plugins/hermes-tweet/skills/*/SKILL.md, plugins/hr-legal-compliance/skills/*/SKILL.md, plugins/incident-response/skills/*/SKILL.md, plugins/javascript-typescript/skills/*/SKILL.md, plugins/kubernetes-operations/skills/*/SKILL.md, plugins/llm-application-dev/skills/*/SKILL.md, plugins/llm-finetuning/skills/*/SKILL.md, plugins/machine-learning-ops/skills/*/SKILL.md, plugins/observability-monitoring/skills/*/SKILL.md, plugins/payment-processing/skills/*/SKILL.md, plugins/plugin-eval/skills/*/SKILL.md, plugins/pptx-deck-creation/skills/*/SKILL.md, plugins/protect-mcp/skills/*/SKILL.md, plugins/python-development/skills/*/SKILL.md, plugins/quantitative-trading/skills/*/SKILL.md, plugins/reverse-engineering/skills/*/SKILL.md, plugins/review-agent-governance/skills/*/SKILL.md, plugins/security-scanning/skills/*/SKILL.md, plugins/shell-scripting/skills/*/SKILL.md, plugins/ship-mate/skills/*/SKILL.md, plugins/signed-audit-trails/skills/*/SKILL.md, plugins/skill-forge-essentials/skills/*/SKILL.md, plugins/social-publishing/skills/*/SKILL.md, plugins/startup-business-analyst/skills/*/SKILL.md, plugins/superself/skills/*/SKILL.md, plugins/systems-programming/skills/*/SKILL.md, plugins/ui-design/skills/*/SKILL.md.

Issue colours

Resolved from a deterministic hash of the owner name. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Removed “Hybrid Cloud Networking”, a leading h1 that duplicated the skill title.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .claude-plugin/marketplace.json by Seth Hobson, declaring 94 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /wshobson/agents.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, ExpressRoute, Interconnect, and FastConnect.

Purpose

Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP, OCI).

When to Use

Connect on-premises to cloud
Extend datacenter to cloud
Implement hybrid active-active setups
Meet compliance requirements
Migrate to cloud gradually

IPSec VPN over internet
Up to 1.25 Gbps per tunnel
Cost-effective for moderate bandwidth
Higher latency, internet-dependent

resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "main-vpn-gateway"
  }
}

resource "aws_customer_gateway" "main" {
  bgp_asn    = 65000
  ip_address = "203.0.113.1"
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "main" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.main.id
  type                = "ipsec.1"
  static_routes_only  = false
}

2. AWS Direct Connect

Dedicated network connection
1 Gbps to 100 Gbps
Lower latency, consistent bandwidth
More expensive, setup time required

Reference: See references/direct-connect.md

Azure Connectivity

1. Site-to-Site VPN

resource "azurerm_virtual_network_gateway" "vpn" {
  name                = "vpn-gateway"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "VpnGw1"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

2. Azure ExpressRoute

Private connection via connectivity provider
Up to 100 Gbps
Low latency, high reliability
Premium for global connectivity

GCP Connectivity

1. Cloud VPN

IPSec VPN (Classic or HA VPN)
HA VPN: 99.99% SLA
Up to 3 Gbps per tunnel

2. Cloud Interconnect

Dedicated (10 Gbps, 100 Gbps)
Partner (50 Mbps to 50 Gbps)
Lower latency than VPN

OCI Connectivity

1. IPSec VPN Connect

IPSec VPN with redundant tunnels
Dynamic routing through DRG
Good fit for branch offices and migration phases

2. OCI FastConnect

Private dedicated connectivity through Oracle or partner edge
Suitable for predictable throughput and lower-latency hybrid traffic
Commonly paired with DRG for hub-and-spoke designs

Hybrid Network Patterns

Pattern 1: Hub-and-Spoke

On-Premises Datacenter
         ↓
    VPN/Direct Connect
         ↓
    Transit Gateway (AWS) / vWAN (Azure)
         ↓
    ├─ Production VPC/VNet
    ├─ Staging VPC/VNet
    └─ Development VPC/VNet

Pattern 2: Multi-Region Hybrid

On-Premises
    ├─ Direct Connect → us-east-1
    └─ Direct Connect → us-west-2
            ↓
        Cross-Region Peering

Pattern 3: Multi-Cloud Hybrid

On-Premises Datacenter
    ├─ Direct Connect → AWS
    ├─ ExpressRoute → Azure
    ├─ Interconnect → GCP
    └─ FastConnect → OCI

Routing Configuration

BGP Configuration

On-Premises Router:
- AS Number: 65000
- Advertise: 10.0.0.0/8

Cloud Router:
- AS Number: 64512 (AWS), 65515 (Azure), provider-assigned for GCP/OCI
- Advertise: Cloud VPC/VNet CIDRs

Route Propagation

Enable route propagation on route tables
Use BGP for dynamic routing
Implement route filtering
Monitor route advertisements

Security Best Practices

Use private connectivity (Direct Connect/ExpressRoute/Interconnect/FastConnect)
Implement encryption for VPN tunnels
Use VPC endpoints to avoid internet routing
Configure network ACLs and security groups
Enable VPC Flow Logs for monitoring
Implement DDoS protection
Use PrivateLink/Private Endpoints
Monitor connections with CloudWatch/Azure Monitor/Cloud Monitoring/OCI Monitoring
Implement redundancy (dual tunnels)
Regular security audits

High Availability

Dual VPN Tunnels

resource "aws_vpn_connection" "primary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.primary.id
  type                = "ipsec.1"
}

resource "aws_vpn_connection" "secondary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.secondary.id
  type                = "ipsec.1"
}

Active-Active Configuration

Multiple connections from different locations
BGP for automatic failover
Equal-cost multi-path (ECMP) routing
Monitor health of all connections

Monitoring and Troubleshooting

Key Metrics

Tunnel status (up/down)
Bytes in/out
Packet loss
Latency
BGP session status

Troubleshooting

# AWS VPN
aws ec2 describe-vpn-connections
aws ec2 get-vpn-connection-telemetry

# Azure VPN
az network vpn-connection show
az network vpn-connection show-device-config-script

# OCI IPSec VPN
oci network ip-sec-connection list
oci network cpe list

Cost Optimization

Right-size connections based on traffic
Use VPN for low-bandwidth workloads
Consolidate traffic through fewer connections
Minimize data transfer costs
Use dedicated private links for high bandwidth
Implement caching to reduce traffic

multi-cloud-architecture - For architecture decisions
terraform-module-library - For IaC implementation

About this skill

Trigger

Colophon

Appendix 34.1

ReferencesMarkdown · 1 file

About this skill

Trigger

Colophon

Appendix 34.1

ReferencesMarkdown · 1 file