hybrid-cloud-networking
installsforks
How to install hybrid-cloud-networking?
wshobson/agents/hybrid-cloud-networking
$npx -y skills add wshobson/agents --skill hybrid-cloud-networkingConfigure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.
SKILL.md
| 1 | # Hybrid Cloud Networking |
| 2 | |
| 3 | Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, ExpressRoute, Interconnect, and FastConnect. |
| 4 | |
| 5 | ## Purpose |
| 6 | |
| 7 | Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP, OCI). |
| 8 | |
| 9 | ## When to Use |
| 10 | |
| 11 | - Connect on-premises to cloud |
| 12 | - Extend datacenter to cloud |
| 13 | - Implement hybrid active-active setups |
| 14 | - Meet compliance requirements |
| 15 | - Migrate to cloud gradually |
| 16 | |
| 17 | ## Connection Options |
| 18 | |
| 19 | ### AWS Connectivity |
| 20 | |
| 21 | #### 1. Site-to-Site VPN |
| 22 | |
| 23 | - IPSec VPN over internet |
| 24 | - Up to 1.25 Gbps per tunnel |
| 25 | - Cost-effective for moderate bandwidth |
| 26 | - Higher latency, internet-dependent |
| 27 | |
| 28 | ```hcl |
| 29 | resource "aws_vpn_gateway" "main" { |
| 30 | vpc_id = aws_vpc.main.id |
| 31 | tags = { |
| 32 | Name = "main-vpn-gateway" |
| 33 | } |
| 34 | } |
| 35 | |
| 36 | resource "aws_customer_gateway" "main" { |
| 37 | bgp_asn = 65000 |
| 38 | ip_address = "203.0.113.1" |
| 39 | type = "ipsec.1" |
| 40 | } |
| 41 | |
| 42 | resource "aws_vpn_connection" "main" { |
| 43 | vpn_gateway_id = aws_vpn_gateway.main.id |
| 44 | customer_gateway_id = aws_customer_gateway.main.id |
| 45 | type = "ipsec.1" |
| 46 | static_routes_only = false |
| 47 | } |
| 48 | ``` |
| 49 | |
| 50 | #### 2. AWS Direct Connect |
| 51 | |
| 52 | - Dedicated network connection |
| 53 | - 1 Gbps to 100 Gbps |
| 54 | - Lower latency, consistent bandwidth |
| 55 | - More expensive, setup time required |
| 56 | |
| 57 | **Reference:** See `references/direct-connect.md` |
| 58 | |
| 59 | ### Azure Connectivity |
| 60 | |
| 61 | #### 1. Site-to-Site VPN |
| 62 | |
| 63 | ```hcl |
| 64 | resource "azurerm_virtual_network_gateway" "vpn" { |
| 65 | name = "vpn-gateway" |
| 66 | location = azurerm_resource_group.main.location |
| 67 | resource_group_name = azurerm_resource_group.main.name |
| 68 | |
| 69 | type = "Vpn" |
| 70 | vpn_type = "RouteBased" |
| 71 | sku = "VpnGw1" |
| 72 | |
| 73 | ip_configuration { |
| 74 | name = "vnetGatewayConfig" |
| 75 | public_ip_address_id = azurerm_public_ip.vpn.id |
| 76 | private_ip_address_allocation = "Dynamic" |
| 77 | subnet_id = azurerm_subnet.gateway.id |
| 78 | } |
| 79 | } |
| 80 | ``` |
| 81 | |
| 82 | #### 2. Azure ExpressRoute |
| 83 | |
| 84 | - Private connection via connectivity provider |
| 85 | - Up to 100 Gbps |
| 86 | - Low latency, high reliability |
| 87 | - Premium for global connectivity |
| 88 | |
| 89 | ### GCP Connectivity |
| 90 | |
| 91 | #### 1. Cloud VPN |
| 92 | |
| 93 | - IPSec VPN (Classic or HA VPN) |
| 94 | - HA VPN: 99.99% SLA |
| 95 | - Up to 3 Gbps per tunnel |
| 96 | |
| 97 | #### 2. Cloud Interconnect |
| 98 | |
| 99 | - Dedicated (10 Gbps, 100 Gbps) |
| 100 | - Partner (50 Mbps to 50 Gbps) |
| 101 | - Lower latency than VPN |
| 102 | |
| 103 | ### OCI Connectivity |
| 104 | |
| 105 | #### 1. IPSec VPN Connect |
| 106 | |
| 107 | - IPSec VPN with redundant tunnels |
| 108 | - Dynamic routing through DRG |
| 109 | - Good fit for branch offices and migration phases |
| 110 | |
| 111 | #### 2. OCI FastConnect |
| 112 | |
| 113 | - Private dedicated connectivity through Oracle or partner edge |
| 114 | - Suitable for predictable throughput and lower-latency hybrid traffic |
| 115 | - Commonly paired with DRG for hub-and-spoke designs |
| 116 | |
| 117 | ## Hybrid Network Patterns |
| 118 | |
| 119 | ### Pattern 1: Hub-and-Spoke |
| 120 | |
| 121 | ``` |
| 122 | On-Premises Datacenter |
| 123 | ↓ |
| 124 | VPN/Direct Connect |
| 125 | ↓ |
| 126 | Transit Gateway (AWS) / vWAN (Azure) |
| 127 | ↓ |
| 128 | ├─ Production VPC/VNet |
| 129 | ├─ Staging VPC/VNet |
| 130 | └─ Development VPC/VNet |
| 131 | ``` |
| 132 | |
| 133 | ### Pattern 2: Multi-Region Hybrid |
| 134 | |
| 135 | ``` |
| 136 | On-Premises |
| 137 | ├─ Direct Connect → us-east-1 |
| 138 | └─ Direct Connect → us-west-2 |
| 139 | ↓ |
| 140 | Cross-Region Peering |
| 141 | ``` |
| 142 | |
| 143 | ### Pattern 3: Multi-Cloud Hybrid |
| 144 | |
| 145 | ``` |
| 146 | On-Premises Datacenter |
| 147 | ├─ Direct Connect → AWS |
| 148 | ├─ ExpressRoute → Azure |
| 149 | ├─ Interconnect → GCP |
| 150 | └─ FastConnect → OCI |
| 151 | ``` |
| 152 | |
| 153 | ## Routing Configuration |
| 154 | |
| 155 | ### BGP Configuration |
| 156 | |
| 157 | ``` |
| 158 | On-Premises Router: |
| 159 | - AS Number: 65000 |
| 160 | - Advertise: 10.0.0.0/8 |
| 161 | |
| 162 | Cloud Router: |
| 163 | - AS Number: 64512 (AWS), 65515 (Azure), provider-assigned for GCP/OCI |
| 164 | - Advertise: Cloud VPC/VNet CIDRs |
| 165 | ``` |
| 166 | |
| 167 | ### Route Propagation |
| 168 | |
| 169 | - Enable route propagation on route tables |
| 170 | - Use BGP for dynamic routing |
| 171 | - Implement route filtering |
| 172 | - Monitor route advertisements |
| 173 | |
| 174 | ## Security Best Practices |
| 175 | |
| 176 | 1. **Use private connectivity** (Direct Connect/ExpressRoute/Interconnect/FastConnect) |
| 177 | 2. **Implement encryption** for VPN tunnels |
| 178 | 3. **Use VPC endpoints** to avoid internet routing |
| 179 | 4. **Configure network ACLs** and security groups |
| 180 | 5. **Enable VPC Flow Logs** for monitoring |
| 181 | 6. **Implement DDoS protection** |
| 182 | 7. **Use PrivateLink/Private Endpoints** |
| 183 | 8. **Monitor connections** with CloudWatch/Azure Monitor/Cloud Monitoring/OCI Monitoring |
| 184 | 9. **Implement redundancy** (dual tunnels) |
| 185 | 10. **Regular security audits** |
| 186 | |
| 187 | ## High Availability |
| 188 | |
| 189 | ### Dual VPN Tunnels |
| 190 | |
| 191 | ```hcl |
| 192 | resource "aws_vpn_connection" "primary" { |
| 193 | vpn_gateway_id = aws_vpn_gateway.main.id |
| 194 | customer_gateway_id = aws_customer_gateway.primary.id |
| 195 | type = "ipsec.1" |
| 196 | } |
| 197 | |
| 198 | resource "aws_vpn_connection" "secondary" { |
| 199 | vpn_gateway_id = aws_vpn_gateway.main.id |
| 200 | customer_gateway_id = aws_customer_gateway.secondary.id |
| 201 | type |
People who liked this also viewed
6 picksType
- microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026
- azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026
- azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026
- azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026
- azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026
- azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
