Connecting On-Premises Networks to the Cloud (VPN and Direct Connect Concepts)

Connecting On-Premises Networks to the Cloud

Most real-world organizations do not move everything to the cloud at once. Instead, they run a hybrid architecture: some servers and devices stay on-premises while others run in a cloud VPC (Virtual Private Cloud). To make those two sides communicate securely, engineers use either a site-to-site VPN or a dedicated connection service. Understanding both options is essential for IT support and networking roles and is tested on the CompTIA Network+, Cisco CCST, and Cisco CCNA exams.

What Is a Site-to-Site VPN?

A site-to-site VPN creates an encrypted tunnel between two network endpoints across the public internet. In a hybrid cloud setup the two endpoints are:

• Customer Gateway (CGW): the on-premises router or firewall device. You register its public IP address with the cloud provider so the provider knows where to send the tunnel.
• Virtual Private Gateway (VGW): the cloud-side VPN concentrator that terminates the tunnel at the edge of your VPC.

The tunnel uses the IPsec protocol suite. IPsec authenticates both ends of the tunnel and encrypts every packet traveling through it. From the perspective of hosts on either side, they are sending traffic to private IP addresses just as they would on a local LAN. The encrypted wrapper keeps the payload hidden from anyone on the public internet between the two endpoints.

Cloud providers typically provision two parallel tunnels to the same VGW for redundancy. If one tunnel goes down, traffic automatically fails over to the second. When you check the console you should see a status of Up for at least one tunnel before declaring the connection healthy.

Key Configuration Parameters

When you build a site-to-site VPN in a cloud console you will supply or confirm:

1. The public IP of the customer gateway.

2. The routing type — static (you enter route prefixes manually) or dynamic using BGP (Border Gateway Protocol).

3. The pre-shared key (PSK) or certificate used for IKE (Internet Key Exchange) phase-1 authentication.

4. The VPC route table — you must add a route pointing your on-premises CIDR block toward the VGW, and you must add a route on your on-premises router pointing your cloud VPC CIDR toward the tunnel interface.

Both sides must agree on the same IKE version, encryption algorithm (such as AES-256), hashing algorithm (such as SHA-256), and Diffie-Hellman group for the tunnel to come up.

Dedicated Connection Services

A site-to-site VPN shares bandwidth with all other internet traffic and introduces variable latency. For workloads that need consistent throughput and low latency, cloud providers offer dedicated connection options:

• AWS Direct Connect — a private fiber circuit provisioned through a network service provider that connects your facility directly to an AWS region without touching the public internet.
• Azure ExpressRoute — Microsoft's equivalent service, also delivered through a connectivity provider.

Dedicated connections are more expensive and take longer to provision (weeks to months) compared to a VPN (minutes to hours). However, they offer predictable bandwidth, lower latency, and no exposure to internet-based threats. Many compliance frameworks favor dedicated connections for sensitive data.

Trade-off Summary

| Factor | Site-to-Site VPN | Dedicated Connection |

|---|---|---|

| Setup time | Minutes to hours | Weeks to months |

| Cost | Lower | Higher |

| Latency | Variable (internet) | Consistent (private) |

| Bandwidth | Shared | Dedicated |

| Availability | Good (dual tunnels) | Very high (redundant circuits) |

Traffic Path Through the Tunnel

When a host on the on-premises network sends a packet to a private IP address inside the VPC, the on-premises router looks up its routing table and matches the VPC CIDR to the tunnel interface. The router encapsulates the original packet inside an IPsec ESP (Encapsulating Security Payload) header, encrypts it, and sends it out the WAN interface toward the VGW's public IP. The VGW decrypts the outer packet, reads the original destination IP, and forwards it to the correct resource inside the VPC. The reply follows the same path in reverse. At no point does the private payload travel in plaintext across the internet.

Safety and Professional Practices

• Credential security: Pre-shared keys are secrets. Never share them in chat, email, or screenshots. Store them in a password manager or secrets manager service.
• Least privilege: The IAM (Identity and Access Management) role you use to configure a VPN gateway should have only the permissions needed for that task — not full administrator access.
• Change control: In a production environment, follow your organization's change management process before modifying VPN or routing configurations. Misconfigured routes can drop connectivity for many users.
• Lab isolation: In this course your sandbox accounts are isolated. Do not enter real credentials, real company data, or personal payment information into any lab environment.
• Electrical and physical safety: If you are physically handling network equipment such as a router or switch, follow standard PPE and lockout/tagout (LOTO) procedures before working inside an energized rack or replacing components.

Verifying the Connection

After configuring both sides, verify the VPN in two ways:

1. Console check: In the cloud console, navigate to the VPN connections section and confirm tunnel status shows Up.

2. Connectivity test: From the simulated on-premises host, ping the private IP address of an instance inside the VPC. A successful ping confirms that routing, tunnel negotiation, and security group rules are all correct.

If the ping fails, work through the layers: confirm tunnel status, check route tables on both sides, verify security groups allow ICMP from the on-premises CIDR, and confirm the on-premises firewall is not blocking IPsec UDP port 500 and 4500.