Executive summary
Hybrid cloud connectivity requires a clear understanding of the difference between an encrypted VPN that rides on the public internet and a dedicated private circuit that bypasses that underlay. Azure VPN Gateway, Azure ExpressRoute, AWS Direct Connect and Alibaba Cloud Express Connect each expose a virtual interface or virtual router that carries only the prefixes you advertise. All other traffic – SaaS, Microsoft 365, public AWS services – continues on the internet unless you explicitly route it over a private virtual interface. This article walks through the fundamentals, compares the four major providers, shows a reference architecture, and supplies step‑by‑step guidance for building a resilient, secure hybrid network.
Introduction
Enterprises increasingly run workloads across on‑premises datacentres and multiple public clouds. To meet latency, compliance and cost goals they need private connectivity that isolates critical traffic from the public internet while still allowing occasional internet‑bound flows. The two primary mechanisms are:
- Site‑to‑site VPN – an IPsec tunnel (or OpenVPN/IKEv2 for point‑to‑site) that encrypts packets and transports them over the shared internet underlay.
- Private circuit – a provider‑provisioned fiber link that terminates in a cloud access point, then uses a virtual interface or virtual border router to exchange routes via BGP.
Both approaches appear similar at the IP layer, yet their operational characteristics, bandwidth guarantees and failure modes differ dramatically. Understanding those differences is essential before committing to a design.
Technical fundamentals
VPN fundamentals
Azure VPN Gateway implements IPsec/IKE for site‑to‑site connections. The underlay is the public internet, which means packet loss, jitter and variable latency are governed by the ISP rather than the cloud provider. Bandwidth is shared among all tunnels attached to a single gateway and is limited by the SKU. The Basic SKU does not support BGP, while larger SKUs do. Point‑to‑site uses OpenVPN, IKEv2 or SSTP and is intended for individual users, not datacentre routers.
Private circuit fundamentals
A private circuit such as Azure ExpressRoute or AWS Direct Connect starts as a physical provider link into a cloud‑provider colocation. After the physical layer, the cloud provider adds a virtual interface (Azure) or virtual router (Alibaba) that establishes a BGP session. Only the prefixes advertised over that BGP session travel on the circuit; everything else follows the internet. ExpressRoute circuits are provisioned in pairs for redundancy, each connecting to a different Microsoft Enterprise edge router. The Premium add‑on extends the reach of an ExpressRoute circuit beyond its geopolitical region, but still excludes national clouds.
Routing semantics
All four services rely on BGP for route exchange. Azure ExpressRoute supports multiple BGP sessions per circuit, one for each traffic profile (private, Microsoft, public). AWS Direct Connect offers three virtual interface types: private, public and transit. The private interface carries private IP ranges to a VPC, the public interface uses public IP ranges to reach AWS public services, and the transit interface connects to a Direct Connect gateway for multi‑VPC, multi‑account scenarios. Alibaba Cloud Express Connect uses a virtual border router and a transit router to bridge the datacentre to VPCs.
Architecture and components
Below is a reference diagram showing a typical dual‑path hybrid design:
+----------------+ +----------------+ +----------------+
| Data centre |---[Circuit]---| Cloud Access |---[Virtual |--- VPC / VNets
| Router (BGP) | | Location (ER) | Interface] |
+----------------+ +----------------+ +----------------+
| |
| |
+---[IPsec Tunnel over Internet]---+--- SaaS, Microsoft 365, Public AWS
The circuit carries only the advertised private prefixes. The IPsec tunnel carries any traffic not advertised, including SaaS endpoints.
Component list
| Component | Azure | AWS | Alibaba Cloud | Role |
|---|
| Underlay | Public Internet (VPN) | Public Internet (VPN) | Public Internet (VPN) | Shared ISP path |
| Virtual object | VPN Gateway / ExpressRoute virtual interface | Direct Connect private, public, transit interfaces | Express Connect virtual border router + transit router | Endpoint for BGP |
| Routing protocol | IPsec/IKE, optional BGP (SKU dependent) | BGP with MD5, optional MD5 on Direct Connect | BGP with MD5 | Exchange of advertised prefixes |
| Traffic remaining on internet | Yes (non‑advertised) | Yes (non‑advertised) | Yes (non‑advertised) | SaaS, public endpoints |
Detailed implementation approach
- Assess traffic patterns – Identify which workloads need deterministic latency and which can tolerate internet variability.
- Select connectivity type – Use VPN for low‑volume or backup paths; use a private circuit for high‑throughput, low‑latency workloads.
- Provision the circuit – Work with a connectivity provider to order the desired bandwidth (e.g., 1 Gbps, 10 Gbps). For Azure ExpressRoute the provider offers 50 Mbps up to 10 Gbps; ExpressRoute Direct provides dual 10 Gbps, 100 Gbps or 400 Gbps.
- Create the virtual interface – In Azure, create an ExpressRoute circuit, then add a virtual interface and enable BGP. In AWS, create a private virtual interface and associate it with a Direct Connect gateway. In Alibaba, create an Express Connect virtual border router and attach a transit router.
- Configure BGP – Set up MD5 authentication, advertise only the prefixes that must travel over the circuit, and apply route filters to prevent leakage.
- Deploy VPN fallback – Configure an Azure site‑to‑site VPN gateway with matching IPsec parameters. Enable BGP on the VPN SKU if dynamic failover is required.
- Test failover – Simulate a circuit outage and verify traffic reroutes over the IPsec tunnel without loss of session state.
- Monitor – Enable cloud‑provider metrics for link status, BGP session health and interface utilization.
Architecture and data‑flow
When a packet originates in the datacentre, the router first checks the BGP table. If the destination prefix matches an advertised private route, the packet is forwarded onto the private circuit, encapsulated in the provider’s layer‑2 frame, and reaches the cloud virtual network or VPC directly. If the destination is not in the BGP table, the router forwards the packet to the default internet gateway, where it is encrypted by the VPN gateway (if a VPN tunnel exists) and sent over the public internet. SaaS endpoints such as Microsoft 365 or Amazon S3 are therefore reached via the internet unless a public virtual interface is explicitly configured.
Security and governance
- Encryption – VPN tunnels encrypt traffic end‑to‑end. Private circuits do not encrypt by default; organizations must apply IPsec or MACsec at the edge if encryption is required.
- Authentication – BGP sessions use MD5 authentication on all three providers. Azure ExpressRoute and AWS Direct Connect require MD5; Alibaba Cloud Express Connect also mandates it.
- Segmentation – Advertise only the necessary CIDR blocks. Use route filters to prevent accidental advertisement of internal management subnets.
- Compliance – Private circuits satisfy many regulatory requirements for data‑in‑transit because the underlay never traverses the public internet. VPNs can meet compliance if strong encryption and key management are enforced.
- Governance – Document the prefix list, BGP policies and failover hierarchy. Treat the VPN as a secondary path, not a primary production link, unless bandwidth guarantees are sufficient.
Enterprise use cases
- Finance – low‑latency trade execution – Use ExpressRoute (or Direct Connect) to connect a trading engine to cloud‑based market data feeds, advertising only the market‑data prefix.
- Healthcare – regulated data – Deploy a private circuit to move patient records into a HIPAA‑compliant Azure VNet, while allowing clinicians to access SaaS portals over the internet.
- Media – large file ingest – Use ExpressRoute Direct 100 Gbps to move high‑resolution video to Azure Media Services, with a VPN fallback for continuity.
- Multi‑cloud backup – Connect a datacentre to both Azure and AWS using separate circuits; use BGP communities to steer backup traffic to the appropriate cloud.
Benefits and limitations
| Benefit | Limitation |
|---|
| Deterministic bandwidth on private circuits | Bandwidth limited to provider‑offered sizes; oversubscription can cause packet loss |
| End‑to‑end encryption with VPN | Shared internet underlay can introduce jitter and variable latency |
| Granular route control via BGP | Misconfiguration can expose internal prefixes to the internet |
| Redundant paths (dual circuits + VPN) | Managing BGP sessions on multiple devices adds operational complexity |
| Premium ExpressRoute extends regional reach | Premium does not include national clouds and still requires advertised prefixes |
Operational considerations
- Monitoring – Enable Azure Monitor, AWS CloudWatch and Alibaba Cloud CloudMonitor for link status, BGP session state and traffic metrics.
- Capacity planning – Primary circuit bandwidth is fixed; secondary circuits provide redundancy but not additional guaranteed capacity.
- Failover testing – Schedule regular drills that disable the primary circuit and verify traffic flows over the VPN tunnel.
- Patch management – Keep router firmware up to date, especially for MD5 and BFD support. BFD will only be active after the customer router is configured.
- Cost tracking – Provider billing is per port‑hour plus outbound data transfer. No per‑megabit pricing is shown in the source documents.
Best practices
- Advertise the minimum set of prefixes – Reduces attack surface and prevents accidental routing of management traffic over the public internet.
- Use dual circuits in separate peering locations – Provides resilience against a single point of failure at the provider edge.
- Enable BGP MD5 on both sides – Prevents unauthorized route injection.
- Implement route filters – On Azure, use route filters for Microsoft peering; on AWS, use prefix filters on the Direct Connect gateway.
- Separate control and data planes – Keep BGP sessions on a dedicated management VLAN.
- Document failover order – Primary circuit → secondary circuit → VPN tunnel.
- Validate encryption – If data‑in‑transit encryption is required on a private circuit, deploy IPsec or MACsec at the edge.
Analysis
The source material provides clear definitions of each connectivity option, the bandwidth tiers offered by providers, and the routing model based on BGP. Azure VPN Gateway is limited by SKU‑dependent bandwidth and BGP support. ExpressRoute offers region‑limited private peering unless Premium is purchased, and secondary bandwidth is not guaranteed capacity. AWS Direct Connect separates private, public and transit virtual interfaces, each with distinct routing scopes. Alibaba Cloud Express Connect adds a transit router for multi‑VPC connectivity and caps a single connection at 400 Gbps. All three providers rely on BGP with MD5 authentication, and none publish a universal availability percentage. The analysis shows that the primary decision factor is whether the organization needs guaranteed underlay isolation (private circuit) versus cost‑effective encrypted transport (VPN).
What the sources do not settle
- Exact failover times when a primary circuit is lost – each provider mentions redundancy but does not quantify recovery latency.
- Comparative cost models – pricing tables are omitted, making it impossible to calculate total cost of ownership.
- Performance impact of BGP route flaps on application latency – the sources describe routing mechanisms but do not provide latency measurements.
- Inter‑cloud routing when using multiple private circuits – no guidance is given on how to coordinate BGP policies across Azure, AWS and Alibaba in a single hybrid fabric.
Conclusion
Private network integration between a datacentre and public clouds can be achieved with either encrypted VPN tunnels over the internet or dedicated circuits that bypass the public underlay. Azure VPN Gateway, Azure ExpressRoute, AWS Direct Connect and Alibaba Cloud Express Connect each expose a virtual interface or router that carries only the prefixes you advertise. By carefully selecting which prefixes travel on the private circuit and configuring BGP with MD5 authentication, organizations can obtain deterministic bandwidth, meet compliance mandates and retain flexibility for internet‑bound SaaS traffic. Redundant design patterns—dual circuits plus VPN fallback—provide resilience without sacrificing performance.
References
What is AWS Direct Connect? | Amazon Web Services
What is Azure ExpressRoute? | Microsoft Learn
What is Azure VPN Gateway? | Microsoft Learn
What is Express Connect? | Alibaba Cloud
These published CloudExchangers articles are further desk reading. They are not sources for the technical claims above.
