High-Availability Hybrid Cloud Networking with AWS Direct Connect and Site-to-Site VPN

1. The Challenge of Hybrid Cloud Networking

As companies move workloads to the cloud, hybrid cloud architecture has become common. Core systems may stay in an on-premises data center, while burst capacity, analytics, and edge services run on AWS.

In this model, network stability and high availability are critical:

• Direct Connect provides low-latency, high-bandwidth, stable private connectivity. It also has longer deployment cycles, higher cost, and possible physical-circuit failures.
• Site-to-Site VPN builds encrypted tunnels over the internet. It is fast to deploy and inexpensive, but network quality depends on the public internet.

The best design combines both: private-line performance with VPN flexibility.

2. Architecture: Direct Connect Primary, VPN Backup

We recommend an active/passive pattern:

• Primary path: AWS Direct Connect, usually 1G or 10G, carrying normal business traffic.
• Backup path: AWS Site-to-Site VPN, automatically taking over when Direct Connect fails.

Topology

[Corporate Data Center] <========================> [AWS Region]
       |                                              |
       |---(Primary: Direct Connect BGP)------------->|---[Direct Connect Gateway]
       |                                              |            |
       |---(Backup: Site-to-Site VPN BGP)------------>|---[Transit Gateway / VGW]

3. Routing Strategy and Key Configuration

Automatic failover depends on BGP, or Border Gateway Protocol. AWS advertises VPC CIDR routes to the data center through both Direct Connect and VPN. The customer-premises router also advertises on-premises prefixes back to AWS.

Path Selection

For traffic from AWS back to the data center, AWS chooses paths in this order:

1. Longest prefix match first.
2. Direct Connect over VPN when the same prefix is received from both paths.

This means return traffic uses Direct Connect by default. When Direct Connect fails and its route is withdrawn, traffic shifts to VPN automatically.

Controlling Data Center to AWS Traffic

For traffic from the data center to AWS, configure the customer-premises router:

• Local Preference: set a higher local preference for the Direct Connect BGP neighbor.
• AS Path Prepending: optionally make the VPN path less preferred by increasing its AS path length.

# Cisco-style pseudocode
router bgp 65000
 neighbor 10.0.0.1 remote-as 64512 ! DX neighbor
 neighbor 10.0.0.1 route-map PREFER_DX in
 neighbor 192.168.1.1 remote-as 64512 ! VPN neighbor
!
route-map PREFER_DX permit 10
 set local-preference 200 ! Prefer DX

4. Failover and Recovery Testing

Failover Time

• BGP keepalive and hold time: the default hold time is often 90 seconds. A hard link failure may take up to 90 seconds to detect.
• Optimization: enable BFD, or Bidirectional Forwarding Detection. Direct Connect supports BFD and can reduce fault detection to milliseconds, often under one second.

Recovery

When the Direct Connect circuit recovers, the BGP session is reestablished. Because AWS prefers Direct Connect over VPN for the same route, traffic automatically moves back to the private link. Practice failback during low-traffic windows to avoid route flapping.

5. Cost and Security

• Cost: a standby VPN only generates meaningful data-transfer charges during Direct Connect failures. In normal operation, it mainly incurs VPN connection-hour fees. This is far cheaper than running two Direct Connect circuits.
• Security: although VPN uses the public internet, IPSec provides strong encryption. For stricter requirements, consider Direct Connect + MACsec, but confirm hardware support first.

6. Summary

The combination of Direct Connect and Site-to-Site VPN is one of the most cost-effective high-availability patterns for hybrid cloud networking. With proper BGP configuration and BFD optimization, companies can build a resilient network foundation that protects business continuity.