Hybrid and Multi-Cloud Connectivity
Hybrid connectivity is a major CNEcl topic: VPN versus dedicated circuits, BGP route exchange, redundancy, and DNS across environments. The exam expects you to diagnose why a tunnel is up but traffic still fails.
Core rules
- Site-to-site VPN uses IPsec over the internet; dedicated interconnect (Direct Connect, ExpressRoute, Interconnect) bypasses the public internet and takes longer to provision.
- BGP advertises prefixes. If a prefix is not advertised or is filtered, the tunnel can be UP while traffic is undeliverable.
- Redundancy requires two tunnels on diverse paths and, ideally, two customer gateway devices.
- MTU: IPsec overhead reduces usable MTU; jumbo frames on dedicated links may not match the internet path.
- DNS: forwarding rules and private zones must exist on both sides for name resolution.
- Private endpoints (PrivateLink, Private Service Connect) avoid exposing services to the public internet.
Worked example
On-premises 172.16.0.0/16 must reach cloud 10.10.0.0/16. Two IPsec tunnels terminate on a virtual gateway; BGP advertises 172.16.0.0/16. The tunnel is UP but pings fail. Check that the cloud route table has a propagated route for 172.16.0.0/16, the on-premises firewall allows 10.10.0.0/16, the security group allows ICMP, and the on-premises router has a return route. A missing return route is the most common cause.
Traps
- A single tunnel with no high availability.
- Overlapping prefixes causing BGP to reject or prefer the wrong path.
- Forgetting on-premises return routes.
- Ignoring MTU black holes for large packets.