Hybrid connectivity: site-to-site VPN versus Direct Connect and ExpressRoute
In short: Hybrid connectivity links your data centre or office to cloud networks. Site-to-site IPsec VPNs run over the internet and are quick and encrypted; dedicated links such as Direct Connect and ExpressRoute give steady bandwidth and latency but are not encrypted by default. Many designs use both, with BGP handling failover.
Why hybrid links matter
Few organisations move everything to the cloud at once. Applications in the cloud still need to reach on-premises databases, directory services or users. That traffic should not cross the public internet in clear text, and it needs to be reliable. There are two main options, plus the routing that ties them together.
Site-to-site VPN
A site-to-site VPN builds encrypted IPsec tunnels between your firewall or router and a cloud VPN gateway (AWS Site-to-Site VPN, Azure VPN Gateway, Google Cloud HA VPN). It uses your existing internet connection, so you can have it working the same day.
- Use IKEv2 with strong algorithms, for example AES-256-GCM and SHA-256 or better, and Diffie-Hellman group 14 or above (prefer elliptic-curve groups such as 19 or 20).
- Providers give two tunnels per connection to different endpoints; configure both.
- Use BGP so routes update automatically and failover is fast.
- Throughput per tunnel is limited (often around 1.25 Gbps on AWS), and latency varies with internet conditions.
Dedicated links
AWS Direct Connect, Azure ExpressRoute and Google Cloud Interconnect provide a private circuit from your site or a colocation facility, through a carrier or partner, into the provider's network. You get predictable latency, high bandwidth (from tens of megabits to 100 Gbps and more) and usually lower data transfer prices.
| Factor | Site-to-site VPN | Dedicated link |
|---|---|---|
| Setup time | Hours | Weeks to months |
| Cost | Low | Port, circuit and partner fees |
| Encryption | Built in (IPsec) | Add MACsec where supported, or IPsec over the link |
| Performance | Best effort | Consistent, with SLA when built redundantly |
| Good for | Small sites, backup path, quick start | Large data flows, latency-sensitive apps |
Tip: "private" does not mean "encrypted". Traffic on a dedicated link travels in clear unless you add MACsec or IPsec, and many compliance rules require encryption in transit.
Designing for resilience and security
- Use two customer routers and, for dedicated links, two circuits at different locations.
- Add a VPN as a backup path and use BGP attributes (such as AS path prepending) so the dedicated link is preferred.
- Terminate links on a cloud hub so all spokes share them and a central firewall inspects traffic.
- Filter routes: advertise only the prefixes needed in each direction.
- Plan non-overlapping IP ranges between on-premises and cloud.
- Monitor tunnel and BGP status and alert on any change.
For branch offices, SD-WAN products can also build and manage these tunnels; see SD-WAN introduction.
Practice
A company needs cloud access tomorrow for a small office. Which option fits?
Is traffic over ExpressRoute or Direct Connect encrypted by default?
How do you make sure traffic prefers the dedicated link but fails over to VPN?
Key takeaways
- Hybrid links connect on-premises networks to cloud networks.
- Site-to-site VPNs are fast, cheap and encrypted, but best effort.
- Dedicated links give steady performance but need added encryption.
- Use redundant links, BGP and a VPN backup path.
- Terminate on a cloud hub and filter routes carefully.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.