Tutorials · DevSecOps & Cloud
How to Design a Hybrid Cloud Network: Offices, Data Centre and Cloud
Most companies now run some workloads on-premises and some in the cloud. Design addressing, connectivity, DNS, security and monitoring so everything works as one network.
Before you start
- A list of sites, applications and where each one runs
- Current IP address plan
Step by step
Plan one global address space
Give each site, data centre and cloud region its own non-overlapping range from a master plan, for example 10.0.0.0/8 split by region and site.
Choose connectivity per site
Internet VPN for small sites, SD-WAN or MPLS for many branches, dedicated cloud links (Direct Connect, ExpressRoute) for heavy or latency-sensitive traffic. Always plan a backup path.
Use a hub for cloud
Connect sites to a cloud hub (AWS Transit Gateway, Azure Virtual WAN or a hub VNet) instead of building tunnels to every VPC or VNet.
Design DNS across environments
Internal names must resolve the same way everywhere: conditional forwarding between office DNS and cloud resolvers (Route 53 Resolver, Azure DNS Private Resolver).
Keep security consistent
Same segmentation model on-premises and in the cloud: user, server, management and partner zones, with central firewall policies and logging.
Monitor end to end
Collect flow logs from cloud and on-premises, monitor VPN and link health, and measure application response time from each site.
Control cloud data costs
Data leaving the cloud (egress) is billed. Keep chatty systems close to each other and cache or replicate where it saves money.
Pro tips
- Document the design in one diagram: sites, links, hubs, address ranges and where security controls sit.
- Use infrastructure-as-code for cloud networking so it can be reviewed and rebuilt.
FAQ
Frequently asked questions
Do we need SD-WAN?
Not always. With a few sites, VPNs with dual Internet links work well. SD-WAN helps when you have many branches and want central policy and link steering.
Keep learning
Related guides
Connect your office to AWS or Azure
Read more →Plan IP addressing and subnets
Read more →Compare cloud-managed vs on-premises TCO
Read more →How to Scan Container Images, Code and IaC for Vulnerabilities With Trivy
Trivy is a free scanner for container images, file systems, Git repositories and infrastructure-as-code. Find vulnerable packages and misconfigurations before they reach production.
Read more →How to Generate an SBOM for Your Software and Scan It With Grype
A Software Bill of Materials lists every component in your software. Customers and regulations (such as the EU Cyber Resilience Act) increasingly ask for it. Generate SBOMs with Syft and check them for vulnerabilities with Grype.
Read more →How to Add Security Checks to a CI/CD Pipeline (Secrets, SAST, Dependencies, Images)
Shift security left: catch leaked secrets, insecure code, vulnerable dependencies and risky infrastructure settings automatically on every commit, before anything is deployed.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.