> ## Documentation Index
> Fetch the complete documentation index at: https://docs.megaport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enabling Cloud-Native VPN/Encryption Options Over Dedicated Cloud Connectivity Paths

> This help topic describes encryption options for dedicated cloud connectivity paths with Megaport.

export const Video = ({url, text, duration, description}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Video -';
  if (typeof url !== 'string') {
    url = String(url);
  }
  if (typeof text !== 'string') {
    text = String(text);
  }
  if (!url || url === 'undefined') {
    console.error(`${errorPrefix} the \`url\` property is required — rendering an empty string instead`);
    return <></>;
  }
  if (!text || text === 'undefined') {
    console.error(`${errorPrefix} the \`text\` property is required — rendering an empty string instead`);
    return <></>;
  }
  const youtubeIconMask = "url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 576 512'%3E%3Cpath d='M549.7 124.1c-6.3-23.7-24.8-42.3-48.3-48.6C458.8 64 288 64 288 64S117.2 64 74.6 75.5c-23.5 6.3-42 24.9-48.3 48.6-11.4 42.9-11.4 132.3-11.4 132.3s0 89.4 11.4 132.3c6.3 23.7 24.8 41.5 48.3 47.8C117.2 448 288 448 288 448s170.8 0 213.4-11.5c23.5-6.3 42-24.2 48.3-47.8 11.4-42.9 11.4-132.3 11.4-132.3s0-89.4-11.4-132.3zM232 336V176l142.7 80z'/%3E%3C/svg%3E\")";
  return <div className="video-callout">
      <div className="callout my-4 flex gap-3 overflow-hidden rounded-2xl border px-5 py-4">
        <div className="mt-0.5 w-4 shrink-0" data-component-part="callout-icon">
          <svg aria-hidden="true" className="size-4 shrink-0" style={{
    WebkitMaskImage: youtubeIconMask,
    maskImage: youtubeIconMask,
    WebkitMaskRepeat: 'no-repeat',
    maskRepeat: 'no-repeat',
    WebkitMaskPosition: 'center',
    maskPosition: 'center',
    backgroundColor: '#0284c7'
  }} />
        </div>
        <div className="min-w-0 w-full text-sm" data-component-part="callout-content">
          <strong>
            Video:{' '}
            <a href={url} target="_blank" rel="noopener noreferrer">
              {text}
              <span className="sr-only"> (opens in a new tab)</span>
            </a>
          </strong>
          {}
          {duration && <> ({duration})</>}
          {}
          {description && <p className="mt-1 mb-0 text-xs text-gray-500 dark:text-gray-400">
              {description}
            </p>}
        </div>
      </div>
    </div>;
};

export const Gloss = ({term, anchor, langDir = 'en'}) => {
  const errorPrefix = '\x1b[31;1;4mERROR\x1b[0m: Gloss -';
  if (typeof term !== 'string') {
    term = String(term);
  }
  if (typeof anchor !== 'string') {
    anchor = String(anchor);
  }
  if (!term || term === 'undefined') {
    console.error(`${errorPrefix} the \`term\` property is required — rendering an empty string instead`);
    return <></>;
  }
  if (!anchor || anchor === 'undefined') {
    console.error(`${errorPrefix} the \`anchor\` property is required — rendering an empty string instead`);
    return <></>;
  }
  const lang = langDir === 'en' ? '/' : '/' + langDir + '/';
  const glossaryPage = lang + 'glossary/#' + anchor;
  return <a href={glossaryPage}>{term}</a>;
};

When implementing a dedicated connection into the public cloud through ExpressRoute to Microsoft Azure or Direct Connect to Amazon Web Services, the security of the transport path is part of a security risk assessment to minimize the risk of any potential man-in-the-middle attack.

Azure and AWS have published details on how to use VPN services through their respective dedicated cloud connectivity options:

* [Configure a site-to-site VPN over Microsoft Peering](https://docs.microsoft.com/en-us/azure/expressroute/site-to-site-vpn-over-microsoft-peering)
* [Establish a VPN Using AWS Direct Connect](https://aws.amazon.com/premiumsupport/knowledge-center/create-vpn-direct-connect/)

This topic describes several scenarios using dedicated cloud connectivity, including:

* **Scenario 1:** IPsec VPN -- Azure ER Microsoft Peering or AWS DX Public VIF
* **Scenario 2:** IPsec VPN via Megaport Cloud Router (MCR) -- Azure ER Microsoft Peering or AWS DX Public VIF
* **Scenario 3:** IPsec VPN -- Azure ER Private Peering or AWS DX Private VIF with <Gloss term="Network Virtual Appliance (NVA)" anchor="nva" /> in Azure or AWS
* **Scenario 4:** IPsec VPN -- Multicloud with Network Virtual Appliance (NVA) in Azure and AWS

<Tabs>
  <Tab title="Scenario 1">
    IPsec VPN -- Azure ER Microsoft Peering or AWS DX Public VIF

    **Prerequisites**

    * Owned public IP addresses that can be assigned to use Microsoft Peering and Public VIF. **Note:** If public IP addresses are not owned, use MCR (Scenario 2).
    * Owned network appliance capable of IPsec.

    **Megaport Technology Required**

    | Technology                  | Required | How many?                          |
    | --------------------------- | -------- | ---------------------------------- |
    | Port                        | Yes      | 1 or (2 in a Link Aggregation/LAG) |
    | Megaport Cloud Router (MCR) | No       |                                    |
    | Virtual Cross Connect (VXC) | Yes      | 1 to each CSP (Azure or AWS)       |

    <img src="https://mintcdn.com/megaport-b7713936/vzHnDWW0MkJIiKlH/images/encryption/encryptions-scenario-1.png?fit=max&auto=format&n=vzHnDWW0MkJIiKlH&q=85&s=35680718f9c27997ceb3a69b60e04386" alt="Scenario 1" width="3300" height="1751" data-path="images/encryption/encryptions-scenario-1.png" />

    **Considerations**

    * Azure and AWS use industry standard protocol IPsec AES128 or AES256 for encryption: using other protocols for security or performance is not easily customizable.
    * Azure and AWS IPsec VPN can be configured with Active-Active HA configuration.
    * The maximum throughput available to AWS Virtual Private Gateway is 1.25 Gbps. The maximum throughput of Azure VPNs depends on the VPN Gateway SKU.
  </Tab>

  <Tab title="Scenario 2">
    IPsec VPN via Megaport Cloud Router (MCR) -- Azure ER Microsoft Peering or AWS DX Public VIF

    This solution is suitable for organizations that do not own public IP addresses.

    **Prerequisites**

    * Customer-owned network appliance capable of IPsec.

    **Megaport Technology Required**

    | Technology                  | Required | How many?                                      |
    | --------------------------- | -------- | ---------------------------------------------- |
    | Port                        | Yes      | 1 (2 in a Link Aggregation/LAG)                |
    | Megaport Cloud Router (MCR) | Yes      | 1                                              |
    | Virtual Cross Connect (VXC) | Yes      | 1 to each CSP (Azure or AWS) and 1 Private VXC |

    <img src="https://mintcdn.com/megaport-b7713936/JBpJSRLp_jYNOgZM/images/encryption/encryptions-scenario-2.png?fit=max&auto=format&n=JBpJSRLp_jYNOgZM&q=85&s=412b6cb01be9c8b5e2e2cd5d168c3fd1" alt="Scenario 2" width="3300" height="1774" data-path="images/encryption/encryptions-scenario-2.png" />

    **Considerations**

    * Azure and AWS use industry standard protocol IPsec AES128 or AES256 for encryption: using other protocols for security or performance is not easily customizable.
    * Azure and AWS IPsec VPN can be configured with Active-Active HA configuration.
    * The maximum throughput available to AWS Virtual Private Gateway is 1.25 Gbps. The maximum throughput of Azure VPNs depends on the VPN Gateway SKU.
  </Tab>

  <Tab title="Scenario 3">
    IPsec (or other) VPN - Private Peering or Private VIF with [Network Virtual Appliance (NVA)](https://azure.microsoft.com/en-au/solutions/network-appliances/) in Azure or AWS.

    **Prerequisites**

    * Customer-owned IPsec-capable network appliances on-premises and in the cloud.

    **Megaport Technology Required**

    | Technology                  | Required | How many?                       |
    | --------------------------- | -------- | ------------------------------- |
    | Port                        | Yes      | 1 (2 in a Link Aggregation/LAG) |
    | Megaport Cloud Router (MCR) | No       |                                 |
    | Virtual Cross Connect (VXC) | Yes      | 1 to each CSP (Azure or AWS)    |

    <img src="https://mintcdn.com/megaport-b7713936/vzHnDWW0MkJIiKlH/images/encryption/encryptions-scenario-3.png?fit=max&auto=format&n=vzHnDWW0MkJIiKlH&q=85&s=9792dcb20fea0362e3983c1a76ae7e0f" alt="Scenario 3" width="3300" height="1545" data-path="images/encryption/encryptions-scenario-3.png" />

    **Considerations**

    * Organizations have the flexibility of the encryption method for better security or better performance.
    * Additional cost to the VMs running the NVA.
    * Organizations will need to consider how to design and deliver HA for this scenario.
    * The maximum throughput can exceed 1.25 Gbps up to the maximum Port size (1 Gbps or 10 Gbps) with the right compute power available on the NVA.
  </Tab>

  <Tab title="Scenario 4">
    IPsec (or other) VPN - Multicloud with [Network Virtual Appliance (NVA)](https://azure.microsoft.com/en-au/solutions/network-appliances/) in Azure and AWS.

    This solution is suitable for organizations with on-premises infrastructure that is not geographically close to the CSPs.

    **Prerequisites**

    * Customer owns IPsec-capable network appliances on-premises and in the cloud.

    **Megaport Technology Required**

    | Technology                  | Required | How many?                                       |
    | --------------------------- | -------- | ----------------------------------------------- |
    | Port                        | Yes      | 1 (2 in a Link Aggregation/LAG)                 |
    | Megaport Cloud Router (MCR) | Yes      | 1                                               |
    | Virtual Cross Connect (VXC) | Yes      | 1 to each CSP (Azure and AWS) and 1 Private VXC |

    <img src="https://mintcdn.com/megaport-b7713936/JBpJSRLp_jYNOgZM/images/encryption/encryptions-scenario-4.png?fit=max&auto=format&n=JBpJSRLp_jYNOgZM&q=85&s=0c93c216a64843235f5049e922016fa4" alt="Scenario 4" width="3300" height="1549" data-path="images/encryption/encryptions-scenario-4.png" />

    **Considerations**

    * Provides a flexible encryption method for better security or better performance.
    * Additional cost to the VMs running the NVA.
    * Need to consider how to design and deliver HA for this scenario.
    * The maximum throughput can exceed 1.25 Gbps with the required compute power available on the NVA.
  </Tab>
</Tabs>

## Helpful references

<Video url="https://www.youtube.com/watch?v=rdUE4X976mE" text="AWS - Azure Private IP VPN with Megaport" duration="19:35" description="This is a recording of a Megaport Live Tech Drop-in session on setting up a private IP VPN between AWS and Azure using Megaport." />

* **Readme file:** [AWS - Azure Private IP VPN with Megaport](https://github.com/Mark-Austen/mcr-aws-azure-private-ip-vpn)