Multi-cloud is a reality for the German public sector: Azure and Google Cloud are used in parallel. But how do you connect both securely — without routing sensitive data over the public internet? This article extends our guide to Azure ExpressRoute for public authorities to the multi-cloud case.
Multi-Cloud Needs Multi-Connectivity
The answer is dedicated lines to both clouds: Azure ExpressRoute for Microsoft and Google Cloud Interconnect for GCP. Both operate on similar principles and offer enterprise-grade security.
Understanding Google Cloud Interconnect
Cloud Interconnect is Google’s equivalent of ExpressRoute. Dedicated Interconnect provides physical connections, while Partner Interconnect uses carrier infrastructure.
Interconnect is crucial for a GCP migration: large data volumes must be transferred, and GKE workloads benefit from low latency.
The Architecture for Multi-Cloud
Central Network Hub — A hub connects everything: on-premises, Azure, and GCP. Routing is centrally controlled, and security is uniformly enforced.
ExpressRoute to the Azure Hub — Private Peering connects to Azure VNets. A hub-and-spoke topology distributes traffic. The Azure Landing Zone is the destination.
Interconnect to the GCP Hub — Use either Dedicated or Partner Interconnect. A Shared VPC receives the traffic. The GCP Landing Zone takes over.
Inter-Cloud Connection — Azure and GCP can also be connected directly through partner solutions or the central hub.
Quick Checklist: Multi-Cloud Connectivity
| Cloud | Connection Type | Bandwidth | Redundancy |
| Azure | ExpressRoute | As needed | Dual Circuit |
| GCP | Dedicated Interconnect | As needed | Dual Attachment |
| Inter-Cloud | Partner/Hub | As needed | Active-Active |
To-Do List for a Multi-Cloud Network
- Week 1: Conduct a traffic analysis.
- Week 2: Create a connectivity design.
- Week 3: Prepare the carrier tender.
- Month 1: Order ExpressRoute.
- Month 2: Order Interconnect.
- Month 3: Optimise routing.
- Month 4: Establish monitoring.
VPN as a Backup and Entry Point
Not every authority needs dedicated lines immediately. VPN is a valid entry point. A Site-to-Site VPN connects securely at a lower cost. Azure VPN Gateway and Cloud VPN from GCP both support IPsec and offer high availability; they are often sufficient for smaller workloads.
The transition to ExpressRoute or Interconnect can happen later when bandwidth or latency become critical — a decision we typically make in the cloud migration assessment.
Connectivity Compliance
Being BSI C5 compliant also means secure connections. The BSI-compliant cloud security concept must address connectivity. Encryption is mandatory, even on dedicated lines.
A Data Protection Impact Assessment for the cloud considers data flows. Where does data flow? Via which paths? These questions must be answered.
Optimising Costs
Multi-cloud connectivity is not cheap, but it is necessary. FinOps approaches help with optimisation: traffic routing is analysed, egress costs are allocated, and a fixed-price migration offer should include connectivity transparently.
Insight42 Multi-Cloud Network Services
We design multi-cloud networks, providing ExpressRoute and Interconnect from a single source for secure, performant, and cost-effective solutions — with managed services that monitor the connections proactively under SLA.
Connect your clouds. See Cloud Migration Beratung (German) or contact us.