Diseño de Red Híbrida Cloud — DataCore Analytics SL

Conexiones configuradas

Enlace	Tipo	BW	Latencia	Estado
DX Primary Madrid→AWS	Direct Connect	2 Gbps	14 ms	UP
VPN-A Madrid→AWS	IPSec IKEv2	1.25 Gbps	28 ms	Standby
VPN-B Madrid→AWS	IPSec IKEv2	1.25 Gbps	29 ms	Standby
ER Primary Madrid→Azure	ExpressRoute	500 Mbps	19 ms	UP
VPN-C Madrid→Azure	IPSec IKEv2	250 Mbps	35 ms	Standby

Seguridad y cumplimiento

Cifrado AES-256-GCM en todos los túneles VPN (IKEv2 + PFS)
Datos personales confinados en AWS eu-west-1 y Azure westeurope (GDPR Art. 44+)
BGP autenticado (MD5) entre CPD y Transit Gateway
VPC Flow Logs habilitados → S3 + Athena (retención 90 días)
AWS PrivateLink para S3, ECR y SageMaker (sin salida a internet)
AWS Shield Standard + Azure DDoS Basic activados
Auditoría de seguridad trimestral — próxima: Sep 2026

Terraform — AWS Direct Connect + Transit Gateway

# main.tf — DataCore Analytics / AWS Hybrid

resource "aws_dx_gateway" "datacore" {
  name            = "datacore-dx-gateway"
  amazon_side_asn = 64512
}

resource "aws_dx_hosted_connection" "primary" {
  connection_id    = "dxcon-XXXXXXXX"
  name             = "datacore-dx-primary-2gbps"
  owner_account_id = var.aws_account_id
  bandwidth        = "2Gbps"
  vlan             = 101
}

resource "aws_ec2_transit_gateway" "main" {
  description                     = "DataCore Hub"
  default_route_table_association = "disable"
  default_route_table_propagation = "disable"
  amazon_side_asn                 = 64512
  tags = {
    Name    = "datacore-tgw"
    Env     = "prod"
    GDPR    = "eu-only"
  }
}

# Dual VPN failover
resource "aws_customer_gateway" "cpe_a" {
  bgp_asn    = 65100
  ip_address = "195.10.83.12" # Madrid CPD router A
  type       = "ipsec.1"
  tags       = { Name = "datacore-cpe-a" }
}

resource "aws_customer_gateway" "cpe_b" {
  bgp_asn    = 65100
  ip_address = "195.10.83.13" # Madrid CPD router B
  type       = "ipsec.1"
  tags       = { Name = "datacore-cpe-b" }
}

Terraform — Azure ExpressRoute + VPN Gateway

# azure.tf — DataCore Analytics / Azure Hybrid

resource "azurerm_express_route_circuit" "main" {
  name                = "datacore-er-circuit"
  resource_group_name = azurerm_resource_group.main.name
  location            = "westeurope"
  service_provider_name = "Telefonica"
  peering_location      = "Madrid"
  bandwidth_in_mbps     = 500

  sku {
    tier   = "Standard"
    family = "MeteredData"
  }
  tags = { GDPR = "eu-residency" }
}

resource "azurerm_virtual_network_gateway" "vpn_gw" {
  name                = "datacore-vpn-gw"
  location            = "westeurope"
  resource_group_name = azurerm_resource_group.main.name
  type                = "Vpn"
  vpn_type            = "RouteBased"
  sku                 = "VpnGw2"
  active_active       = false

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

# BGP peering config
resource "azurerm_local_network_gateway" "onprem" {
  name                = "datacore-onprem-gw"
  resource_group_name = azurerm_resource_group.main.name
  location            = "westeurope"
  gateway_address     = "195.10.83.12"
  address_space       = ["10.0.0.0/16"]
  bgp_settings { asn = 65100; bgp_peering_address = "10.0.255.1" }
}

Enrutamiento BGP — tabla de prefijos

Prefijo CIDR	Origen	Next Hop	Métrica	Estado
`10.0.0.0/16`	CPD Madrid	195.10.83.12	100	Activo
`172.16.0.0/16`	AWS VPC Prod	Transit GW	200	Activo
`172.16.128.0/18`	AWS VPC Stg	Transit GW	200	Activo
`192.168.0.0/16`	Azure VNet	ER Gateway	300	Activo
`192.168.128.0/18`	Azure Backup	ER Gateway	300	Activo

      BGP ASN — On-prem: 65100  |  AWS TGW: 64512  |  Azure VPN GW: 65515

      ECMP habilitado en Transit Gateway. Failover automático <3 seg (BFD timer 300ms).

Monitoring — CloudWatch + Azure Monitor

DX Tunnel Status (AWS)UP 99.97%

ER Circuit Status (Azure)UP 99.95%

Throughput utiliz. DX87% / 2 Gbps

Throughput utiliz. ER54% / 500 Mbps

Packet loss promedio0.01%

      Alerta activa: Throughput DX en 87% de capacidad. Recomendado escalar a 5 Gbps en Q3 2026 o activar CDN edge cache para reducir tráfico.
    

Desglose de costes mensuales

Servicio	Proveedor	Coste €/mes	% Total
Direct Connect 2 Gbps	AWS	1.240 €	43.7%
Transit Gateway	AWS	280 €	9.9%
Site-to-Site VPN (x2)	AWS	145 €	5.1%
ExpressRoute 500 Mbps	Azure	890 €	31.3%
VPN Gateway Azure	Azure	175 €	6.2%
Data transfer (estimado)	Multi	110 €	3.9%
TOTAL		2.840 €	Bajo presupuesto (3.500€)

Plan de Alta Disponibilidad

Dual router en CPD Madrid (Cisco ASR 1001-X x2 en HA activo-pasivo)
Dual VPN tunnels AWS (VPN-A + VPN-B) — failover automático via BGP BFD <3 seg
ECMP routing en Transit Gateway — distribución carga entre DX + VPN activos
Azure ER redundante — circuito primario via Telefónica; VPN-C como backup
Alertas Slack configuradas (CloudWatch SNS + Azure Monitor → Webhook)
RTO estimado: < 30 seg (DX → VPN failover) | RPO: 0 (sync BGP)

99.97%

Uptime DX

< 30s

Failover RTO

RPO (BGP sync)

Comandos de diagnóstico rápido

AWS

# Estado VPN connections
aws ec2 describe-vpn-connections \
  --filters "Name=tag:Project,Values=datacore" \
  --query "VpnConnections[].{ID:VpnConnectionId,State:State}"

# Telemetría túneles Direct Connect
aws ec2 get-vpn-connection-telemetry \
  --vpn-connection-id vpn-0a1b2c3d4e5f

# BGP routes advertised from Transit GW
aws ec2 describe-transit-gateway-route-tables

AZURE

# Estado ExpressRoute circuit
az network express-route show \
  --name datacore-er-circuit \
  --resource-group datacore-rg \
  --query "{State:circuitProvisioningState,BW:serviceProviderProvisioningState}"

# Conexión VPN Gateway
az network vpn-connection show \
  --name datacore-vpn-conn \
  --resource-group datacore-rg

# Effective routes de la NIC
az network nic show-effective-route-table \
  --name datacore-nic --resource-group datacore-rg

Arquitectura de Red Híbrida Cloud