September 14, 2023 By Anuj Jain
Nicholas Woodyard
Ryan Sumner
6 min read
Figure 1: IBM Cloud connected to other clouds and enterprise networks.

As enterprises modernize and migrate workloads to IBM Cloud, they often run into requirements that certain components of their application workloads to run on other cloud service provider networks. These requirements create a technical challenge for enterprises—especially in regulated industries (e.g., insurance, banking, healthcare, etc.)—to establish secure and reliable connectivity between the multicloud application components and services.

To help address the challenges, this blog post attempts to answer some common questions by providing a summary of key concepts and approaches that enterprises adopt for connecting IBM application workloads to other clouds. Use the article as a guide to evaluate and determine the best options and connectivity offerings that fit your use case:

  1. Why are regulated workload components spread across multiple clouds?
  2. What are the typical workloads that require multicloud connectivity?
  3. How are IBM Cloud regulated workloads set up and connected to other clouds?
  4. What are the different ways multicloud workloads can connect and communicate?

1. Why are regulated workload components spread across multiple clouds?

Enterprises in regulated industries have complex business processes (e.g., insurance underwriting, claims processing, payment processing, fraud detection, medical data processing, etc.) and numerous other automated and semi-automated workflows that drive business functions. Modernizing these processes typically requires a combination of specialized best-of-breed vendor services or application offerings that may not all exist on the same cloud.

Many home-grown custom applications continue to operate on-premises on private cloud networks, separating them from dependent components running on other clouds. Additionally, enterprises often partner with managed service providers that have a centralized cloud location but must access resources distributed across multiple clouds. Utilizing different clouds for running the workloads is also often a strategic choice to meet compliance requirements, reduce vulnerability to outages and lower the risk of vendor lock-in.

2. What are the typical workloads that require multicloud connectivity?

Workloads that require multicloud connectivity can be categorized based on high-level use cases and types of data that are exchanged across clouds. Broadly, the categories include the following:

  • Application data exchange: Client/server communication between application components across clouds (e.g., via RESTful APIs) to exchange data and complete synchronous or asynchronous transactions.
  • Batch data transfer: Ad-hoc or scheduled batch data transfers between clouds for analytical processing, archiving, AI training or data migration.
  • Administration access: Administrative remote access and communication between hosts on a cloud network and managed systems residing on other clouds, often part of managed services and third-party administration contracts.
  • Monitoring and tooling data transfer: Real-time or non-real-time transfer of logs and/or performance and security monitoring data from systems across multiple clouds to a centralized collection and management system on a different cloud.
  • Data replication: Real-time or non-real-time batch exchange of data between systems and components for replication for HA, DR, etc.

Depending on the complexity of the application, the enterprise deployments have a combination of the above workloads. Knowing the use cases and characteristics of the data exchanges across clouds are key factors for evaluating viable options for connecting the workload components.

3. How are IBM Cloud regulated workloads set up and connected to other clouds?

On IBM Cloud, enterprises with insurance and banking workloads often follow the VPC-based reference architecture from IBM Cloud for Financial Services. IBM Cloud for Financial Services provides security and controls built into the platform, automates security and compliance posture, and simplifies risk management for regulatory compliance.

Multicloud application workloads running on IBM Cloud for Financial Services VPCs connect and exchange data with applications or services running on VPCs or Software-as-a-Service (SaaS) offerings on other clouds. To enable this connectivity, enterprises choose from the cloud provider’s service offerings to enable access to and from VPCs to other clouds or networks:

Figure 2: High-level VPC reference architecture for IBM Cloud for Financial Services showing Direct Link and VPN connectivity.

IBM Cloud VPC connectivity service offerings are Financial Services Validated, ensuring compliance to the controls of the IBM Cloud Framework for Financial Services. The Site-to-Site VPN offering provides secure connectivity over the public internet, while Direct Link Connect and Direct Link Dedicated offerings provide secure and private connectivity leveraging existing partnerships with over 45 global service providers. These capabilities from IBM Cloud build trust and enable a transparent public cloud ecosystem with the features for security, compliance and resiliency that financial and other regulated institutions require.

4. What are the different ways multicloud workloads can connect and communicate?

There are three main approaches to establish connectivity between workloads running across different cloud providers:

  1. Over the public internet.
  2. Through connectivity partner networks.
  3. Direct connectivity at the data center facility.

Below is a description of the approaches and the associated IBM Cloud offerings:

Figure 3: IBM Cloud connectivity options and offerings.

Connectivity over public internet using public interfaces: One of the most common ways is application-to-application communication and connection by using secure public interfaces on the internet (e.g., public API endpoints or TCP host/ports exposed from custom applications, SaaS public API endpoints, etc.). While limited in the scope of use cases it can support, this approach is simple and frequently used because it requires no special networking resources other than public internet connectivity to and from the VPC. IBM Cloud Public Gateway and API Connect offerings provide the capabilities to utilize public interfaces and establish connectivity with services on another peer cloud:

Figure 4: High-level view of the cloud-to-cloud connectivity between IBM Cloud and other peer cloud using public interfaces on internet.

Connectivity over the public internet using virtual private networks (VPNs): Another connectivity option over the public internet is virtual private network-to-network connectivity (i.e., virtual private networks (VPNs)). IBM Client-to-Site VPN enables connecting a host running on any cloud to an IBM Cloud VPC. IBM Site-to-Site VPN enables connectivity between an IBM Cloud VPC to a VPC on another peer cloud:

Figure 5: High-level view of the cloud-to-cloud connectivity between IBM Cloud and other peer cloud using virtual private networks (VPNs).

Connectivity through provider networks: A more comprehensive approach that provides private network-to-network connectivity is connecting the cloud VPC networks through a connectivity provider partner network. The IBM Cloud Direct Link Connect offering has pre-established partnerships with various network service providers that are also connected to the other clouds. It is a multi-tenant offering and provides secure and private connectivity of IBM Cloud VPCs to other peer cloud VPCs:

Figure 6: High-level view of the cloud-to-cloud connectivity between IBM Cloud and other peer cloud through partner networks.

Direct connectivity at co-location data center facility: The most direct option for connecting the workloads is direct physical connectivity of the networks at a data center facility provider that has co-located IBM Cloud and another peer cloud. The IBM Cloud Direct Link Dedicated offering has pre-established partnerships with various co-location facilities and provides direct, secure and private single-tenant physical connectivity with other cloud networks.

Figure 7: High-level view of the cloud-to-cloud connectivity between IBM Cloud and other peer cloud at a colocation facility provider.

An important step in adopting one or more of the above approaches for an enterprise multicloud workload is to evaluate the offerings available from IBM Cloud and the peer cloud providers. Selecting a viable offering requires an evaluation of various factors in terms of short- and long-term strategic goals and technical requirements.

Wrap up

To conclude, enterprises in regulated industries can adopt the VPC-based reference architecture from IBM Cloud for Financial Services to securely connect multicloud application workloads on IBM Cloud to other clouds and on-premises networks. Leveraging offerings like IBM Site-to-Site VPN to connect over public internet or IBM Direct Link for private network connectivity with a choice of over 45 global service providers, enterprises have various options to select connectivity offerings that are best suited to meet their business and technical requirements.

Learn more about IBM Cloud for Financial Services

The next blog post provides a comparative description of the key factors to evaluate and ensure reliable and cost-effective connectivity between the clouds.

Was this article helpful?

More from Cloud

A clear path to value: Overcome challenges on your FinOps journey 

3 min read - In recent years, cloud adoption services have accelerated, with companies increasingly moving from traditional on-premises hosting to public cloud solutions. However, the rise of hybrid and multi-cloud patterns has led to challenges in optimizing value and controlling cloud expenditure, resulting in a shift from capital to operational expenses.   According to a Gartner report, cloud operational expenses are expected to surpass traditional IT spending, reflecting the ongoing transformation in expenditure patterns by 2025. FinOps is an evolving cloud financial management discipline…

IBM Power8 end of service: What are my options?

3 min read - IBM Power8® generation of IBM Power Systems was introduced ten years ago and it is now time to retire that generation. The end-of-service (EoS) support for the entire IBM Power8 server line is scheduled for this year, commencing in March 2024 and concluding in October 2024. EoS dates vary by model: 31 March 2024: maintenance expires for Power Systems S812LC, S822, S822L, 822LC, 824 and 824L. 31 May 2024: maintenance expires for Power Systems S812L, S814 and 822LC. 31 October…

24 IBM offerings winning TrustRadius 2024 Top Rated Awards

2 min read - TrustRadius is a buyer intelligence platform for business technology. Comprehensive product information, in-depth customer insights and peer conversations enable buyers to make confident decisions. “Earning a Top Rated Award means the vendor has excellent customer satisfaction and proven credibility. It’s based entirely on reviews and customer sentiment,” said Becky Susko, TrustRadius, Marketing Program Manager of Awards. Top Rated Awards have to be earned: Gain 10+ new reviews in the past 12 months Earn a trScore of 7.5 or higher from…

IBM Newsletters

Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters