September 14, 2023 By Anuj Jain
Nicholas Woodyard
Ryan Sumner
6 min read
Figure 1: IBM Cloud connected to other clouds and enterprise networks.

As enterprises modernize and migrate workloads to IBM Cloud, they often run into requirements that certain components of their application workloads to run on other cloud service provider networks. These requirements create a technical challenge for enterprises—especially in regulated industries (e.g., insurance, banking, healthcare, etc.)—to establish secure and reliable connectivity between the multicloud application components and services.

To help address the challenges, this blog post attempts to answer some common questions by providing a summary of key concepts and approaches that enterprises adopt for connecting IBM application workloads to other clouds. Use the article as a guide to evaluate and determine the best options and connectivity offerings that fit your use case:

  1. Why are regulated workload components spread across multiple clouds?
  2. What are the typical workloads that require multicloud connectivity?
  3. How are IBM Cloud regulated workloads set up and connected to other clouds?
  4. What are the different ways multicloud workloads can connect and communicate?

1. Why are regulated workload components spread across multiple clouds?

Enterprises in regulated industries have complex business processes (e.g., insurance underwriting, claims processing, payment processing, fraud detection, medical data processing, etc.) and numerous other automated and semi-automated workflows that drive business functions. Modernizing these processes typically requires a combination of specialized best-of-breed vendor services or application offerings that may not all exist on the same cloud.

Many home-grown custom applications continue to operate on-premises on private cloud networks, separating them from dependent components running on other clouds. Additionally, enterprises often partner with managed service providers that have a centralized cloud location but must access resources distributed across multiple clouds. Utilizing different clouds for running the workloads is also often a strategic choice to meet compliance requirements, reduce vulnerability to outages and lower the risk of vendor lock-in.

2. What are the typical workloads that require multicloud connectivity?

Workloads that require multicloud connectivity can be categorized based on high-level use cases and types of data that are exchanged across clouds. Broadly, the categories include the following:

  • Application data exchange: Client/server communication between application components across clouds (e.g., via RESTful APIs) to exchange data and complete synchronous or asynchronous transactions.
  • Batch data transfer: Ad-hoc or scheduled batch data transfers between clouds for analytical processing, archiving, AI training or data migration.
  • Administration access: Administrative remote access and communication between hosts on a cloud network and managed systems residing on other clouds, often part of managed services and third-party administration contracts.
  • Monitoring and tooling data transfer: Real-time or non-real-time transfer of logs and/or performance and security monitoring data from systems across multiple clouds to a centralized collection and management system on a different cloud.
  • Data replication: Real-time or non-real-time batch exchange of data between systems and components for replication for HA, DR, etc.

Depending on the complexity of the application, the enterprise deployments have a combination of the above workloads. Knowing the use cases and characteristics of the data exchanges across clouds are key factors for evaluating viable options for connecting the workload components.

3. How are IBM Cloud regulated workloads set up and connected to other clouds?

On IBM Cloud, enterprises with insurance and banking workloads often follow the VPC-based reference architecture from IBM Cloud for Financial Services. IBM Cloud for Financial Services provides security and controls built into the platform, automates security and compliance posture, and simplifies risk management for regulatory compliance.

Multicloud application workloads running on IBM Cloud for Financial Services VPCs connect and exchange data with applications or services running on VPCs or Software-as-a-Service (SaaS) offerings on other clouds. To enable this connectivity, enterprises choose from the cloud provider’s service offerings to enable access to and from VPCs to other clouds or networks:

Figure 2: High-level VPC reference architecture for IBM Cloud for Financial Services showing Direct Link and VPN connectivity.

IBM Cloud VPC connectivity service offerings are Financial Services Validated, ensuring compliance to the controls of the IBM Cloud Framework for Financial Services. The Site-to-Site VPN offering provides secure connectivity over the public internet, while Direct Link Connect and Direct Link Dedicated offerings provide secure and private connectivity leveraging existing partnerships with over 45 global service providers. These capabilities from IBM Cloud build trust and enable a transparent public cloud ecosystem with the features for security, compliance and resiliency that financial and other regulated institutions require.

4. What are the different ways multicloud workloads can connect and communicate?

There are three main approaches to establish connectivity between workloads running across different cloud providers:

  1. Over the public internet.
  2. Through connectivity partner networks.
  3. Direct connectivity at the data center facility.

Below is a description of the approaches and the associated IBM Cloud offerings:

Figure 3: IBM Cloud connectivity options and offerings.

Connectivity over public internet using public interfaces: One of the most common ways is application-to-application communication and connection by using secure public interfaces on the internet (e.g., public API endpoints or TCP host/ports exposed from custom applications, SaaS public API endpoints, etc.). While limited in the scope of use cases it can support, this approach is simple and frequently used because it requires no special networking resources other than public internet connectivity to and from the VPC. IBM Cloud Public Gateway and API Connect offerings provide the capabilities to utilize public interfaces and establish connectivity with services on another peer cloud:

Figure 4: High-level view of the cloud-to-cloud connectivity between IBM Cloud and other peer cloud using public interfaces on internet.

Connectivity over the public internet using virtual private networks (VPNs): Another connectivity option over the public internet is virtual private network-to-network connectivity (i.e., virtual private networks (VPNs)). IBM Client-to-Site VPN enables connecting a host running on any cloud to an IBM Cloud VPC. IBM Site-to-Site VPN enables connectivity between an IBM Cloud VPC to a VPC on another peer cloud:

Figure 5: High-level view of the cloud-to-cloud connectivity between IBM Cloud and other peer cloud using virtual private networks (VPNs).

Connectivity through provider networks: A more comprehensive approach that provides private network-to-network connectivity is connecting the cloud VPC networks through a connectivity provider partner network. The IBM Cloud Direct Link Connect offering has pre-established partnerships with various network service providers that are also connected to the other clouds. It is a multi-tenant offering and provides secure and private connectivity of IBM Cloud VPCs to other peer cloud VPCs:

Figure 6: High-level view of the cloud-to-cloud connectivity between IBM Cloud and other peer cloud through partner networks.

Direct connectivity at co-location data center facility: The most direct option for connecting the workloads is direct physical connectivity of the networks at a data center facility provider that has co-located IBM Cloud and another peer cloud. The IBM Cloud Direct Link Dedicated offering has pre-established partnerships with various co-location facilities and provides direct, secure and private single-tenant physical connectivity with other cloud networks.

Figure 7: High-level view of the cloud-to-cloud connectivity between IBM Cloud and other peer cloud at a colocation facility provider.

An important step in adopting one or more of the above approaches for an enterprise multicloud workload is to evaluate the offerings available from IBM Cloud and the peer cloud providers. Selecting a viable offering requires an evaluation of various factors in terms of short- and long-term strategic goals and technical requirements.

Wrap up

To conclude, enterprises in regulated industries can adopt the VPC-based reference architecture from IBM Cloud for Financial Services to securely connect multicloud application workloads on IBM Cloud to other clouds and on-premises networks. Leveraging offerings like IBM Site-to-Site VPN to connect over public internet or IBM Direct Link for private network connectivity with a choice of over 45 global service providers, enterprises have various options to select connectivity offerings that are best suited to meet their business and technical requirements.

Learn more about IBM Cloud for Financial Services

The next blog post provides a comparative description of the key factors to evaluate and ensure reliable and cost-effective connectivity between the clouds.

More from Cloud

The advantages and disadvantages of hybrid cloud

6 min read - With the rapid advancements in cloud computing, data management and artificial intelligence (AI), hybrid cloud plays an integral role in next-generation IT infrastructure. Enterprise-level businesses rely on hybrid cloud solutions to run critical workloads from anywhere by combining and unifying on-premises, private cloud and public cloud environments. Just like any other IT solution, adopting a successful hybrid cloud strategy starts with examining how this cloud computing architecture can drive overall business objectives. As an initial step, business and IT leaders…

IBM Tech Now: December 11, 2023

< 1 min read - ​Welcome IBM Tech Now, our video web series featuring the latest and greatest news and announcements in the world of technology. Make sure you subscribe to our YouTube channel to be notified every time a new IBM Tech Now video is published. IBM Tech Now: Episode 90 On this episode, we're covering the following topics: IBM Quantum Heron IBM Quantum System Two The GA of watsonx.governance Stay plugged in You can check out the IBM Blog Announcements for a full…

Get ready for change with IBM Cloud Training

2 min read - As generative AI creates new opportunities and transforms cloud operations, it is crucial to learn how to maximize the value of these tools. A recent report from the IBM Institute for Business Value found that 68% of hybrid cloud users already have a formal, organization-wide policy or approach for the use of generative AI. That same report also noted that 58% of global decision makers say that cloud skills remain a considerable challenge. Being proactive in your learning can significantly…

Data center consolidation: Strategy and best practices

7 min read - The modern pace of data creation is staggering. The average organization produces data constantly—perhaps even continuously—and soon it’s investing in servers to provide ample storage for that information. In time, and probably sooner than expected, the organization accrues more data and outgrows that server, so it invests in multiple servers. Or that company could tie into a data center, which is built to accommodate even larger warehouses of information. But the creation of new data never slows for long. And…

IBM Newsletters

Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters