Multi-Cloud Transit Architecture: Connecting AWS Direct Connect & Azure ExpressRoute.

Eliminating hairpinning, latency penalties, and routing loops.

As modern organizations distribute enterprise workloads across both Amazon Web Services (AWS) and Microsoft Azure, connecting cloud environments through public internet VPNs or routing traffic back through on-premises firewalls (hairpinning) introduces unacceptable latency, unpredictability, and egress cost inflation.

Building a carrier-grade multi-cloud transit architecture requires dedicated private interconnects—AWS Direct Connect (DX) and Azure ExpressRoute (ER)—terminated into a redundant carrier-neutral colocation facility or core enterprise spine-leaf routing layer. Achieving predictable sub-second failover between these clouds demands precise BGP policy engineering.

Meet-Me Colocation and Direct Cloud Gateway Peering.

In our reference architecture, enterprise routers (Cisco Catalyst 8000, Cisco Nexus, or MikroTik CCR2216) terminate redundant 10Gbps cross-connects to both cloud providers:

• Dual AWS Direct Connect: Primary connection terminates at DX Location A; secondary connection terminates at DX Location B with Direct Connect Gateway (DXGW) attached to multi-region AWS Transit Gateways (TGW).
• Dual Azure ExpressRoute: Redundant Primary and Secondary circuits over Microsoft Enterprise Edge (MSEE) peering into Azure Virtual WAN or ExpressRoute Gateway in hub VNet.
• On-Premises Fabric: Redundant spine-leaf core with 100G uplinks, running eBGP toward clouds and iBGP internally over EVPN-VXLAN.
• BFD Link Detection: Sub-second Bidirectional Forwarding Detection (BFD) enabled across all cross-connects (min-rx: 300ms, min-tx: 300ms, multiplier: 3).

Controlling Ingress and Egress with MED and AS-Path Prepending.

To avoid asymmetric routing—where traffic enters AWS via Direct Connect but return traffic exits toward Azure over the internet—traffic paths must be strictly deterministic:

1. Outbound Traffic Steering (Local Preference): Internal routers assign a higher BGP Local Preference (e.g. 200) to Direct Connect for AWS prefixes and ExpressRoute for Azure prefixes, ensuring predictable outbound path selection.

2. Inbound Traffic Steering (AS-Path Prepending & MED): For standby backup circuits, advertise routes with 3x AS-Path prepending and Multi-Exit Discriminator (MED) values to guarantee that AWS and Azure prefer the primary optical interface during steady-state operations.

With properly architected multi-cloud transit, inter-cloud latency between AWS and Azure environments within the same metropolitan zone (such as Mumbai or Hyderabad) routinely measures under 2.4ms with zero packet loss.