How is the cloud compute cluster of an engineering firm secured as an extended perimeter, and which components are needed?
Build the cloud cluster as a private network (private LAN with private IPs on Layer 3, a virtual switch on Layer 2), connect it to the on-premises network through a VPN router, and use firewalls to block unwanted traffic. Everything is configured restrictively; in particular the internet stays unreachable for the cluster and the AI.
* A private cloud network joined to on-premises by VPN, with firewalls at both ends and no route to the internet. *
The system analysis puts the engineers, CAD tool and experience database on-premises; the AI algorithm and model software on a virtual cluster in the cloud; and the production plant (OT) on-premises receiving the results. The interactions are: parameters and a start command go up, results (CAD data) come back down to storage and then on to production.
Components for the cloud side:
- private LAN, private IP for the cluster (Layer 3);
- virtual switch (Layer 2);
- VPN router;
- firewall to prevent unwanted traffic.
The design brief was to solve it provider-neutrally first, so the components are named by function. Any of the large cloud providers offers virtual equivalents.
Go deeper:
AWS — What is Amazon VPC? — the same idea at another provider, under different names.- Microsoft Learn — Azure network foundation services — virtual networks, private links and gateways as named at one provider.