Hybrid connectivity and bandwidth economics

Hybrid link selection begins with a transfer equation. Measure sustained and peak bits per second in both directions, burst duration, required completion window, protocol overhead, encryption overhead, source and destination limits, and concurrent production traffic. Nominal circuit speed is not usable application throughput. Then state latency consistency, provisioning lead time, route convergence, encryption, and the failure scope that must survive. A one-gigabit link cannot be credited with one gigabit of useful payload continuously without evidence. For bulk movement, divide remaining bytes by remaining usable seconds and include change rate so the cutover backlog does not grow. For interactive traffic, assess p95 latency and jitter rather than only monthly bytes. Capacity plans should show normal utilization, one-path-failed utilization, and the point where a burst would queue or violate the transfer window. This arithmetic prevents a low fixed-price connection from winning despite insufficient capacity.

Public internet with application TLS can fit ordinary public connectivity when path variability is accepted. Site-to-Site VPN provides encrypted IPsec tunnels over the internet and is comparatively quick to provision, making it useful as an initial path, backup, or moderate-volume solution. Direct Connect provides dedicated connectivity with provider and cross-connect dependencies and can improve path consistency for sustained demand. Basic Direct Connect is not automatically encrypted and one connection is not redundant. Add supported MACsec, an IPsec overlay, or application TLS according to the security requirement, and use independent locations or paths when outage tolerance demands it. Compare DX port, provider, cross-connect, transfer, monitoring, and redundant capacity against VPN resources and internet-path behavior over the actual horizon. A rapidly needed twelve-week project may never recover DX lead time. A long-lived steady transfer may justify it. Preserve route policy and test failover; purchasing two logical tunnels that share the same underlying dependency does not satisfy independent-path intent.

Monitor tunnel state, BGP routes, packet loss, latency, throughput, discarded traffic, and utilization by direction. Test failure during peak demand to prove the survivor carries required traffic without violating latency or encryption. A warm backup with insufficient capacity is not resilience. Document which prefixes prefer which path and how asymmetric routing affects stateful inspection. Cost crossover depends on monthly bytes and duration as well as fixed fees; recompute when data volume, provider rates, contract term, or traffic direction changes. During DX provisioning, redundant VPN can satisfy immediate encrypted connectivity, but remove temporary excess only after the new routes and failover are proven. Conversely, retain VPN as a diverse backup when the recovery requirement values it. If demand falls and path consistency becomes unimportant, internet or VPN may regain the advantage. If residency or local response becomes the deciding constraint, this network comparison hands off to a compute-placement decision rather than pretending a faster circuit solves data-governance semantics.