Advanced Multi-Cloud Network Implementation for State Government

The agency faced several complex challenges requiring specialized expertise:

1. Complex Legacy Integration: The existing State Government Network utilized extensive per-agency network segmentation with Virtual Routing and Forwarders (VRFs), creating isolated network domains for each agency while sharing physical infrastructure.

2. Multi-Cloud Requirements: The solution needed to support Azure and AWS environments with consistent security controls and design patterns while leveraging each platform\'s native capabilities.

3. Security and Compliance: Architecture had to maintain strict security controls compliant with state security standards, NIST Cybersecurity Framework, CIS Security Controls, and NIST Risk Management Framework.

4. Technical Constraints: The solution needed to overcome constrained legacy VPN and WAN throughput limiting traffic flow to the state's Azure environment.

5. Advanced Network Requirements: The design needed to support various traffic patterns with distinct security policies:

• Agency-to-agency cloud traffic

• On-premises to cloud traffic (inter-agency and intra-agency)

• Internet ingress/egress for cloud workloads

• Cross-region and cross-cloud connectivity

CONVX led the technical design and implementation through multiple project phases:

Phase 1: Strategic Architecture Design (2023)

CONVX developed a comprehensive cloud network strategy that aligned with the agency\'s requirements. Key deliverables included:

• Requirements documentation capturing business and technical needs

• Solution candidate decision matrix for evaluating design options

• High-level design with core architectural components

• Detailed design with routing topologies and security controls

Phase 2: Low-Level Design and Lab Implementation (2024-2025)

CONVX led the development of detailed network designs and lab implementations:

• Comprehensive low-level designs for both Azure and AWS environments

• Lab implementation in both cloud environments

• Testing and validation to ensure the design met all requirements

• Terraform automation code for consistent deployment

• Operational runbooks and migration plans

Phase 3: Production Implementation (2025, in progress)

CONVX is currently leading the production deployment:

• Azure VWAN Secure Hub with integrated security

• AWS Transit Gateway with inspection VPC

• DCaaS (Domain Controller as a Service) migration to the new statewide cloud gateway network

• Integration with Cisco SD-WAN

Technical Architecture

Azure Environment

• Azure Virtual WAN with Fortinet Secure Hub integration

• Custom routing intents to direct traffic through security inspection

• BGP peering with SD-WAN for dynamic routing

• Multi-tier subnet design with carefully planned address spaces

• Integration with Azure monitoring and logging services

AWS Environment

• Transit Gateway with dedicated routing domains

• Inspection VPC with Fortinet NextGen Firewalls and Gateway Load

Balancer

• SD-WAN VPC with Cisco 8000V virtual appliances

• GRE tunneling for high-bandwidth connectivity (up to 5Gbps per tunnel)

• Secure BGP peering between Transit Gateway and SD-WAN

Integration Layer

• Cisco SD-WAN with Cat 8000V routers

• Fortinet NextGen Firewalls for unified security controls

• Azure DevOps CI/CD pipelines for infrastructure deployment

• Terraform IaC for consistent, repeatable deployments

The CONVX-led network implementation is delivering significant benefits:

1. Cost Reduction: The solution will save approximately 65% compared to dedicated solutions for each agency.

2. Operational Efficiency: Provisioning time for new agency connections reduced by up to 80% compared to traditional private WAN services.

3. Enhanced Security: Implemented inspection for all network traffic flows with centralized policy management.

4. Future-Ready Foundation: Created a platform capable of supporting the state\'s cloud-first strategy and adoption roadmap.

5. Simplified Management: Provided consistent architectural patterns and automation across cloud providers.

Technical Innovations

• SD-WAN Integration: Successfully extended on-premises VRF

segmentation to the cloud through Cisco SD-WAN, maintaining routing isolation between agencies while leveraging a shared security infrastructure.

• Secure Transit Design: Implemented a robust routing design that

forces traffic through inspection points regardless of source or destination.

• Scale-Out Security Architecture: Designed security components that

can dynamically scale with traffic volumes, particularly in AWS using Gateway Load Balancer.

• Migration Path for Legacy Services: Created detailed migration

plans for critical services like Domain Controller as a Service (DCaaS), enabling seamless transition to the modern architecture.

• Automated Deployment: Developed comprehensive Terraform code for

both Azure and AWS environments, ensuring consistent and repeatable deployments.

Customer Relationship

While specific testimonials aren\'t available due to confidentiality, the agency\'s continued engagement of CONVX through multiple project phases demonstrates their confidence in our expertise and delivery capabilities. The sequential engagement of CONVX to lead this initiative from strategy through implementation provides proof of our technical leadership and ability to execute complex networking projects.

The statewide cloud gateway network project showcases CONVX\'s ability to navigate complex requirements and deliver modern cloud networking solutions in demanding enterprise environments. By applying deep expertise in both cloud-native networking and traditional infrastructure, CONVX created a unified, secure, and scalable foundation that will support the state\'s cloud journey for years to come.

The success of this engagement demonstrates our capacity to:

• Lead complex technical initiatives within large government

organizations

• Navigate strict security and compliance requirements

• Bridge legacy infrastructure with modern cloud platforms

• Design solutions that work across multiple cloud providers

• Deliver tangible business outcomes through technical transformation