Build the cloud foundation and the paths into it.
Manufacturing & Industrial
Azure landing zone, repeatable deployment and connections to facilities and AWS.
The constraint
Cloud networking, security and deployment processes had to align with the existing environment. Changes to AWS Direct Connect and facility connectivity also needed to be sequenced around live services.
Our work
The client’s Azure landing zone needed dependable connections to its facilities and existing cloud services. Quokka and a delivery partner delivered the landing zone and cloud connections as one coordinated project.
What changed
Build a connected Azure foundation
Design the hub-and-spoke network, central inspection and connectivity to the existing estate. Include the security and routing requirements before deploying workloads.
Coordinate the facility and cloud connections
Bring together Megaport, Azure ExpressRoute, AWS Direct Connect and VPN connectivity, with a planned sequence for changing live paths.
Deliver the deployment process with the environment
Use Azure Bicep and Azure DevOps for repeatable infrastructure deployment. Include code, review controls, cutover and operating handover in the delivery.
The result
The Azure landing zone and its cloud connections were delivered together, from design and build through deployment and operating handover. The deployment code was included so the team could maintain the environment through a repeatable process.
Quokka delivered the cloud foundation and connectivity with a delivery partner.
The engineering decisions.
The landing zone, inspection policies and facility connections formed one migration. Quokka delivered the deployment code and operating handover with the environment.
Keep cloud on-ramps distinct and coordinated
The connectivity design joins the existing estate to AWS Direct Connect and Azure ExpressRoute through Megaport. Paired ports and separate virtual connections provide the planned link and service resilience. Quokka coordinated the on-premises and cloud route changes with the landing zone build, so connectivity and workload migration followed the same cutover plan.
Combine hub inspection with deliberate route selection
The Azure hub hosts Palo Alto Networks VM-Series inspection and shared connectivity for the workload spokes. The security design includes BGP and ECMP peerings with Azure Route Server for the available on-premises paths. Azure routes and the inspection configuration work together to keep hybrid, cloud-to-cloud and internet traffic on the intended paths.
Carry existing access into the new security policy
The migration design starts with existing Azure access rules, then uses the inspection logs to inform tighter rules after cutover. Panorama templates, device groups and security profiles provide common management, with workload-specific changes where required. The team can review application access while moving the enforcement point.
Hand over the process for changing the environment
Azure Bicep defines the infrastructure and Azure DevOps provides the repository and deployment pipeline. The design includes review requirements, branch controls and deployment permissions. The completion report records the landing zone, connectivity, deployment code and operating handover together, giving the team a repeatable way to maintain the delivered environment.
What needs to work better?
Talk to us about the environment, the constraint and the change.