Multicloud AI & ERP / Cloud Networking, Edge & Zero Trust for AI
Why it matters
Network mistakes are among the hardest to undo. Overlapping IP ranges block future connections between clouds, offices and acquisitions; flat networks let one compromised server reach everything; and uncontrolled egress makes data leaks invisible.
How it works
Address plan first
Assign non-overlapping CIDR ranges to every region, cloud and on-premises site before building anything. Leave room to grow: networks are cheap, renumbering is not. An IP address management tool keeps the plan honest as teams add networks.
Public edge, private core
Only load balancers and NAT gateways belong in public subnets. Applications and databases live in private subnets with no public IPs. Route tables decide where each packet goes, and outbound internet traffic leaves through one controlled exit where it can be filtered and logged.
AWS, Azure and Google Cloud compared
| AWS | Azure | Google Cloud | |
|---|---|---|---|
| Virtual network | Amazon VPC (regional) | Virtual Network (regional) | VPC network (global) |
| Subnets | Per Availability Zone | Span all zones in a region | Regional, expandable |
| Outbound NAT | NAT gateway | NAT Gateway | Cloud NAT |
| Firewall at the workload | Security groups, NACLs | Network security groups | VPC firewall rules and policies |
| Central IP management | VPC IPAM | Virtual Network Manager IPAM | Shared VPC with planned ranges |
| Traffic records | VPC Flow Logs | VNet flow logs | VPC Flow Logs |
What makes each cloud different
AWS
AWS subnets live in a single Availability Zone, so resilient designs create matching public and private subnets in each zone. Security groups are stateful and attach to network interfaces, while network ACLs add stateless subnet-level rules. VPC IPAM plans and tracks address space across accounts.
Azure
Azure subnets span every zone in a region, which simplifies layout. Network security groups apply to subnets or NICs, and subnets can be delegated to services such as App Service or AKS. Azure is retiring default outbound internet access, so explicit NAT Gateway egress is the modern pattern.
Google Cloud
Google Cloud's VPC is global: one network spans every region, with regional subnets you can expand without downtime. Hierarchical firewall policies apply from the organization down, and Shared VPC lets a central team own the network while projects deploy into it.
Design decisions that matter
- 01Plan IP ranges for the whole estate
Every cloud, region and site, with space reserved for growth and acquisitions.
- 02Private by default
No public IPs on workloads; expose only through load balancers.
- 03One controlled egress path
NAT or firewall with logging for all outbound traffic.
- 04Flow logs from day one
You cannot investigate traffic you never recorded.
Common mistakes we see
- Default ranges everywhere. Every VPC using the same range makes later connectivity impossible without NAT tricks.
- Public IPs on servers. Direct exposure bypasses every central control.
- Flat networks. One subnet for everything lets attackers move freely.
A practical 30-day plan
- Week 1
Agree the enterprise IP plan and reserve ranges per cloud and region.
- Week 2
Build the network baseline as code: VPCs, subnets, routes.
- Week 3
Add controlled egress, firewall rules and flow logs.
- Week 4
Migrate the first workloads and remove any public IPs.
How NTS helps
NTS designs cloud network foundations across AWS, Azure and Google Cloud: enterprise IP plans, landing-zone networks as code, egress control and segmentation. We also untangle existing networks with overlapping ranges.
What you get
- An IP address plan that avoids overlaps across clouds and offices
- Hub-and-spoke or Transit network designs
- Central egress, inspection and DNS
- Network as code with documented standards
Typical outcomes
- No more overlapping IP ranges
- New networks ready in minutes from code
- Clear, auditable traffic paths
How we work with you
- 1Assess
A focused review of your cloud network foundations across AWS, Azure and Google Cloud. We look for the gaps we find most often: default ranges everywhere, public IPs on servers and flat networks.
- 2Design
A target architecture and roadmap built on the decisions that matter most: plan IP ranges for the whole estate, private by default, one controlled egress path and flow logs from day one.
- 3Build
Hands-on delivery alongside your team. We agree the enterprise IP plan and reserve ranges per cloud and region, build the network baseline as code: VPCs, subnets, routes, add controlled egress, firewall rules and flow logs, and finally migrate the first workloads and remove any public IPs.
- 4Run and improve
We manage network changes, capacity and costs, and evolve the design as new regions and clouds are added.
Why teams choose NTS for cloud network foundations
- Plan once, grow for years
We design address space and topology for the scale you will reach, not just today.
- Multicloud networking experience
We connect AWS, Azure, Google Cloud and data centers into one coherent network.
- Security by design
Segmentation and inspection are built into the topology, not bolted on later.
Book a free 30-minute review
Talk to an NTS architect about your cloud network foundations on AWS, Azure and Google Cloud.