MPLS to Hybrid Cloud Migration: A 6-Month Log From Douala

Deploying cloud architectures in Europe or North America is one thing. Doing it in Central Africa, dealing with local connectivity realities, is a completely different challenge. Recently, I led a migration from an expensive MPLS network to a hybrid cloud infrastructure for an industrial group based in Douala, Cameroon. Here is our technical log and architectural decisions from the field.

The Initial Constraint: The Illusion of Stable Fiber

Prior to the migration, the client relied on private MPLS links connecting their headquarters in Douala to 3 remote manufacturing plants. The monthly cost was high for a bandwidth capped at 4 Mbps per site, with high packet loss rates during the heavy rainy seasons. The goal was to migrate collaborative tools, Active Directory, and inventory systems to Microsoft Azure, while keeping heavy industrial software running on-premise.

The Solution: Redundant IPSec VPNs with BGP Routing

To ensure high availability without paying for dedicated leased lines (like ExpressRoute), we deployed local Fortinet firewalls connected to an active-active Azure VPN Gateway.

The key to success was setting up dual VPN tunnels: a primary tunnel via local fiber and a secondary backup tunnel routed through an industrial 4G/LTE antenna or satellite link in case of physical fiber cuts. Automated failover was managed using BGP (Border Gateway Protocol) routing.

Here is the Terraform (IaC) configuration snippet used to provision the active-active gateway on Azure:

# Provisioning Azure VPN Gateway (Active-Active Double Tunnel)
resource "azurerm_virtual_network_gateway" "vpn_gw" {
  name                = "douala-azure-vpn-gw"
  location            = "westeurope"
  resource_group_name = "production-rg"

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "VpnGw1"
  active_active = true

  ip_configuration {
    name                          = "vnetGatewayConfig1"
    public_ip_address_id          = azurerm_public_ip.vpn_ip_1.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway_subnet.id
  }

  ip_configuration {
    name                          = "vnetGatewayConfig2"
    public_ip_address_id          = azurerm_public_ip.vpn_ip_2.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway_subnet.id
  }
}

Active Directory Compromise: Mandatory Hybrid Setup

Forcing local workstations in Douala to depend on Azure AD servers in Dublin with 140ms latency and high internet drop risks would have paralyzed operations during outages.

Our decision: Maintain physical Domain Controllers (Active Directory) locally at the Douala HQ (replicated to a secondary local node) and use Azure AD Connect to sync identities to the cloud. If the internet connection drops, local domain authorization continues to work seamlessly.

6-Month Outcome

By dropping traditional MPLS in favor of redundant broadband links coupled with a secure Azure VPN Gateway, the client slashed network operation costs by 75%. Failover time to the backup 4G/LTE link is under 5 seconds (transparent to users). This project proves that cloud architecture in Central Africa must be hybrid by default, treating network failures not as anomalies, but as a regular parameter of system design.