Enterprise Hybrid HCI Platform Reference Architecture

Purpose and Scope

This reference architecture describes a multi-region enterprise platform that combines:

• Multiple on-premises data centers
• Hyper-converged infrastructure (HCI) for compute and storage
• Segmented network and security domains
• Integration with one or more public cloud providers

The design is intended as a pattern, not a prescription. It can be implemented with different vendors as long as they can meet the functional requirements described in each section.

Design Objectives

• Hybrid cloud connectivity
  Seamless integration between on-premises data centers and public cloud environments, with consistent security controls and routing.

• High availability and resiliency
  Three-site model: a primary region, a secondary region for synchronous or near-synchronous recovery, and an out-of-region site for disaster scenarios.

• Zero trust enforcement
  Network and security controls applied at each zone and tier: user ingress, DMZ, application, database, and management planes.

• Service separation
  Clear separation of infrastructure, DMZ, application hosting, identity, security operations, and management services.

• Operational simplicity at scale
  Repeatable patterns for segmentation, routing, and platform services that can be applied across additional regions and tenants.

High-Level Architecture

At a high level, the platform consists of:

1. Multi-Region Core Network

   • Multiple physical data centers, for example:
     • Region A: Primary data center
     • Region B: Secondary data center
     • Region C: Out-of-region data center
   • High-capacity private connectivity between sites
   • Edge connectivity to the internet and cloud providers
   • Redundant next-generation firewalls at each edge
   • Transit or core routing domain that interconnects regions and cloud VPC/VNets

2. Data Center Fabric and HCI Blocks

   • Spine-leaf switching fabric
   • HCI clusters segmented into functional blocks:
     • Infrastructure (core platform services)
     • Demilitarized Zone (DMZ)
     • Application Hosted Environment
     • High-performance SQL / SAN
   • Each block is a repeatable unit of compute, storage, and network capacity.

3. Platform Service Domains

   Logical service domains mapped onto the HCI blocks:

   • Identity and Access Management (IdAM)
     Directory services, PKI, MFA, SSO, network access control.

   • Virtual Desktop Infrastructure (VDI)
     Delivery controllers, StoreFront / gateways, VDI databases.

   • Security Operations
     Centralized logging & SIEM, vulnerability scanning, endpoint protection, monitoring.

   • Infrastructure Services
     DNS, NTP, SMTP relay, patch management, backup, file and print.

   • Management Plane
     Firewall management, network management, infrastructure orchestration and ITSM.

4. DMZ and External Access

   • External load balancers and web application firewalls (WAF)
   • External VDI gateways when required
   • Security telemetry forwarders for SIEM and monitoring systems
   • Strictly controlled flow to internal application tiers.

5. Application and Data Tiers

   • Web tier
     Public and internal web applications, typically behind WAF/LB.

   • Application tier
     Business logic services and APIs, reachable only from web tier and specific system accounts.

   • Database tier
     High-availability relational databases and specialized data services on separate network segments.

   • Container / Kubernetes platforms
     Clusters hosted within dedicated HCI blocks and integrated into the same zero-trust model.

6. Zero Trust Traffic Flow

   • User ingress via internet or private WAN
   • Edge next-generation firewall enforcing user, application, and content policies
   • DMZ WAF/LB applying HTTP/S and application-layer protections
   • Internal virtual firewalls between web, app, and database tiers
   • Deep logging of every control point into centralized SIEM.

Logical Zones

The architecture standardizes the following core zones:

• User / Access zone, including remote and on-premises users
• DMZ zone, for externally reachable services and proxies
• Application zone, hosting internal application services
• Database zone, for data stores with highest confidentiality and integrity requirements
• Infrastructure zone, for foundational services (DNS, NTP, patching, backup)
• Management zone, for administrative access and control systems
• Security operations zone, for SIEM, monitoring, and scanning

Each zone is implemented as one or more VLANs or segments, with routing and firewall policies defined between them.

Resiliency Model

The reference architecture supports:

• Intra-site resiliency
  Redundant leaf switches, HCI nodes, and security appliances.

• Inter-site resiliency
  Data replication and application failover between primary and secondary data centers.

• Out-of-region DR
  Asynchronous replication and failover procedures to a geographically distinct site.

RPO/RTO targets are mapped to application tiers and data services, not treated as one-size-fits-all requirements.

Implementation Options

The following vendors and products are examples of technologies that can implement this architecture. They are not requirements and can be substituted with equivalents that provide similar capabilities.

Compute, Virtualization, and HCI

• VMware vSphere + vSAN or VxRail
• Nutanix AHV
• Microsoft Azure Stack HCI
• Red Hat OpenShift Virtualization with underlying storage arrays

Network Fabric

• Cisco (Nexus, Catalyst, ACI)
• Arista
• Juniper QFX/EX
• HPE/Aruba

Next-Generation Firewall and Security

• Palo Alto Networks
• Fortinet
• Cisco Secure Firewall
• Check Point

Load Balancing and WAF

• F5
• Citrix / NetScaler
• NGINX (OSS or Plus)
• HAProxy with WAF extensions

Identity and Access Management

• Microsoft Active Directory / Entra ID
• Okta / Auth0
• Ping Identity
• Self-hosted platforms such as Keycloak or Authentik

SIEM and Monitoring

• Splunk
• Elastic Stack
• Microsoft Sentinel
• Datadog or similar observability platforms

Database and Data Platforms

• Microsoft SQL Server
• Oracle Database
• PostgreSQL / MySQL / MariaDB
• Managed cloud database services mapped into the same patterns

How to Use This Reference

• As a starting point for greenfield enterprise environments that require hybrid connectivity and strict segmentation.
• As a target state model for organizations modernizing legacy flat networks into HCI and zero-trust patterns.
• As a pattern library to derive specific designs, for example:
  • "Two-site only, no out-of-region DR yet."
  • "Single region, but with full DMZ and zero-trust tiers."
  • "Cloud-heavy footprint where one 'site' is a major cloud region."

Related Entries

• Multi-Site Hybrid Core Architecture - Detailed site topology and connectivity patterns
• Enterprise Disaster Recovery Architecture - DR patterns and RTO/RPO implementation
• Open Systems Reference Platform - Working implementation example

Subsequent documents in this series break down each major area, provide more detailed diagrams, and show example policies and flows.