REPEAT 2 AWS Networking Fundamentals NET201-R2

NET201-R
AWS networking fundamentals
Alan Halachmi Steve Seymour

Director, Public Sector WW Tech Leader, Networking
AWS Solutions Architecture AWS Solutions Architecture
Amazon Web Services Amazon Web Services
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS global infrastructure
AWS Region
US-EAST-1
Availability Zone (AZ)
US-EAST-1
Availability Zone Availability Zone

US-EAST-1A US-EAST-1B
Data center
Rack, host, EC2 instance
US-EAST-1

Instance Instance
Instance Instance
US-EAST-1

VPC
Instance Instance
Instance Instance
US-EAST-1

VPC
Instance Instance
Instance Instance
Amazon Virtual Private Cloud (Amazon VPC)
VPC
Subnets
VPC
Public subnet Public subnet
Private subnet Private subnet

EC2 instances
VPC
Instance Instance
Instance Instance
Gateways, endpoints & peering
VPC
Instance Instance
Instance Instance
Example web application
VPC
ELB
Web Server
Security Group
Web Server Web Server
App Server
Security Group
Application Application
Server Server
IP addressing
VPC

Private IP address range for your VPC – IPv4
• ”CIDR” Range ?
• Classless Inter-domain Routing
• No more Class A, B, C
• RFC1918
• 192.168.0.0 /16
• 172.16.0.0 /12
• 10.0.0.0 /8
• How much ?
• /16
• /28
Where to use IPv4 addresses ?
VPC
Subnet Subnet
172.31. 172.31.
Subnet Subnet
172.31. 172.31.
IPv6 basics
IPv6: Colon-Separated Hextet Notation + CIDR
2001:0db8:0ec2:0000:0000:0000:0000:0001/64 0000:0000:0000:0000:0000:0000:0000:0001/128
2001:db8:ec2:0:0:0:0:1/64 0:0:0:0:0:0:0:1/128
2001:db8:ec2::1/64 ::1/128
Unicast Addresses
Loopback Address ::1
Link Local Address (LLA) fe80::/10 (fe80::/64 in practice)
Global Unicast Address (GUA) 2600:1f16:14d:6300::/64
Multicast Addresses (ff00::/8)

All Nodes ff02::1
All Routers ff02::2
Solicited Node ff02::1:ff00:0/104
IPv6 on AWS
• /56 VPC
• /64 Subnets
• Dualstack
• Link Local Address and Global Unicast Address required IPv4 Private Address
IPv6 Link Local Address
(Private)
IPv6 Global Unicast Address
(Public)
Where to use IPv6 addresses ?
VPC
Subnet Subnet
172.31. 172.31.
2600:1f16:14d:6300::/64 2600:1f16:14d:6301::/64
Subnet Subnet
172.31. 172.31.
2600:1f16:14d:6328::/64 2600:1f16:14d:6329::/64
2600:1f16:14d:6300::/56
The “5 Things” required for Internet traffic
1. Public IP Address
2. Internet Gateway Attached to a VPC
3. Route to an Internet Gateway
4. NACL Allow Rule
5. Security Group Allow Rule
Public IP addresses for your instances
• Auto-assign public IP addresses
• Elastic IP Addresses (EIP)
• Amazon EIP Pool
• Bring Your Own IP (BYOIP) Pool

Public IP addresses
VPC
Subnet Subnet
Subnet Subnet
Gateways, endpoints & peering
Customer Gateway VPN Gateway NAT Gateway Internet Gateway AWS Transit Gateway Endpoints Peering connection
Internet access
Internet access
Different routes for different subnets
Public subnet
Private subnet
Public & private subnets
Private subnet Public subnet
Network Address Translation (NAT) Gateway
Private subnet Public subnet
Network security
• Network ACLs
• Security Groups
• VPC Flow Logs
• Amazon VPC Traffic Mirroring
Network ACLs
VPC
Server Server
Security groups – Inbound
VPC
Web Server
Security Group
sg-0f004ca5495132527
App Server
Security Group
sg-090a960aee374b3cd
Server Server
Security groups – Outbound
VPC
Web Server
Security Group
sg-0f004ca5495132527
App Server
Security Group
sg-090a960aee374b3cd
Server Server
VPC flow logs
• Amazon CloudWatch Logs or Amazon S3
• Does not impact throughput or latency
• Apply to VPC, Subnet, or ENI
• Accepted, Rejected, or All traffic

Amazon VPC traffic mirroring
• Mirror to another ENI or Network Load Balancer with UDP listener
• Packet copy. Shares interface bandwidth.
• Traffic mirror filters to define “interesting traffic”
• Traffic mirror session is the combination of source, target, and filter
Filter 1
High availability & scale
Web Server
Elastic Load Balancing
Web Server
Web Server
Elastic Load Balancing (ELB) distributes incoming application or network Web Server
traffic across multiple targets, such as Amazon EC2 instances, containers,

Lambda functions, and IP addresses, in multiple Availability Zones.
ELB: Options
Application Load Balancer Network Load Balancer Classic Load Balancer
ALB: Components
Listener Rule
IP Target
Listener
Health check
Forward /img/*
Target Group
Target
default
Web Server
Web Server
Health check
Example web application
VPC
ELB
Web Server
Security Group
App Server
Security Group
Server Server
Example web application – Final
VPC
ELB
Web Server
Security Group
App Server
Security Group
Server Server
Connecting between VPCs
AWS Cloud
VPC VPC
VPC
VPC peering – same region
AWS Cloud
VPC VPC
VPC
AWS Cloud
VPC VPC
Peering
VPC
AWS Cloud
VPC
Peering
VPC
AWS Cloud
Peering
VPC VPC
Peering Peering
VPC
AWS Cloud
Peering
VPC VPC
Peering Peering
VPC
AWS Cloud
Peering
VPC VPC
Peering Peering
VPC
AWS Cloud
Peering
VPC VPC
Peering
VPC
AWS Cloud
Peering
VPC VPC
Peering
VPC
VPC peering – different region
VPC peering – different account
VPC peering – things to know
• Can reference security groups from the peer VPC in the same region
• Can enable DNS hostname resolution to return private IP addresses
• Can peer for both IPv4 & IPv6 addresses
• Cannot have overlapping IP addresses
• Cannot have multiple peers between the same pair of VPCs
• Cannot use jumbo frames across inter-region VPC peering

AWS site-to-site VPN setup – VGW
VPC 10.0.0.0/16
Corporate Data Center
172.16.0.0/16
Virtual Private
Gateway
AWS site-to-site VPN – CGW
VPC 10.0.0.0/16
172.16.0.0/16
Virtual Private Customer

Gateway Gateway
IP Address not needed when

Certificate is used
AWS site-to-site VPN
I don’t…
VPC 10.0.0.0/16 I know how to get to
172.16.0.0/16 Corporate Data Center
172.16.0.0/16
Instance Virtual Private Customer

Gateway Gateway
1x VPN Connection = 2x VPN Tunnels

VPC 10.0.0.0/16
172.16.0.0/16

Gateway Gateway
172.16.0.0/16
via VGW

VPC 10.0.0.0/16
1 Tunnel always preferred 172.16.0.0/16

Gateway Gateway
172.16.0.0/16
via VGW

1x VPN Tunnel = 1.25Gbps
AWS Direct Connect – physical connection
AWS Global Network

172.16.0.0/16
AWS
Customer Customer
Router
Router Router
Direct Connect
Location
AWS Direct Connect – Interface types
• Private VIF – Used to connect to Amazon VPCs using private IP

addresses; directly or via Direct Connect gateway
• Transit VIF – Used to connect to AWS Transit Gateways via Direct
Connect gateway
• Public VIF – Used to access all AWS public services using public IP
addresses
All Virtual Interfaces are 802.1Q VLANs with BGP peering

AWS Direct Connect gateway – Private VIF
AWS Global Network
Region
VPC Corporate Data Center

10.0.0.0/16 Private Virtual 172.16.0.0/16
Interface
VPC
10.1.0.0/16
AWS
Customer Customer
Router
Router Router
Region
Direct Connect
VPC
10.2.0.0/16 Location
Direct
Connect
Gateway
Route propagation
• Enable propagation on the Route Table
• Automatically populates with anything the VGW learns via BGP
VPC 10.0.0.0/16 VGW

Corporate Data Center (192.168.0.0/16)
DX or S2S VPN
AWS Direct Connect – Public VIF
AWS Global Network
Amazon DynamoDB
Amazon Simple Storage Public Virtual 172.16.0.0/16
Service (Amazon S3) Interface
Amazon CloudWatch
AWS
Customer Customer
Router
Router Router
Direct Connect
VPC
Interconnecting VPCs at scale – VPC peering
AWS Cloud
Peering
VPC VPC
Peering Peering
VPC
Interconnecting VPCs at scale – VPC peering
AWS Cloud
VPC
Peering VPC
Peering VPC
Peering Peering Peering Peering
VPC VPC VPC
Peering Peering
Multiple VPCs access models – AWS Transit Gateway
AWS Cloud
VPC VPC VPC
AWS Transit Gateway
VPC VPC VPC

AWS Transit Gateway with AWS site-to-site VPN
VPC
VPC
VPN Attachment 172.16.0.0/16
VPC
AWS Transit Gateway
VPC TGW Route Table

172.16.0.0/16 via VPN
VPC Route Table
172.16.0.0/16 via TGW
AWS Transit Gateway with DX gateway
AWS Global Network
Region
VPC Corporate Data Center

10.0.0.0/16 Transit Virtual 172.16.0.0/16
Interface
VPC AWS
10.1.0.0/16 Transit AWS Customer
Gateway Customer
Router Router
Router
Region
Direct Connect
VPC
AWS
Transit
Gateway DX
Gateway
Amazon Route 53 Resolver
• VPC+2 Resolver VPC 10.0.0.0/16
• enableDnsHostnames
Instance
• enableDnsSupport
10.0.0.2
Route 53 Resolver
• Private Hosted Zones

PRIVATE HOSTED
ZONE: example.aws
• Inbound and Outbound Endpoints

VPC DNS options
Have EC2 auto-assign DNS

host names to instances Use Amazon DNS server
Amazon Route 53 private hosted zones
example.demohostedzone.org
Private Hosted→
172.31.0.99 Zone
Associating private hosted zones to multiple VPCs
VPC 10.0.0.0/16 VPC 10.1.0.0/16
Instance Instance
10.0.0.2 10.1.0.2
Route 53 Resolver Route 53 Resolver
PRIVATE HOSTED Associate PRIVATE HOSTED

ZONE: example.aws ZONE: example.aws
PRIVATE HOSTED PRIVATE HOSTED

ZONE: example2.aws ZONE: example2.aws
Resolving AWS domains from on-premises – Route
53 Resolver
VPC 10.0.0.0/16
172.16.0.0/16
Route 53
Resolver
Inbound ENI
Server
10.0.0.2
Route 53 Resolver
PRIVATE HOSTED
ZONE: example.aws
Resolving on-premise domains from AWS – Route 53
Resolver
VPC 10.0.0.0/16
172.16.0.0/16
Route 53
Resolver
Instance Outbound ENI
Server
10.0.0.2
Route 53 Resolver
PRIVATE ZONE:
example.internal
RESOLVER RULE:
FORWARD: example.internal
TO: Server
Other AWS services in your VPC
• Amazon Relational Database Service (Amazon RDS)
VPC
Subnet Subnet
Instance Instance
SERVICE VPC
Subnet Subnet
P S
Amazon RDS Amazon RDS
instance instance
• Amazon Relational Database Service (Amazon RDS)
VPC
Subnet Subnet
Instance Instance
SERVICE VPC
Subnet Subnet
P S
Amazon RDS Amazon RDS
instance instance
• Amazon WorkSpaces
VPC
Subnet Subnet
Instance Instance
SERVICE VPC
Subnet Subnet
Streaming
Gateway
• Amazon WorkSpaces
VPC
Subnet Subnet
Instance Instance
SERVICE VPC
Subnet Subnet
WorkSpace WorkSpace WorkSpace WorkSpace
Streaming
Gateway
• AWS Lambda
• VPC-2-VPC NAT (V2N) Availability Zone Availability Zone
VPC
Subnet Subnet
Instance Instance
LAMBDA SERVICE VPC V2N

Gateway VPC endpoints
US-EAST-1
Availability Zone Internet Gateway Availability Zone

US-EAST-1A (IGW) US-EAST-1B
VPC
Amazon S3
Instance Instance
Route Table
Private subnet (Main) Private subnet
DynamoDB
Instance Instance
US-EAST-1

VPC
Amazon S3
Instance Instance
Route Table
DynamoDB
Instance Instance
US-EAST-1

VPC
Amazon S3
Instance Instance
Route Table
DynamoDB
Instance Instance
US-EAST-1

VPC
Amazon S3
Instance Instance
Route Table
DynamoDB
Instance Instance
US-EAST-1

VPC
Amazon S3
Instance Instance
Route Table
DynamoDB
Instance Instance
US-EAST-1

VPC
Amazon S3
Instance
Route Table
Gateway
VPC Endpoint
DynamoDB
Instance
US-EAST-1

VPC
Amazon S3
Instance
Route Table
DynamoDB
Instance
US-EAST-1

VPC
Amazon S3
Instance
Route Table
DynamoDB
Instance
US-EAST-1

VPC
Amazon S3
Instance
Route Table
DynamoDB
Instance
Interface VPC endpoints (AWS PrivateLink)
US-EAST-1

AWS Transfer for SFTP

VPC Amazon API Gateway
Amazon CloudWatch
Instance Instance AWS CodeCommit
Amazon Kinesis
Private subnet Private subnet Data Streams
AWS Systems Manager
Amazon Simple Queue

Service (Amazon SQS)
US-EAST-1


sqs.us-east-1.amazonaws.com ?
Amazon CloudWatch
52.94.242.77
Amazon Kinesis
AWS Systems Manager
Amazon Simple Queue Service

US-EAST-1


Amazon CloudWatch
52.94.242.77
Amazon Kinesis
AWS Systems Manager

US-EAST-1


Amazon CloudWatch
Amazon Kinesis
AWS Systems Manager

US-EAST-1


Amazon CloudWatch
172.31.1.5 / 172.31.2.7
Amazon Kinesis
AWS Systems Manager

AWS PrivateLink – your own services
US-EAST-1

VPC (172.31.0.0/16) VPC (10.50.0.0/16)
Instance Instance

Network
Load
Balancer
AWS PrivateLink – Your own services – On-prem
Availability Zone
US-EAST-1B
172.16.0.0/16
VPC (10.50.0.0/16)
Private subnet
Instance
Private subnet DX
Network or
Load VPN
Balancer
Endpoint policies
• A VPC endpoint policy is an AWS Identity and Access Management (IAM) resource
policy that you attach to an endpoint
• An endpoint policy does not override or replace IAM user policies or service-
specific policies (such as S3 bucket policies)
Example for S3
• IAM policy at VPC endpoint: You may only access the “Data” bucket
• IAM policy at S3 bucket: Access to this bucket is only allowed from VPCE-X
Your VPC Availability Zone
US-EAST-1A
IGW
Availability Zone
US-EAST-1B
VPC VPC
NAT-GW NAT-GW Amazon S3
VPCE
ELB

Amazon SQS
VPC
PEERING Web Server Web Server
Private subnet Private subnet Corporate

Data Center
VPN
CGW
ENI’s
P S D
VPC+2
Route 53 Resolver X VIF
G
PRIVATE VGW AWS Transit Gateway W
HOSTED
ZONES VPN
LAMBDA WORKSPACES CGW
Security IGW VPC Flow Logs
VPC VPC
NAT-GW NAT-GW Amazon S3
VPCE
ELB

Amazon SQS
Web Server
VPC Security Group
PEERING Web Server Web Server
PrivateLink VPC
App Server
Security Group
Server Server
Traffic Mirroring P EIGW S
AWS Transit
Gateway
Related sessions
Tuesday
• NET317-R Connectivity to AWS and hybrid AWS network architectures
• NET320-R1 The right AWS network architecture for the right reason
Wednesday
• NET305-R1 Advanced VPC design and new capabilities for Amazon VPC
• NET203-L Leadership session: Networking
Thursday
• NET339 Innovation and operation of the AWS global network infrastructure
• NET322-R1 Shared VPC: Simplify your AWS Cloud scale network with VPC sharing
Learn networking with AWS Training and Certification
Resources created by the experts at AWS to help you build and validate networking skills
Free digital courses cover topics related to networking and

content delivery, including Introduction to Amazon CloudFront
and Introduction to Amazon VPC
Validate expertise with the

AWS Certified Advanced Networking - specialty exam
Visit aws.amazon.com/training/paths-specialty
Thank you!
Alan Halachmi Steve Seymour
Director, Public Sector WW Tech Leader, Networking
AWS Solutions Architecture AWS Solutions Architecture
Amazon Web Services Amazon Web Services

REPEAT 2 AWS Networking Fundamentals NET201-R2

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

REPEAT 2 AWS Networking Fundamentals NET201-R2

Uploaded by

Copyright:

Available Formats

NET201-R

AWS networking fundamentals

Alan Halachmi Steve Seymour

Availability Zone Availability Zone

Availability Zone Availability Zone

Availability Zone Availability Zone

Availability Zone Availability Zone

Public subnet Public subnet

Private subnet Private subnet

Public subnet Public subnet

Private subnet Private subnet

Public subnet Public subnet

Private subnet Private subnet

Public subnet Public subnet

Web Server Web Server

Private subnet Private subnet

Public subnet Public subnet

Private subnet Private subnet

Multicast Addresses (ff00::/8)

• Elastic IP Addresses (EIP)

• Amazon EIP Pool

• Bring Your Own IP (BYOIP) Pool

Public subnet Public subnet

Web Server Web Server

Private subnet Private subnet

Public subnet Public subnet

Private subnet Private subnet

Public subnet Public subnet

Private subnet Private subnet

• Does not impact throughput or latency

• Apply to VPC, Subnet, or ENI

• Accepted, Rejected, or All traffic

traffic across multiple targets, such as Amazon EC2 instances, containers,

Public subnet Public subnet

Web Server Web Server

Private subnet Private subnet

Public subnet Public subnet

Private subnet Private subnet

Web Server Web Server

Private subnet Private subnet

• Can enable DNS hostname resolution to return private IP addresses

• Can peer for both IPv4 & IPv6 addresses

• Cannot have overlapping IP addresses

• Cannot have multiple peers between the same pair of VPCs

• Cannot use jumbo frames across inter-region VPC peering

Virtual Private Customer

IP Address not needed when

Instance Virtual Private Customer

1x VPN Connection = 2x VPN Tunnels

Instance Virtual Private Customer

1x VPN Connection = 2x VPN Tunnels

Instance Virtual Private Customer

1x VPN Connection = 2x VPN Tunnels

AWS Global Network

Corporate Data Center

• Private VIF – Used to connect to Amazon VPCs using private IP

All Virtual Interfaces are 802.1Q VLANs with BGP peering

VPC Corporate Data Center

VPC 10.0.0.0/16 VGW

AWS Global Network

Peering Peering Peering Peering

VPC VPC VPC

VPC VPC VPC