Huawei Cloud Network Services

• The lesson covers network cloud services on Huawei Cloud.
• The lesson describes how to use services to interconnect various resources.
• These resources include communications within a VPC in a single region.
• Further resources include communications across VPCs in a single region.
• Communications between a cloud and on-premises networks, across regions are also covered.
• Communications between a cloud and the Internet is also covered.

Objectives

• Know Huawei Cloud network services.
• Get familiar with VPCs, security groups, network ACLS, EIPS, NAT gateways, and enterprise routers
• Understand the functions, architectures, and use cases of the aforementioned items.
• Recognize the appropriate network services for different scenarios.

Huawei Cloud Network Service Overview

• Cloud access network includes items like the internet. ELB, DNS, IPv4/IPv6, EIP and NAT Gateway
• Cloud network includes VPCs and Cloud Connect
• Hybrid cloud network includes VPNs, and Direct Connect and connectivity for on-premise data centers.

Cloud Network Solution Design

• Communication within a VPC in a Single Region makes use of VPC and Subnet.
• Communication Between Cloud and On-Premises Networks makes use of Direct Connect and VPN.
• Communication Across VPCs in a Single Region utilizes VPC Peering, Enterprise Router and VPC Endpoint.
• Communication Across Regions use Cloud Connects.
• The Communications Between a Cloud and the Internet use EIP, NAT Gateway, and DNS

VPC Network Planning and Design

• A VPC is a private virtual cloud.
• When it comes to Single VPC, it has limited applications, a small service volume, a small team scale.
• Single VPC also provides low latency, high-performance computing, and simplified management.
• Multiple VPCs are implemented when different services that need to be isolated from each other for a team or organization.
• When selecting a region for a VPC, select the region that is nearest to users.
• When selecting a VPC CIDR block, reserve sufficient IP addresses for workload expansion.
• Pay attention to IP address conflicts when connecting a VPC to an on-premises data center or connect two VPCs.

VPC defined

• A Virtual Private Cloud (VPC) enables logically isolated, configurable, and manageable virtual networks.
• These allow for cloud servers, containers, and databases, improving cloud service compliance.
• VPCs simplify network deployment.
• it's a software-defined network.
• VPCs allow for the configuration of IP address ranges, subnets, routes, and firewalls.
• They provide an isolated and intra-connected network on Huawei Cloud.
• An EIP is usable to connect to the Internet.

Single VPC

• Employed when workloads need connectivity rather than isolation.
• Suitable for limited applications, small service volume, and small teams
• Suitable for low-latency services, such as high-performance computing
• Best for simplified management, like security and O&M management
• Multiple VPCs are better when there are multiple projects or enterprise projects
• Multiple accounts should also make use of multiple VPCs

Multiple VPCs

• Multiple VPCs are used for Isolation.
• Employed where different services need to be isolated from each other.
• Best where different VPCs that are used for different purposes, for example, production zone and test zone are required
• Usable to implement for a single team or organization

Considerations When Creating a VPC

• Consider the region where the VPC is to be created.
• When creating a VPC, whether VPCs need to be isolated from each other is key.
• Resource allocation and VPC quota are also a consideration.

VPC Region Selection

• Select the region nearest to users, bearing in mind VPCs are region-specific.
• VPCs do not communicate with each other over a private network even if they are in the same region by default.

VPC Isolation

• Create a dedicated VPC for a service that needs to be isolated.

Resource Allocation

• Note that not all resources depend on VPCs.

VPC Quota

• Request a VPC quota increase in advance if necessary.

Selecting a VPC CIDR Block

• An IP address range for a VPC.
• A subnet is a range of IP addresses in a VPC.
• Resources in a VPC must be deployed in subnets.
• The IP address range for a VPC is defined using Classless Inter-Domain Routing (CIDR) notation.
• Recommended VPC CIDR blocks: includes 10.0.0.0/8-24, 172.16.0.0/12-24, and 192.168.0.0/16-24
• For example, 172.16.0.0/16 contains the IP addresses from 172.16.0.0 to 172.16.255.255

Selecting a Size for a VPC CIDR Block

• Estimate the number of servers in a VPC.
• Ensure the VPC has enough IP addresses for them
• Allocate subnets in different AZs from a VPC CIDR block.
• Allocate an IP address range to each subnet based on the expected number of subnets and servers.
• Select an IP address range that leaves room for future service growth.
• Add more subnets and servers when needed without redesigning the network.
• Select an IP address range based on requirements and number of servers.
• Don't select an excessively large IP address range, which will waste IP addresses.
• Don't select a range so small there are not enough IP addresses.

Subnet Planning and Design Considerations

• A subnet should have enough IP addresses to meet service requirements.
• VPC CIDR 192.168.0.0/22 has 1,024 IP addresses, allowing four subnets to be created.
• Five IP addresses are reserved for each subnet, however this has no adverse impact on a well-designed network.
• A subnet does not need to contain all IP addresses of its VPC.

Reserved IP Addresses for each subnet

• Includes 192.168.0.0, the network address, which is the beginning of the private IP address range and is not assigned.
• Includes 192.168.0.1, the gateway address.
• Includes 192.168.0.253, that acts as a system interface and is used by the VPC for external communications.
• Includes 192.168.0.254, the DHCP service address
• Includes 192.168.0.255, the broadcast address
• Use a subnet that has enough IP addresses.
• IP addresses of the subnet must belong to its VPC, but do not need to cover all IP addresses of its VPC.
• The CIDR blocks of subnets in a VPC cannot overlap, and IPs provided by a subnet can be used by resources from a different AZ.
• One-to-one mapping exists between subnets and node types, so deploy only one type of node in a given subnet.
• Deploy nodes with the same function in the same subnet and subnets are logical concepts with no traditional restrictions.
• Each subnet needs a route table and can only have one route table associated.
• Each VPC has a default route table, associated with subnets that have no route table.
• Each route table controls traffic across VPCs.
• Default routes in a route table can't be modified or deleted
• A route table can be associated with different subnets.

Virtual Private Network (VPN)

• A VPN Provides end-to-end private communications channels
• IPsec VPN establishes encrypted communications tunnels between remote users and VPCs over a public network.
• A VPN enables remote users to access resources in the VPCs.
• Application scenarios include a site-to-cloud interconnection; connecting an on-premises data center to a VPC.
• Application scenarios also include an interconnection between VPCs in different regions

Key VPN Technologies

• VPN gateway: an egress gateway created in a VPC that can be bound to a VPC.
• VPN gateway connects to one remote gateway.
• Remote gateway: a transit device for exchanging data between a local network and a remote network over VPN connections.
• The remote gateway provides different functions such as communications data transmission, data encryption, and traffic management.
• VPN Connection: a confidential and secure IPsec-encrypted communications tunnel established over the Internet.
• This tunnel secures data transmission between different networks.

VPN Constraints and Limitations

• A local subnet is a subnet of the local network the VPN connection originates from.
• A remote subnet is the subnet on the remote network which is the destination of a VPN connection.
• The local subnet and remote subnet cannot overlap
• A VPN gateway accesses multiple subnets of the associated VPC, though the remote subnets for all VPN connections of the same VPN gateway cannot overlap.
• Also, the remote subnets for the same VPN connection cannot overlap.
• The local subnets for all VPN connections of the same VPN gateway cannot overlap.
• A VPN gateway can be associated with only one VPC.
• VPNs connects an on-premises data center to a VPC, and you can easily access ECS and storage resources on the cloud.
• It Migrates applications to the cloud, adds web servers, and extends computing capacity, creating hybrid cloud architecture

Hybrid Cloud Deployment

• VPN connects multiple on-premises data centers to a VPC for easier access to ECSs and block storage on the cloud.
• VPN establishes tunnels between two VPCs in different regions, this allows VPCs to communicate with each other

Direct Connect

• Direct Connect enables a stable, reliable dedicated connection.
• Direct Connect connections are fast, secure, and low-latency.
• In an application scenario, an on-premises data center accesses VPCs over a private network, often over optical fiber.

Important Direct Connect Technologies

• A connection is a leased physical connection of a carrier to connect an on-premises data center to a Direct Connect access point.
• It creates multiple virtual interfaces to connect to VPCs
• A virtual gateway is a logical gateway to access a VPC through a Direct Connect connection.
• Multiple VPCs share one virtual gateway, and multiple connections use one virtual gateway to access the same VPC.
• A virtual interface links a connection with one or more virtual gateways, each to a VPC, so that an on-premises network access all the VPCs.
• Direct Connect allows industries or enterprises to comply with specific standards and regulations, this is known as local compliance

Performance of Direct Connect

• Provides a dedicated connection, which is stable than Internet-based connections.
• This makes Direct Connect suitable for large-scale data transmission, high-capacity network traffic, and real-time applications

VPN Compared To Direct Connect

• VPN service is easy to use, out of box, with encrypted tunnels for transmitting data over the Internet.
• Public networks are used in VPN connections
• Direct Connect has dedicated connections, and the on-premises meets user requirements for data compliance.
• Private network access is used for Direct Connect Excellent performance, low latency and jitter.
• Direct Connect is useful when connecting an on-premises data center to a VPC.
• This enables high-performance, low-latency and compliant dedicated connections.
• On-premise servers can be connected to cloud servers in a VPC.
• Direct Connect helps connect on-premises assets to more than one VPC which helps leverage compute resources in different VPCs.
• Cloud servers in multiple VPCs can be connected to the on-premise asset using this design

VPC Peering

• A VPC peering connection connects two VPCs so they can communicate using private IP addresses.
• After a VPC peering connection is created, you need to add routes for the local and peer VPCs to enable communications.
• VPC peering connections are free and easy to configure.
• VPCs connected by VPC peering connections communicate with each other over a private network instead of the Internet.
• VPC peering enables two VPCs in the same region to communicate over a private network with different accounts.
• Private IP addresses are used for communications.

Important facts for VPC Peering

• A VPC peering connection request sent to a peer account must be accepted by the account.
• Communications between different subnets in two VPCs are enabled by just adding more routes.
• Only one VPC peering connection between the same two VPCs is possible at any one time.
• VPCs can be from different accounts and projects but not from different regions.
• The CIDR blocks connected by a VPC peering connection cannot overlap. Further both ECSs in VPCs connected by a VPC peering connection can access resources at the peer end.

Enterprise Router

• An enterprise router is a cloud router that connects VPCs and on-premises networks using BGP. It dynamically selects or switches between connections, improving network scalability, efficiency, and service continuity

Key Specs For Enterprise Router

• Cluster deployment and exclusive resources ensures high performance large-scale networks.
• Multiple links share loads or work in active/standby pairs for enhanced reliability.
• Resources (such as VPCs, VPN gateways, Direct Connect virtual gateways) are attached to an enterprise router, simplifying network topology.
• O&M efficiency is improved by allowing BGP enables flexible switchover between connections and the balancing of loads.
• VPN connections can back up Direct Connect connections. Enterprise Router can connect several on-premise and cloud networks
• Several VPCs can communicate with each other with a Direct Connect connection
• The VPCs don't need to be connected
• Several links share loads or work in active/standby
• Different accounts can share internetworking through on enterprise router

Network Topology Comparison

• The enterprise router is simpler and scalable.
• If there are four VPCs, six VPC peering connections are required, with 12 total routes configured.
• Only connecting the four VPCs to an enterprise router is needed, because the enterprise router learns VPC CIDR blocks.
• Only configure routes to the enterprise router in the route table of each VPC.
• Eliminate several VPC peering connections, and reduces the workload for configuring and maintaining routes.

More on Enterprise Router

• There is no need to connect all network instances, like using Cloud Connect.
• Route learning eliminates complex configurations and simplifies maintenance.
• Direct Connect also requires integrating with VPN, so that multipleVPCs can share direct connect
• Route learning also removes need for manual routes and speeds up the network.
• Multiple links share loads or work in active/standby pairs for enhanced reliability.

VPC Endpoint (VPCEP)

• VPC Endpoint (VPCEP) is a cloud service that extends VPC capabilities.
• It provides secure and private channels to connect VPCs to endpoint services, and stable networking without using EIPs.
• VPCEP Provides two types of resources: VPC endpoint services created by service providers and VPC endpoints created by service users
• VPC Endpoints keep access isolated to the internet or to expose all network resources, but you need at least one access point to the Internet.
• VPC Endpoints are useful in cross-VPC connections, and for accessing services like Huawei Cloud over an intranet
• They are also very useful in accessing certain cloud services

Characteristics and Advantages Of VPC Endpoints

• Excellent performance: Each gateway node can handle millions of concurrent connections.
• Ready to use: VPC endpoints can be used within just a few seconds of when they were created.
• High compliance: No EIP is required, and VPC connects to a VPC endpoint service through a VPC endpoint.

VPC Peering Connections Compared To Endpoints

• Like Enterprise Router, VPC peering connections enable network-wide communications, while VPCEP exposes ports.
• VPC peering makes all resources accessible compared to VPC Endpoints A service or application, such as ECSs and load balancers is accessible.
• CIDR block overlapping is not supported on Peering Connections
• Peerings communicate with each other
• VPC Endpoints only initiate requests to a VPC endpoint service
• Peerings need VPC, where Endpoints use a local IP to access and so do not
• Peering supports VPNs where as Endpoints only expose what is needed
• Peerings provide network-wide communication and Endpoints a intranet

Cloud Connect

• Cloud Connect builds stable, high-speed, high-quality networks between VPCs in different regions.
• It enables communications between network instances in the same or different regions over a private network.
• Assign the resource an inter-region bandwidth to establish inter-connectivity.

Cloud Connect Application Scenarios

• Cross-region multi-VPC communication: VPCs in different regions communicate with each other over a compliant private network, which improves network topology flexibility.
• Interworking between data centers and VPCs: Multiple on-premises data centers communicate with VPCs in different regions so that Direct Connect enables on-premises data to access the VPCs.
• Cloud Connect connects all the VPCs

Technical aspects of Cloud Connect

• Full connectivity: Any two network nodes connected, and packages are transmitted without others.
• Ease of use: In just a few steps, cross-region network connectivity is established.
• Excellent performance: uses Huawei's global network to transmit data through the shortest path for low latency. Flexible bandwidth.
• Global compliance: Compliant with local laws, to create business success.
• Accounts: Network instances others adds with permission

Cloud Connect Constraints

• A cloud connection can connect a maximum of six network instances in each region
• A VPC can only be loaded to one cloud connection.
• Subnets must be specified
• 50 CIDR blocks per network instance are supported.

Elastic IP Addresses (EIP)

• EIPs are public IPv4 addresses. They are bound to or unbound from an ECS, and they use public network bandwidth for Internet access.

EIP Billing Options

• There is Pay-per-use, billing by bandwidth, billing by traffic, yearly/monthly, and shared data package and bandwidth add-on package
• Assign EIP and bind to ECS to communicate over Internet
• Binding and unbinding takes direct effect, and it is automatic
• You can apply a specific IP or have the system apply randomly if not allocated
• Bandwidth size has a setting

EIP Use Cases

• Connecting to the Internet requires Elastic IPs.
• Cloud servers can communicate with one another if allocated
• The Load balancer can distribute request if also applied
• Binding to a NAT gateway enables numerous cloud servers to share an IP for internet access

Important items for NAT Gateways

• This function provides network address translation (NAT) service for multiple servers in a VPC to share one EIP.
• Access the Internet and ensure that servers cannot be directly accessed, use NAT Gateway.
• Using a NAT gateway requires 42.123.115.120 is using it
• If resources need to come from and access the internet, do not bind your own EIP
• Add the SNAT rule when doing so with a subnet to that gateway

NAT Types

• If servers are reaching out the internet

• Public NAT gateway; add source rule, then route outbound.

• Private IPs and security are offered by the services

• Easy access and guaranteed availability

• Destination Translation can use a single IP in the gateway

• Public NAT gateway; add address with the port

• Enforcing architecture security can improve a network

• NATs can provide full EIP benefits

• Avoid using direct IPs on your VMs

Binding Considerations

• To allow an ECS in a VPC to be accessed from the Internet, bind an EIP to the ECS.
• To enable multiple cloud servers in a VPC to access the Internet, use an EIP and a NAT gateway together

Elastic Network Interfaces

• A network interface is attached to an ECS for network communications.
• Network interfaces can be transferred across ECSs in the same VPC and do not need to be in the same subnet
• The primary network interface of an ECS cannot be detached from its instance.
• A network interface is associated with a Private IP address, EIP, Security group and MAC address and extended settings
• Extended items are Security isolation, Failover, Authorization (license) transfer

Virtual IP Addresses

• A virtual IP address; Can be bound to or unbound from ECSs, and are assigned from a subnet and can only be bound to resources in the same subnet.
• Typical application scenarios: Active/standby ECS switchovers and virtual IP address changes
• If communication is abnormal, IP detaches from the active and binds to the other.

Domain Name Service (DNS)

• DNS translates domain names into the IP addresses required for network connection. It directs to applications.
• This service a highly available, scalable authoritative Domain Name System web service
• Offers High performance, Robust Security, resolution for Private, and Reverse options

DNS Technical Notes

• Millions of queries are handled by single nodes
• Has anti-DDOS protection
• VPC can have secure DNS
• Protect records and improve efficiency, lower latencies, and stop spoofing
• Use pointer records

DNS Use-Cases

• DNS provides private domain name resolution within VPCs to provide decoupling
• Hostnames, transitions of service, cloud resources, and nearby access are the key use-cases

DNS Resolution

• Public DNS resolution translates a domain name (like the sample) to IP addresses for routing.
• Private DNS resolution maps a domain name (such as ecs.com) and subdomains to private IPs, in one + VPCs to work without Internet.
• Also private DNSs makes it for DNS to change.

Overview Of Network Architecture

• Should always meet security, realiability, performance, cost and maintenance rules
• Static data should use encryption with management keys Static data is encrypted with keys Dynamic has encryption, tunnels (TLS) Event Response recognizes systems/architecture and have automatic alerts
• Limited connectivity as there is limited access by default
• Log flows and configuration with audits