Networking Basics and Amazon VPC

Networking Basics

• A network consists of subnets and routers
• IP addresses are numerical labels assigned to each device participating in a computer network for communication
• IPv4 is a 32-bit address, represented in dotted decimal format (e.g., 192.0.2.0)
• IPv6 is a 128-bit address, represented in hexadecimal format (e.g., 2600:1f18:22ba:8c00:ba86:a05e:a5ba:00FF)
• Classless Inter-Domain Routing (CIDR) is an IP addressing scheme that specifies both the network and host portions of an IP address
  • A CIDR block looks like this: 192.0.2.0/24
  • 192. 0. 2 is the network identifier (routing prefix)
  • The 24 indicates that the first 24 bits are fixed
• The Open Systems Interconnection (OSI) model is a conceptual framework that standardizes the functions of a telecommunication or computing system into seven abstraction layers:
  • Physical
  • Data Link
  • Network
  • Transport
  • Session
  • Presentation
  • Application

Amazon VPC

• Enables you to provision a logically isolated section of the AWS Cloud to launch AWS resources in a virtual network that you define.
• Gives you control over your virtual networking resources, including selection of IP address range, creation of subnets, and configuration of route tables and network gateways.
• Allows you to customize the network configuration and use multiple layers of security.
• VPCs are logically isolated and dedicated to your AWS account and belong to a single AWS Region. They can span multiple Availability Zones.
• Each VPC has a range of IP addresses that divide a VPC.
• Subnets belong to a single Availability Zone and are classified as public or private
• When creating a VPC, assign it to an IPv4 CIDR block (range of private IPv4 addresses).
• After creating the VPC, the address range cannot be changed.
• The largest IPv4 CIDR block size is /16 with 65,536 addresses
• IPv6 is also supported with a different black size limit.
• IPv4 CIDR blocks overlap
• For a VPC with an IPv4 CIDR block of 10.0.0.0/16, there are 65,536 total IP addresses with four equal-sized subnets
• Only 251 IP addresses are available for use by each subnet.
• A public IPv4 address can be manually assigned through a Elastic IP address.
• Public IPv4 addresses are automatically assigned through the auto-assign public IP address settings at the subnet level
• Elastic IP addresses are associated with an AWS account
• Elastic IP addresses can be allocated and remapped anytime and additional costs might apply.
• Elastic network interface is a virtual network interface that can be attached to an instance or detached to another instance to redirect network traffic
• Attributes of the network interface follow when it is reattached to a new instance
• Each instance in a VPC has a default network interface that is assigned a private IPv4 address from the IPv4 address range of your VPC.
• A route table contains a set of rules (or routes) that direct network traffic from your subnet
• Each route specifies a destination and a target.
• By default, every route table contains a local route for communication within the VPC.
• Subnets have to be associated with a route table, at most, only one.

VPC Networking

• Different VPC networking options:
  • Internet gateway
  • NAT gateway
  • VPC endpoint
  • VPC peering
  • VPC sharing
  • AWS Site-to-Site VPN
  • AWS Direct Connect
  • AWS Transit Gateway

VPC Security

• Security groups provides rules that control inbound and outbound instance traffic, denying all inbound traffic and allowing all outbound traffic by default
• Security groups are stateful.
• Rules evaluated before a decision is made to allow traffic.
• Network access control lists (ACLs) are security layers at the subnet level
• They have separate inbound/outbound rules that either allow/deny traffic
• Default network ACLs allow all inbound and outbound IPv4 traffic
• Custom network ACLs deny all inbound and outbound traffic until rules are added.
• Network ACLs are stateless

Amazon Route 53

• It is a highly available and scalable Domain Name System (DNS) web service used to route end users to internet applications by translating names (like www.example.com) into numeric IP addresses (like 192.0.2.1) that computers use to connect to each other
• Route 53 is fully compliant with IPv4 and IPv6 and connects user requests to infrastructure running in AWS and outside of AWS
• Features include healthchecks, traffic flow and the ability to register domain names.
• Route 53 supports the following routing policies:
  • Simple routing
  • Weighted round robin routing
  • Latency routing
  • Geolocation routing
  • Geoproximity routing
  • Failover routing
  • Multivalue answer routing

Amazon CloudFront

• It is a fast, global, and secure Content Delivery Network(CDN) service, comprised of global networks of edge locations, and regional edge caches
• Benefits include:
  • Fast and global
  • Security at the edge
  • Highly programmable
  • Deeply integrated with AWS
  • Cost-effective
• Edge locations are a network of data centers that store content that CloudFront uses to serve popular content quickly to customers.
• Regional edge caches cache content that is not popular enough to stay at an edge location.