Virtual Private Cloud (VPC) Basics

Virtual Private Cloud (VPC)

• A VPC is a logically isolated, virtual network.
• Allows for customization, including subnets, route tables, security groups, and bandwidth management.
• Provides secure and isolated networks based on assigned IP addresses and security configurations.
• VPC is the basis of HUAWEI CLOUD networks.

Advantages of VPC

• Flexible Configuration: Customize VPCs, divide subnets as needed, configure DHCP and route tables.
• Security and Reliability: VPCs are logically isolated from each other. They can't communicate by default.
  • Network ACLs protect subnets.
  • Security groups protect ECSs (Elastic Cloud Servers).
• Seamless Connectivity:
  • VPCs are not connected to the internet by default.
  • Connect to the internet through EIP, ELB, NAT Gateway, VPN, and Direct Connect.
  • VPC peering connections allow communication between two VPCs in the same region using private IP addresses.
• High-Speed Access:
  • Up to 21 dynamic BGP connections to various carriers.
  • Dynamic BGP allows for automatic failover and chooses the optimal path in case of network failures.

VPC Architecture

• Each VPC contains a private CIDR block, route tables, and at least one subnet.
• When creating a VPC, specify a private CIDR block within the supported ranges: 10.0.0.0/8-24, 172.16.0.0/12-24, and 192.168.0.0/16-24.
• Cloud resources (like ECSs and databases) must be deployed in subnets.
• A default route table is automatically generated by the system. This ensures subnets in the same VPC communicate.
• To meet specific application requirements, create custom route tables.

Security in VPC

• Security Groups:
  • Act as virtual firewalls that provide access rules for ECSs within a VPC.
  • Apply to instances with the same security requirements and mutual trust.
• Network ACLs:
  • Associated with subnets that have the same access control needs.
  • Allow for specific control of inbound and outbound traffic at the subnet level.

Connectivity Options

• VPC Peering Connection: Establishes communication between two VPCs in the same region using private IP addresses.
• EIP or NAT Gateway: Allows ECSs in a VPC to communicate with the internet.
• On-premise Connections: VPN, Cloud Connect, Direct Connect, and L2CG (Layer 2 Connection Gateway) can connect your on-premises data center to VPCs.

Application Scenarios

• Dedicated Networks on Cloud: Each VPC represents a private network, providing isolation for service systems.
• Web Application/Website Hosting: Host web applications and websites in a VPC. Connect ECSs running web applications to the internet using EIPs or NAT gateways. Distribute traffic using load balancers.
• Web Application Access Control:
  • Create multiple security groups for web and database servers.
  • Associate different security groups to web and database servers.
  • Implement access control rules for security groups.
• Hybrid Cloud Deployment:
  • Combine on-premises data centers with cloud resources for flexibility.

VPC Concepts

• Elastic Network Interface: A virtual network card. Create and configure network interfaces and attach them to your instances.
• IP Address Group: A collection of IP addresses that share the same security group rules. It simplifies management for addresses with similar security requirements.
• Subnet: A unique CIDR block within your VPC. Deploy resources in subnets.
• Elastic IP (EIP): Enables your cloud resources to communicate with the internet using static public IP addresses and scalable bandwidths.
• Route Table: Contains routes used to determine the direction of network traffic from VPC subnets. Associate a route table with each subnet.
• Security Group: A collection of access control rules for ECSs within a VPC. You can create and apply specific rules to the security group.
• VPC Peering Connection: Connects two VPCs in the same region, allowing traffic routing between them using private IP addresses.
• Network ACL: Creates rules to manage traffic in and out of subnets. Offers fine-grained control by allowing both allow and deny rules.
• Virtual IP Address: A shared IP address shared among multiple ECSs. Allows access through either the private or virtual IP address.
• L2CG (Layer 2 Connection Gateway): A virtual tunnel gateway that facilitates communication between cloud and on-premises networks. This enables migration of data center services to the cloud without changing subnets or IP addresses.

Explore the fundamentals of Virtual Private Cloud (VPC) technology, its advantages, and configurations. This quiz covers aspects like flexible setup, security features, and connectivity that define VPC in HUAWEI CLOUD environments.