Overview. AWS networking services including: VPC Extend your network into a virtual private cloud. EIP Elastic IP

Size: px

Start display at page:

Download "Overview. AWS networking services including: VPC Extend your network into a virtual private cloud. EIP Elastic IP"

Naomi Fowler
5 years ago
Views:

1 Networking in AWS 2017 Amazon Web Services, Inc. and its affiliates. All rights served. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon Web Services, Inc.

2 Overview AWS networking services including: VPC Extend your network into a virtual private cloud EIP Elastic IP Direct Connect Physical cross connect into AWS ELB Managed load balancer service Route53 Managed DNS service

3 1 Amazon VPC

4 Amazon VPC Virtual network topology that you define Your own logically isolated section of AWS Complete control of your networking environment IP ranges Subnets Routing tables Gateways Multiple Connectivity Options Advanced Security Features

5 Networking Building Blocks Bring your own network Your network goes here

6 Networking Building Blocks VPC Subnet 1 VPC Subnet 2 VPC Subnet n

7 Networking Building Blocks Configure custom routing rules VPC Subnet 1 VPC Subnet 2

8 Plan your VPC IP space before creating it Consider future AWS region expansion Consider future connectivity to corporate networks Consider subnet design VPC can be /16 between and /28 CIDR cannot be modified once created (New: Add CIDRs to VPC) Overlapping IP spaces = future headache

9 Network Building Blocks Web (HTTP) Security Group Firewall Load Balancer Security Group Firewall Web Server 8080 Web Server Security Group Firewall DB Server

10 Network Building Blocks Availability Zone A Availability Zone B

11 Network Building Blocks Routing rules Availability Zone A Availability Zone B

12 Network Building Blocks Customer Network

13 Network Building Blocks Customer WAN AWS Direct Connect Location Customer Network

14 Network Building Blocks Customer Network

15 Network Building Blocks Customer Network

16 Network Building Blocks Load Balancer Internet Elastic Load Balancing Mid-tier Elastic Load Balancing Customer Network

17 VPC NAT Gateway High availability built-in redundancy High bandwidth up to 10Gbps Fully Managed by AWS Assign an EIP to each NAT Gateway View NAT gateways traffic using Flow Logs NAT gateways support TCP, UDP, and ICMP protocols Network ACLs apply to NAT gateway s traffic CloudTrail Support Nat Gateway Private Route Table Destination Target /16 Local /0 IGW Private Route Table Destination Target /16 Local /0 NGW

18 VPC Endpoints: Amazon S3 access without an Internet Gateway No IGW No NAT No public IPs Free Robust access control Amazon S3

Connecting to other VPCs - VPC peering This image cannot currently be displayed. 172.31.0.

19 Connecting to other VPCs - VPC peering This image cannot currently be displayed / / /16 VPC Peering Private Route Table Private Route Table Destination Target Destination Target /16 Local /16 VPC Peer /16 Local /16 VPC Peer

20 Default VPCs Default VPC Simplicity and Convenience Automatically assigned network and subnets Security of VPC Customer may create additional subnets and change routing rules Additional network controls (Security Groups, NACLs, routing) Hardware VPN options between corporate networks Instances in default subnets have Security Group controlled public and private IPs

21 IP Addressing Default VPC Dynamic Private IP Dynamic Public IP Optional Static Public IP (EIP) AWS-provided DNS names Private DNS name Public DNS name Virtual Private Cloud Dynamic or Static Private IP Address None by default (can be created with publicip=true) Optional Static Public IP (EIP) AWS-provided public DNS lookup AWS-provided private DNS names Customer-controlled DNS options

22 Recap 1. Create VPC 2. Create Subnets Across Multiple AZ s 3. Configure Route Tables 4. Create Gateways IGW and VGW (VPC and DX) 5. Configure Security Security Groups and NACLs 6. Create VPC Endpoints 7. Create NAT Gateway 8. Configure VPC Peering 9. Create Instances

23 2 Direct Connect

24 AWS Direct Connect

25 AWS Direct Connect Cont d

26 AWS Direct Connect Decide on an AWS DX location and port size Use AWS Management Console to create connection request(s) Sends Letter of Authorization Connecting Facility Assignment (LOA-CFA) via Establish WAN connectivity to DX location* APN Partner or a network carrier of your choice Provide LOA-CFA to an APN Partner or your service provider to establish the connection at the DX location Use AWS Management Console to configure one or more virtual interfaces AWS DX Locations * Can be done in parallel with remaining steps once the AWS DX location has been selected

27 3 ELB

28 Elastic Load Balancing Elastic Load Balancing automatically distributes incoming application traffic across multiple Amazon EC2 instances. Two Types: Classic & Application Load Balancer

29 Elastic Load Balancing In-Region Load Balancing Service Distributes traffic across multiple Availability Zones HTTP/S, TCP/S Built-in Health Check Elastic Load Balancer Fully fault-tolerant Can span multiple AZs Web Server Web Server AZ-1 Web Server Web Server AZ-2 Web Server Web Server AZ-3 Region

30 ELB Considerations ELB is a service, but runs on EC2 The IP Addresses will change over time Use CNAME records in DNS or Route 53 Alias records Never use an A record SSL is supported Client SSL Termination Backend ELB-to-Server mutual SSL Cross-Zone Load Balancing Sticky sessions Best Practices for Evaluating ELB

31 Classic Load Balancer Features: High Availability Health Checks Security Features SSL Offloading Sticky Sessions IPv6 Support Layer 4 or 7 Load Balancing Operational Monitoring Logging

32 Application Load Balancer Features: Content-Based Routing Containerized Application Support HTTP/2 Support WebSockets Support Layer-7 Load Balancing Delete Protection Request Tracing Web Application Firewall (WAF)

33 4 Route53

34 Route53

35 Route53

36 Global Traffic Management Example:

37 Route53 Pricing Dimensions

38 Route53

39 Any Questions?

AWS Networking Fundamentals

AWS Networking Fundamentals Tom Adamski Specialist Solutions Architect, AWS Traditional Network WAN VPN VPN Fiber Applications Applications AWS Network VPN WAN (AWS Direct Connect) VPN Fiber Applications