AWS VPC Networking Fundamentals

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon VPC: Foundations, updates, and
how you, too, can build your networking
architectures on AWS
Nick Matthews
Principal Solutions Architect
Amazon Web Services

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
S U M M I T
?

S U M M I T
Let’s take a closer look
AWS Region
Availability Zone 2Availability Zone 1
Private subnet Private subnet
Public subnet Public subnet
VPC CIDR 10.1.0.0/16 + Expand + IPv6
Amazon VPC
Amazon EC2
InstanceB
10.1.1.11/24
InstanceA
10.1.0.11/24
InstanceC
10.1.2.11/24
InstanceD
10.1.3.11/24
The
internet
Amazon S3 Amazon
DynamoDB
AWS
Lambda
Amazon
SQS
Amazon
SNS
AWS IOT

S U M M I T
Woah, hold up…

S U M M I T
IP addressing Creating
subnets
Routing in a
VPC
Security
VPC concepts and fundamentals
DNS in-VPC
with Amazon
Route 53

S U M M I T
Choosing an IP address
range

S U M M I T
Choosing an IP address range for your VPC
172.31.0.0/16
Recommended:
RFC1918 range
Recommended:
/16
(65,536 addresses)
Avoid ranges that overlap with
other networks to which you
might connect

S U M M I T
Creating subnets in a VPC

S U M M I T
VPC subnets and Availability Zones
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
172.31.0.0/24 172.31.1.0/24 172.31.2.0/24
eu-west-1a eu-west-1b eu-west-1c

S U M M I T
IPv6 in your VPC
• Can have a dual-stack VPC by adding an IPv6 CIDR
• Fixed sizes for VPC and subnets:
• /56 VPC (4,722,366,482,869,645,213,696 addresses)
• /64 subnets (18,446,744,073,709,551,616 addresses)

S U M M I T
VPC subnets and Availability Zones
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
172.31.0.0/24 172.31.1.0/24 172.31.2.0/24
eu-west-1a eu-west-1b eu-west-1c
2600:1f16:14d:6300::/56
2600:1f16:14d:6300::/64 2600:1f16:14d:6301::/64 2600:1f16:14d:6302::/64
+ Expand

S U M M I T
Routing in a VPC

S U M M I T
Routing in your VPC
• Route tables contain rules for which packets go where
• Your VPC has a default route table
• But, you can create and assign different route tables to different
subnets

S U M M I T
Traffic destined for my VPC
stays in my VPC

S U M M I T
DNS in a VPC

S U M M I T
VPC DNS options
Use Amazon DNS server
Have EC2 auto-assign DNS
host names to instances

S U M M I T
Amazon Route 53 private hosted zones
Private Hosted
Zone
example.demohostedzone.org 
172.31.0.99

S U M M I T
Amazon Route 53 Resolver for hybrid clouds
Route 53 Resolver
endpoints
Conditional forwarding
rules

S U M M I T
Flow logsNetwork access
control list
Security groups
Network security

S U M M I T
“MyWebServers” security group
“MyBackends” security group
Allow only “MyWebServers”
Security groups follow application structure
Web Web Web Web
App App App
IGW

S U M M I T
Security groups example: Web servers
Allow HTTP traffic from anywhere

S U M M I T
Security groups example: Backends
Allow application traffic
from web servers only

S U M M I T
Network security
Flow logsNetwork access
control list
Security groups

S U M M I T
Security groups versus NACLs
Security group Network ACL
Operates at instance level Operates at subnet level
Supports allow rules only Supports allow and deny rules
Is stateful: return traffic is automatically
allowed regardless of any rules
Is stateless: return traffic must be explicitly
allowed by rules
All rules evaluated before deciding whether to
allow traffic
Rules evaluated in order when deciding whether
to allow traffic
Applies only to instances explicitly associated
with the security group
Automatically applies to all instances launched
into associated subnets
Doesn’t filter traffic to or from link-local addresses (169.254.0.0/16) or AWS-reserved IPv4
addresses; these are the first four IPv4 addresses of the subnet (including the Amazon VPC DNS
server)

S U M M I T
VPC Flow Logs
AZ 2AZ 1
• Visibility
• Troubleshooting
• Analyze traffic
Amazon S3 Amazon CloudWatch Logs
VPC Flow Logs

S U M M I T
VPC Flow Logs: Setup
VPC traffic metadata
captured in Amazon S3
or Amazon CloudWatch Logs

S U M M I T
VPC Flow Logs: Format

S U M M I T
Internet
connectivity
Connecting to
other VPCs
Connecting to your
on-premises network
Connecting your VPC
or not

S U M M I T
Internet connectivity or not

S U M M I T
NAT
InstanceB
10.1.1.11/24
Instance BNAT-GW
NAT-GW
0.0.0.0/0
AWS Region
Private subnet
The
internet
Private subnet
Public subnet
InstanceA
Public subnet
Amazon S3
VPC CIDR 10.1.0.0/16
10.1.0.11/24
InstanceC
10.1.2.11/24
InstanceD
10.1.3.11/24
+ Expand + IPv6
IGW
10.1.0.0/16 Local
0.0.0.0/0 IGW
Destination Target
10.1.0.0/16 Local
Destination Target
EIP - 10.1.0.11 : 54.23.12.43
EIP - 10.1.1.11 : 54.19.12.23
Let’s take a closer look
Amazon
DynamoDB
AWS
Lambda
Amazon
SQS
Amazon
SNS
AWS IOT

S U M M I T
Connecting to other VPCs
VPC peering AWS Transit
Gateway

S U M M I T
VPC peering
• Full private IP connectivity between
two VPCs
• Can peer VPCs across regions
• VPCs can be in different accounts
• VPC CIDR ranges must not overlap
10.0.0.0/16
10.2.0.0/16
10.1.0.0/16
10.3.0.0/16

S U M M I T
Establish a VPC peering: Initiate request
Step 1
Initiate peering
request
172.31.0.0/16 10.55.0.0/16

S U M M I T
Establish a VPC peering: Accept request
Step 1
Initiate peering
request
Step 2
Accept peering
request
172.31.0.0/16 10.55.0.0/16

S U M M I T
Establish a VPC peering: Create routes
Step 1
Initiate peering
request
Step 2
Accept peering
request
Step 3, 4
172.31.0.0/16 10.55.0.0/16
Traffic destined for the peered VPC
should go to the peering, repeat for other
VPC

S U M M I T
VPC peering Transit Gateway
and beyond…
Connecting to other VPCs

S U M M I T
VPN connectionCustomer
gateway
Amazon VPC Amazon VPC
AWS Direct
Connect Gateway
VPC peering
VPC peering VPC peering
Amazon VPC Amazon VPCVPC peering
VPN
connection
VPN connection
VPC peering
Before AWS Transit Gateway…

S U M M I T
1
3
2 4
B Local
A
C PCX-2
D PCX-3
E PCX-4
Destination Target
A B
C
D E
PCX-1

S U M M I T
Full mesh: How many Amazon VPC peering
connections do I need (full mesh)?
n(n-1)
2
VPC x 10

S U M M I T
10(10-1)
2
VPC x 10

S U M M I T
VPC x 10
45

S U M M I T
100(100-1)
2
VPC x 100

S U M M I T
VPC x 100
4,500

S U M M I T
Static routes per
Amazon VPC route table
1,000*
Amazon VPC peering
connections per Amazon VPC
125
*Default is 50

S U M M I T
Transit
Gateway
Amazon VPCAmazon VPC
Amazon VPCAmazon VPC
Customer
gateway
VPN
connection
AWS Direct
Connect Gateway
(NEW)
With AWS Transit Gateway …

S U M M I T
B Local
0.0.0.0/0
Destination Target
A B
TGW
C
TGW
1 2
3 4
TGW Route Table(s)
VPC A : Attachment 1
VPC B : Attachment 2
VPC C : Attachment 3
On-prem : VPN 4
RT1
RT2
On-Premises
With AWS Transit Gateway …

S U M M I T
Attachment
The connection from a
Amazon VPC and VPN to
a TGW
Association
The route table used to
route packets coming from
an attachment (from an
Amazon VPC and VPN)
Propagation
The route table where the
attachment’s routes are
installed

S U M M I T
Llama
TGW
X
Y
TGW Route Table(s)
Associations
RT1
Z
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Barry from Z Barry from Z
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
10.3.0.0/16 via Z
10.1.0.0/16 Local
0.0.0.0/0 TGW
Destination Target
10.1.0.0/16 Local
0.0.0.0/0 IGW
Destination Target
10.0.0.0/8 TGW

S U M M I T
Llama
TGW
X
Y
TGW Route Table(s)
Associations
RT1
Z
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
10.3.0.0/16 via Z
10.8.0.0/16 10.9.0.0/16
10.8.0.0/16 via X
10.9.0.0/16 via X

S U M M I T
Llama
TGW
X
Y
TGW Route Table(s)
Associations
RT1
Z
Propagations
Pegasus from Y
Llama from X
Pegasus from Y
Llama from X
10.1.0.0/16
Pegasus
10.2.0.0/16
Barry
10.3.0.0/16
Routes
10.2.0.0/16 via Y
10.1.0.0/16 via X
10.3.0.0/16 via Z
10.8.0.0/16 10.9.0.0/16
10.8.0.0/16 via X
10.9.0.0/16 via X
Propagation turned off, you can still
statically configure routes

S U M M I T
After: AWS Transit Gateway (TGW) – The console

S U M M I T
Unicorn TGW
This TGW is Awesome
After: AWS Transit Gateway (TGW) – The console

S U M M I T
TGWs per account/TGW
attachments per Amazon VPC
5
Maximum burstable
bandwidth per attachment
50Gbps

S U M M I T
Maximum bandwidth per VPN
connection
1.25Gbps
*With ECMP, you can distribute traffic over multiple tunnels;
e.g., 8 tunnels = 10 Gbps
*

S U M M I T
Routes per TGW
10,000
Number of TGW attachments
per region per account
5,000
!!!

S U M M I T
Cross-region connectivity?
TGW is a region-level construct
today

S U M M I T
AWS Transit Gateway
detailed instructions:
https://amzn.to/2SkI4zV

S U M M I T
Connecting to on-premises
networks:
AWS VPN AWS Direct Connect

S U M M I T
On premises
IPsec Tunnel 1 - Primary
IPsec Tunnel 2- Secondary
Virtual private
gateway
VGW
IPsec tunnel over
the internet
Customer
gateway
CGW
The internet

S U M M I T
On premises
IPsec Tunnel 1 - Primary
IPsec Tunnel 2- Secondary
IPsec tunnel over
the internet
The internet
Transit GW
Customer
gateway
CGW

S U M M I T
Migrate Site-to-Site VPN to Transit
Gateway
https://amzn.to/2vwPcj7
NEW

S U M M I T
Attachment
to Amazon
VPC
TLS-based tunnel
over the internet
User with Open
VPN Client
Client VPN
Endpoint
Client
The
internet
On premises
Amazon S3 Amazon
DynamoDB

S U M M I T
Customer or
partner cage
Service Provider
Network
AWS Direct Connect: What’s that?
AWS Region
On premises
AWS Direct Connect location
AWS cage
Cross Connect
10.0.0.0/16
192.168.0.0/16
Private VIF
Public VIF
VGW

S U M M I T
Customer or
partner cage
Service Provider
Network
AWS Region
On premises
AWS cage
Cross Connect
10.0.0.0/16
192.168.0.0/16
Private VIF
Public VIF
10.2.0.0/16
VGW
VGW
Private VIF
AWS Direct Connect: What’s that?

S U M M I T
Customer or
partner cage
Service Provider
Network
AWS Direct Connect Gateway
AWS Region
On premises
AWS cage
Cross Connect
10.0.0.0/16
192.168.0.0/16
Private VIF
10.2.0.0/16
VGW
VGW
O n e P r i v a t e V I F  M a n y V P C s
AWS Direct
Connect
Gateway

S U M M I T
Customer or
partner cage
Service Provider
Network
AWS Region 1
On premises
AWS cage
Cross Connect
10.0.0.0/16
192.168.0.0/16
Private VIF
10.2.0.0/16
VGW
VGW
O n e P r i v a t e V I F  M a n y V P C s a c r o s s R e g i o n s
AWS Region 2
AWS Direct
Connect
Gateway

S U M M I T
Customer or
partner cage
Service Provider
Network
AWS Account 1
On premises
AWS cage
Cross Connect
10.0.0.0/16
192.168.0.0/16
Private VIF
10.2.0.0/16
VGW
VGW
O n e P r i v a t e V I F  M a n y V P C s a c r o s s a c c o u n t s
AWS Account 2
AWS Direct
Connect
Gateway
Multi Account DX Gateway
NEW

S U M M I T
Customer or
partner cage
Service Provider
Network
AWS Account 1
On premises
AWS cage
Cross Connect
10.0.0.0/16
192.168.0.0/16
Transit VIF
10.2.0.0/16
O n e T r a n s i t V I F  M a n y V P C s
AWS Account 2
AWS Direct
Connect
Gateway
Transit VIF with DX Gateway
NEW
AWS Transit
Gateway

S U M M I T
Transit Gateway with AWS Direct
Connect
https://amzn.to/2VDnnEt
NEW

S U M M I T
New Partner Connection Speeds
1 , 2 , 5 , o r 1 0 G b p s o f c a p a c i t y
https://amzn.to/2YtGNue
Also NEW

S U M M I T
VPC Sharing VPC endpoints and
AWS PrivateLink
…more AWS networking
AWS Global
Accelerator

S U M M I T
Amazon VPC Sharing
Before

S U M M I T
L l a m a
10.3.0.0/16
P e g a s u s
10.2.0.0/16
B a r r y
10.1.0.0/16
I g u a n a
10.6.0.0/16
S t e v e
10.5.0.0/16
S u e
10.4.0.0/16
AWS Lambda Amazon EC2
Amazon RedshiftAmazon RDS
Amazon EC2
Amazon EC2
Prod 1Dev
Test
Prod2
Prod 3 Prod 4

S U M M I T
Amazon VPC Sharing
After

S U M M I T
L l a m aP e g a s u s
10.2.0.0/16
B a r r y
10.1.0.0/16
I g u a n aS t e v eS u e
AWS Lambda Amazon EC2
Amazon RedshiftAmazon RDS
Amazon EC2
Amazon EC2
Prod 1Dev
Test
Prod2
Prod 3 Prod 4
Owner
Participant
Owner
Participant Participant
Participant

S U M M I T
Amazon VPC owners are responsible for creating, managing,
and deleting all VPC level entities.
Amazon VPC owners cannot modify or delete participant
resources.
Amazon VPC Owner

S U M M I T
Participants that are in a shared Amazon VPC are responsible for the creation,
management, and deletion of their resources including Amazon Elastic Compute
Cloud (Amazon EC2) instances, Amazon Relational Database Service (Amazon
RDS) databases, and load balancers.
However, they cannot modify any Amazon VPC-level entities including route
tables, network ACLs, or subnets (or view/modify resources belonging to other
participants).
Amazon VPC Participant

S U M M I T
Why use Amazon VPC sharing?
Pre se rv e I P sp a c e
U se f e w e r I Pv 4 C I D R s
I n t e rc o n ne c tiv it y
N o V PC Pe e ri n g re q u i re d
B i l l i n g a n d S e c u r i t y
C o n t i n u e t o e n j o y s e g r e g a t i o n
w i t h m u l t i p l e a c c o u n t s
S e p a r a t i o n o f d u t i e s
A c e n t r a l t e a m c a n c r e a t e a n d
m a n a g e y o u r A m a z o n V P C
S a m e A Z c o s t f o r d a t a t r a n s f e r i s n i l !

S U M M I T
Amazon VPC Sharing details:
https://amzn.to/2Aovw2Z

S U M M I T
VPC endpoints
Interface VPC
endpoints
Gateway VPC
endpoints
AWS
PrivateLink

S U M M I T
NAT
InstanceB
10.1.1.11/24
Instance BNAT-GW
NAT-GW
0.0.0.0/0
AWS Region
Private subnet
The
internet
Private subnet
Public subnet
InstanceA
Public subnet
Amazon S3
VPC CIDR 10.1.0.0/16
10.1.0.11/24
InstanceC
10.1.2.11/24
InstanceD
10.1.3.11/24
+ Expand + IPv6
IGWVPCE
10.1.0.0/16 Local
0.0.0.0/0 IGW
S3.prefix.list VPCE-123
Destination Target
10.1.0.0/16 Local
DDB.prefix.list VPCE-123
Destination Target
EIP - 10.1.0.11 : 54.23.12.43
EIP - 10.1.1.11 : 54.19.12.23
Amazon
DynamoDB
VPCE =
Virtual Private Endpoint
(Type: Gateway)

S U M M I T
Amazon API Gateway
AWS CloudFormation
Amazon CloudWatch
Amazon CloudWatch Events
Amazon CloudWatch Logs
AWS CodeBuild
AWS Config
Amazon EC2 API
Elastic Load Balancing API
AWS Key Management Service
Amazon Kinesis Data Streams
Amazon SageMaker Runtime
AWS Secrets Manager
AWS Security Token Service
AWS Service Catalog
Amazon SNS
AWS Systems Manager
NAT
InstanceB
10.1.1.11/24
NAT-GW
AWS Region
Private subnet Private subnet
Public subnet
InstanceA
Public subnet
VPC CIDR 10.1.0.0/16
10.1.0.11/24
InstanceC
10.1.2.11/24
InstanceD
10.1.3.11/24
+ Expand + IPv6
22+ services now
supported over AWS
PrivateLink
ec2.eu-west-1.amazonaws.com
ENI1: 10.1.0.15
ENI2: 10.1.1.23
ec2.eu-west-1.amazonaws.com
ENI1: 10.1.0.15
ENI2: 10.1.1.23
AWS PrivateLink can
reach public services,
privately from your VPC
No routes needed!
(almost)
10.1.0.0/16 Local
Destination Target
10.1.0.0/16 Local
Destination Target
+ More

S U M M I T
VPC Endpoints
Type: Gateway
Type: Interface

S U M M I T
And now, AWS PrivateLink
for service providers
Customer VPC
Service Provider VPC
Application, e.g. SaaS
NLB
AWS
PrivateLink
VPC Endpoint: vpce-2222.foo.amazon.com

S U M M I T
AWS Global Accelerator

S U M M I T
Before

S U M M I T
AWS Region 1 AWS Region 2

S U M M I T
After

S U M M I T
AWS Region 1 AWS Region 2
3.10.3.1253.10.3.125

S U M M I T
Client StateAWS’s Global
Network
Static Anycast
IP’s
Applications can keep state,
with connections routed to
the same endpoint, after
initial connection
Traffic routed through
Accelerator traverses AWS
global network (instead of
the public internet)
Global Accelerator uses
Static IP addresses are a
fixed entry point to your
applications. These IP
addresses are anycast from
AWS edge locations

S U M M I T
https://amzn.to/2FI3y89

S U M M I T
NAT
InstanceB
10.1.1.11/24
Instance BNAT-GW
NAT-GW
0.0.0.0/0
AWS Region
Private subnet
VGW
VPC
Peering
VPC
Flow Logs
VPN
The
internet
Private subnet
Public subnet
InstanceA
Public subnet
Amazon S3
VPC CIDR 10.1.0.0/16
10.1.0.11/24
InstanceC
10.1.2.11/24
InstanceD
10.1.3.11/24
DXGW
+ Expand + IPv6
IGWVPCE
10.1.0.0/16 Local
0.0.0.0/0 IGW
On-premises VGW
VPC-B PCX-123
Destination Target
Intra or
Inter
region
10.1.0.0/16 Local
On-premises VGW
VPC-B PCX-123
Destination Target
AWS PrivateLink
Service Provider VPC
NLB
On premises
VPC-B
EIP - 10.1.0.11 : 54.23.12.43
EIP - 10.1.1.11 : 54.19.12.23
Amazon
DynamoDB
AWS
Lambda
AWS Direct
Connect
Amazon
SQS
Amazon
SNS
AWS IOT
Amazon
CloudWatch
AWS
PrivateLink
Transit GW
Onpremises
AWS PrivateLink
Enabled Services
Other Routes TGW
Other Routes TGW
Amazon S3

S U M M I T
Awesome:
Networking Study Guide
https://amzn.to/2U9TczL

S U M M I T
Chalk Talk Directly After!
Securely deliver applications with AWS
C201 (Level 2)

AWS VPC Networking Fundamentals

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a AWS VPC Networking Fundamentals

Similar a AWS VPC Networking Fundamentals (20)

Más de Amazon Web Services

Más de Amazon Web Services (20)

AWS VPC Networking Fundamentals