The document discusses AWS network infrastructure including regions, availability zones, VPCs, subnets, internet gateways, NAT gateways, transit gateways, and direct connect. It explains how to set up redundant direct connect connections between an on-premises network and AWS for high availability. It also discusses using BGP, route tables, and other techniques to optimize routing and connectivity. Links are provided to documentation on transit gateway route tables and gateway load balancers.

1. Classificação: Interna
Zero to Hero for Network Admins on
AWS
Wilson Lopes
01/2023
https://www.linkedin.com/in/wrlopes/

2. Classificação: Interna
AWS Cloud Network Infrastructure
Regions and Availability Zones
Regions
. Geographic segregated infrastructures
around the globe – services, network,
compute, storage
. Services generally are high available
and isolated into the region
. Regions are connected using private
cloud network infrasctructure
https://aws.amazon.com/pt/about-
aws/global-infrastructure/regions_az

3. Classificação: Interna
AWS Cloud Network Infrastructure
Regions and Availability Zones
Availabilty Zones - AZs
. One or more Datacenter into the region – Segregated
Facilities, Energy, Cooling
. Segregated network and compute services into the region
. To became high available, services must be deployed in more
than one AZ
. For example, a service behind a load balancer using 3 AZs,
with frontend, backend and database between the 3 AZs
AZ 1 AZ 3
AZ 2
LB
VPC
LB
FE
BE
Subnet 1 FE Subnet 2 FE Subnet 3 FE
Subnet 1 BE Subnet 2 BE Subnet 3 BE

4. Classificação: Interna
AWS Cloud Network Infrastructure
VPC – Virtual Private Cloud
AZ 1A AZ 1C
AZ 1B
VPC – 10.0.0.0/20 - 2001:db8:1234:1a00::/56
Subnet 1A Subnet 1B Subnet 1C
VPC
. Isolated virtual network into the region
. Segregated in subnets. Subnets are per AZ
. Ipv4/Ipv6/Ipv6 only
. Bring your own ip – public ipv4 and ipv6
Region – Sao Paulo - SA-EAST-1

5. Classificação: Interna
AWS Cloud Network Infrastructure
VPC – Virtual Private Cloud
AZ 1 AZ 1C
AZ 1B
Subnet 1A PUB Subnet 1B PUB Subnet 1C PUB
Subnet 1A PRIV Subnet 1B PRIV Subnet 1C PRIV
Public Route Table
Private Route Table
VPC
. Isolated virtual network into the region
. Segregated in subnets. Subnets are per AZ
. Ipv4/Ipv6/Ipv6 only
. Bring your own ip – public ipv4 and ipv6
. Route tables – Each subnet can use different route tables
VPC – 10.0.0.0/20 - 2001:db8:1234:1a00::/56
Region – Sao Paulo - SA-EAST-1
AZ 1A

6. Classificação: Interna
AWS Cloud Network Infrastructure
VPC – Virtual Private Cloud
IGW
VPC
. Isolated virtual network into the region
. Segregated in subnets. Subnets are per AZ
. Ipv4/Ipv6/Ipv6 only
. Bring your own ip – public ipv4 and ipv6
. Route tables – Each subnet can use different route tables
. IGW – Internet Gateway – connect “Public Subnets” to
internet – ingress/egress . Regional Resource.
AZ 1 AZ 1C
AZ 1B
Subnet 1A PUB Subnet 1B PUB Subnet 1C PUB
Subnet 1A PRIV Subnet 1B PRIV Subnet 1C PRIV
Public Route Table
Private Route Table
VPC – 10.0.0.0/20 - 2001:db8:1234:1a00::/56
Region – Sao Paulo - SA-EAST-1
AZ 1A

7. Classificação: Interna
AWS Cloud Network Infrastructure
VPC – Virtual Private Cloud
IGW
VPC
. Isolated virtual network into the region
. Segregated in subnets. Subnets are per AZ
. Ipv4/Ipv6/Ipv6 only
. Bring your own ip – public ipv4 and ipv6
. Route tables – Each subnet can use different route tables
. IGW – Internet Gateway – connect “Public Subnets” to
internet – ingress/egress . Regional Resource.
AZ 1 AZ 1C
AZ 1B
Subnet 1A PUB Subnet 1B PUB Subnet 1C PUB
Subnet 1A PRIV Subnet 1B PRIV Subnet 1C PRIV
Public Route Table
Private Route Table
VPC – 10.0.0.0/20 - 2001:db8:1234:1a00::/56
Region – Sao Paulo - SA-EAST-1
AZ 1A
PUB Route Table
10.0.0.0/20 – Local
0.0.0.0/0 – IGW

8. Classificação: Interna
AWS Cloud Network Infrastructure
VPC – Virtual Private Cloud
VPC
. Isolated virtual network into the region
. Segregated in subnets. Subnets are per AZ
. Ipv4/Ipv6/Ipv6 only
. Bring your own ip – public ipv4 and ipv6
. Route tables – Each subnet can use different route tables
. IGW – Internet Gateway – connect “Public Subnets” to
internet – ingress/egress. Regional Resource.
. NatGW – Nat Gateway – connect “Private Subnets” to internet
– egress Only. AZ Resource.
NatGW
AZ 1 AZ 1C
AZ 1B
Subnet 1A PUB Subnet 1B PUB Subnet 1C PUB
Subnet 1A PRIV Subnet 1B PRIV Subnet 1C PRIV
Public Route Table
Private Route Table
VPC – 10.0.0.0/20 - 2001:db8:1234:1a00::/56
Region – Sao Paulo - SA-EAST-1
AZ 1A
IGW

9. Classificação: Interna
AWS Cloud Network Infrastructure
VPC – Virtual Private Cloud
VPC
. Isolated virtual network into the region
. Segregated in subnets. Subnets are per AZ
. Ipv4/Ipv6/Ipv6 only
. Bring your own ip – public ipv4 and ipv6
. Route tables – Each subnet can use different route tables
. IGW – Internet Gateway – connect “Public Subnets” to
internet – ingress/egress. Regional Resource.
. NatGW – Nat Gateway – connect “Private Subnets” to internet
– egress Only. AZ Resource – 1 NatGW per AZ, 1 Route Table
Priv per AZ.
NatGW
AZ 1 AZ 1C
AZ 1B
Subnet 1A PUB Subnet 1B PUB Subnet 1C PUB
Subnet 1A PRIV Subnet 1B PRIV Subnet 1C PRIV
Public Route Table
Private Route Table
VPC – 10.0.0.0/20 - 2001:db8:1234:1a00::/56
Region – Sao Paulo - SA-EAST-1
AZ 1A
IGW
PRIV 1C Route Table
10.0.0.0/20 – Local
0.0.0.0/0 – NatGW
NatGW
AZ 1C
PRIV 1B Route Table
10.0.0.0/20 – Local
0.0.0.0/0 – NatGW
NatGW
AZ 1C
PRIV 1A Route Table
10.0.0.0/20 – Local
0.0.0.0/0 – NatGW

10. Classificação: Interna
AWS Cloud Network Infrastructure
VPC – Virtual Private Cloud
VPC
AZ 1 AZ 1C
AZ 1B
Subnet 1A PUB Subnet 1B PUB Subnet 1C PUB
Subnet 1A PRIV Subnet 1B PRIV Subnet 1C PRIV
Public Route Table
PRIV Route Table
VPC – 10.0.0.0/20 - 2001:db8:1234:1a00::/56
Region – Sao Paulo - SA-EAST-1
AZ 1A
IGW
PRIV Route Table PRIV Route Table
NatGW NatGW NatGW
. Isolated virtual network into the region
. Segregated in subnets. Subnets are per AZ
. Ipv4/Ipv6/Ipv6 only
. Bring your own ip – public ipv4 and ipv6
. Route tables – Each subnet can use different route tables
. IGW – Internet Gateway – connect “Public Subnets” to
internet – ingress/egress. Regional Resource.
. NatGW – Nat Gateway – connect “Private Subnets” to internet
– egress Only. AZ Resource – 1 NatGW per AZ, 1 Route Table
Priv per AZ.
. VGW – Virtual Private Gateway – connect to external networks
via VPN or Direct Connect – should connect only “Private
Subnets”. BGP and static routes.
VGW

11. Classificação: Interna
AWS Cloud Network Infrastructure
Terraform – Infra as a Code
https://registry.terraform.io/modules/terraform-aws-modules/vpc/aws/latest

12. Classificação: Interna
AWS Cloud Network Infrastructure
AWS Direct Connect + AWS Transit Gateway
https://docs.aws.amazon.com/pt_br/whitepapers/latest/aws-vpc-connectivity-options/aws-
direct-connect-aws-transit-gateway.html

13. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX
DX
Cloud Network

14. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
. Interconnection Hub
. Per region resource
. Direct connect and VPN support
. Route received from direct connect are prefered
. Static and dynamic bgp routing
. Limits – 10k static routes, 1k dynamic routes
On Premises
Datacenter
Direct
Connect
Gateway
Transit Gateway
DX
DX
Cloud Network

15. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
. Interconnection Hub
. Per region resource
. Direct connect and VPN support
. Route received from direct connect are prefered
. Static and dynamic bgp routing
. Limits – 10k static routes, 1k dynamic routes
On Premises
Datacenter
Direct
Connect
Gateway
Transit Gateway
Direct Connect Gateway
. Global resource
. Attached to transit gateway or virtual private gateway
DX
DX
Cloud Network

16. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
. Interconnection Hub
. Per region resource
. Direct connect and VPN support
. Route received from direct connect are prefered
. Static and dynamic bgp routing
. Limits – 10k static routes, 1k dynamic routes
On Premises
Datacenter
Direct
Connect
Gateway
Transit Gateway
Direct Connect Gateway
. Global resource
. Attached to transit gateway or virtual private gateway
Direct Connect Locations - DX
. Physical location of cloud facility
. Connections can be dedicated or hosted by partners
DX
DX
Cloud Network

17. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX 2
DX 1
Connection A
Telecom A
Direct Connect – Private Connections
. To improve high availability, connect to at least two
different direct connect locations
. Use different telecom operators per connection
Connection B
Telecom B
Cloud Network

18. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX 2
DX 1
Direct Connect – Private Connections
. To improve high availability, connect to at least two
different direct connect locations
. Use different telecom operators per connection
. Analyze the physical path of each connection to not
use same facility/last mile
Cloud Network
X

19. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX 2
DX 1
Direct Connect – Private Connections
. To improve high availability, connect to at least two
different direct connect locations
. Use different telecom operators per connection
. Analyze the physical path of each connection to not
use same facility/last mile
Cloud Network

20. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX 2
DX 1
Direct Connect – Private Connections
. To improve high availability, connect to at least two
different direct connect locations
. Use different telecom operators per connection
. Analyze the physical path of each connection to not
use same facility/last mile
. 1/10/100Gbps for dedicated connections
. Lower than 1Gbps for hosted connections
Cloud Network

21. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX 2
DX 1
BGP
. To improve high availability, connect to at least two
different direct connect locations
. Use different telecom operators per connection
. Analyze the physical path of each connection to not
use same facility/last mile
. 1/10/100Gbps for dedicated connections
. Lower than 1Gbps for hosted connections
. BGP – Dynamic routing and convergence
. Can use private ASN or your own
OnPrem - 10.64.0.0/24
Cloud – 10.0.0.0/20
BGP
OnPrem - 10.64.0.0/24
Cloud – 10.0.0.0/20
Direct Connect – Private Connections
Cloud Network

22. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX 2
DX 1
. To improve high availability, connect to at least two
different direct connect locations
. Use different telecom operators per connection
. Analyze the physical path of each connection to not
use same facility/last mile
. 1/10/100Gbps for dedicated connections
. Lower than 1Gbps for hosted connections
. BGP – Dynamic routing and convergence
. Can use private ASN or your own
. Cloud provider use ECMP for same route metric
. Active/Standby path can be implemented using AS
Prepend and Local Preference
. There are short limits of advertised routes
. Summarization is mandatory to scale
Direct Connect – Private Connections
Cloud Network
Out – AS Prepend
65000 65000 65000
IN – LP 90
active
standby

23. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX 2
DX 1
BGP
BFD
. To improve high availability, connect to at least two
different direct connect locations
. Use different telecom operators per connection
. Analyze the physical path of each connection to not
use same facility/last mile
. 1/10/100Gbps for dedicated connections
. Lower than 1Gbps for hosted connections
. BGP – Dynamic routing and convergence
. Can use private ASN or your own
. Cloud provider use ECMP for same route metric
. Active/Standby path can be implemented using AS
Prepend and Local Preference
. There are short limits of advertised routes
. Summarization is mandatory to scale
. BFD – Minimize the convergence time to
miliseconds
Direct Connect – Private Connections
Cloud Network
BGP
BFD

24. Classificação: Interna
AWS Cloud Network Infrastructure
Transit
Gateway
On Premises
Datacenter
Direct
Connect
Gateway DX 2
DX 1
. To improve high availability, connect to at least two
different direct connect locations
. Use different telecom operators per connection
. Analyze the physical path of each connection to not
use same facility/last mile
. 1/10/100Gbps for dedicated connections
. Lower than 1Gbps for hosted connections
. BGP – Dynamic routing and convergence
. Can use private ASN or your own
. Cloud provider use ECMP for same route metric
. Active/Standby path can be implemented using AS
Prepend and Local Preference
. There are short limits of advertised routes
. Summarization is mandatory to scale
. BFD – Minimize the convergence time to
miliseconds
. LACP – aggregate links and high availability per DX
location
Direct Connect – Private Connections
Cloud Network
BGP
BFD
LACP
BGP
BFD
LACP

25. Classificação: Interna
AWS Cloud Network Infrastructure
AWS Transit Gateway – Route Tables
https://aws.amazon.com/pt/blogs/architecture/field-notes-working-with-route-tables-in-aws-
transit-gateway/

26. Classificação: Interna
AWS Cloud Network Infrastructure
AWS Gateway Load Balancer
https://aws.amazon.com/pt/blogs/aws/introducing-aws-gateway-load-balancer-easy-
deployment-scalability-and-high-availability-for-partner-appliances/
https://aws.amazon.com/pt/blogs/networking-and-content-delivery/scaling-network-traffic-
inspection-using-aws-gateway-load-balancer/

27. Classificação: Interna
AWS Cloud Network Infrastructure
AWS VPC Endpoints
https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html