Architecting on AWS

Module 3: Networking 1

1
Poll question Which network components are you familiar
with? Choose all that apply:

A. IP addressing and subnetting

B. Switching and routing

C. Network security

D. None of the above

2
Module overview
• Business request
• IP addressing
• Amazon Virtual Private Cloud (VPC) fundamentals
• VPC traffic security
• Present solutions
• Capstone check-in
• Knowledge check

3
 Business The network engineer needs to know the
request following:

• How can we make sure that our network has

enough IP addresses to support our
workloads?

• How do we build a dynamic and secure

network infrastructure in our Amazon Web
Services (AWS) account?
• How can we filter inbound and outbound
Network engineer traffic to protect resources on our network?

4
IP addressing

“How can we make sure that our network has enough IP addresses
to support our workloads?”

5
IP addresses
IPv4 example Network A uses 10.x.x.x
• An IP address
identifies a location
within a network. Identifies the
network
• It identifies the [Link] [Link]
network and the host.
• There are two types of [Link]
IP addresses: Network B uses 172.31.x.x
• IPv4
• IPv6 Identifies the location
of the host

[Link] [Link]

8
Classless Inter-Domain Routing (CIDR)

CIDR specifies a range of IP addresses called a CIDR block.

An IPv4 address is four groups of eight bits. VPC supported CIDR blocks
[Link]/16
[Link]/16
CIDR Total IPs

Dot notation to /28 16

specify the 00001010.00010110.00000000.00000000 … …
network or
subnet /20 4,096
/19 8,192

The remaining bits are /18 16,384

/16 reserves the first 16
the host range:
Slash notation for the bits for network /17 32,768
[Link] to
subnet mask identification
[Link] /16 65,536

9
VPC fundamentals

“How do we build a dynamic and secure network infrastructure in

our AWS account?”

11
VPC fundamentals topics

Amazon VPC
Subnets
Internet gateway

VPC fundamentals Route table

NAT gateway
Elastic network interface
Elastic IP address

12
Amazon VPC

Region
Region
• Provides logical
isolation for VPC [Link]/16 (65,536 addresses)
your workloads

• Permits custom Availability Zone 1

access controls
and security
settings for your
resources

• Is bound to a Availability Zone 2

single AWS
Region

• Default VPCs
already created

13
Subnets
Region
• Subnets are a subset
of the VPC CIDR block. VPC ] cloud (VPC)
[Link]/16 (65,536 addresses)
• Subnet CIDR blocks
Availability Zone 1
cannot overlap.
Public [Link]/20 Private [Link]/20
• Each subnet resides subnet subnet
within one Availability (4,096 addresses) (4,096 addresses)
Zone.
• An Availability Zone Availability Zone 2
can contain multiple Public [Link]/20 Private [Link]/20
subnets. subnet subnet
(4,096 addresses) (4,096 addresses)
• Five addresses are
reserved.

15
Public subnets
A public subnet holds resources that work with inbound and outbound internet traffic. It requires the
following:

Route table Internet gateway Public IP addresses

• A set of rules that the VPC uses • Allows communication • IP addresses that can be
to route network traffic between resources in your reached from the internet
• Requires a route to the internet VPC and the internet • Protects the private IP
addresses only reachable on
the network
VPC

Public subnet
Public IP: [Link]
Internet Private IP: [Link]
Internet
Route table EC2 instance
gateway

17
Internet gateways
Availability Zone
Availability Zone

Internet VPC [Link]/16

Public subnet [Link]/20
• Internet gateways permit
communication between Source IP: Route table
instances in your VPC and [Link]
the internet.
Source IP: Public IP: [Link]
[Link] Private IP: [Link]
• They provide a target in
your subnet route tables Internet EC2 instance
for internet-routable gateway
traffic. Private subnet [Link]/20

• They protect IP addresses Route table

on your network by
performing NAT. Private IP: [Link]

EC2 instance

18
Route tables
• Your VPC has an implicit
router.
Public route table
• You use route tables to
control where network Destination Target
traffic is directed. Availability Zone [Link]/16 local
[Link]/0 igw-1234567890abcdef0
[Link]/16
Public subnet [Link]/20
Public IP: [Link]
Private IP: [Link]
Internet EC2 instance Private route table
Internet
gateway Destination Target
Private subnet [Link]/20
[Link]/16 local
Private IP: [Link]

EC2 instance

19
Private subnets
Availability Zone
Internet
VPC [Link]/16
Public subnet
• Private subnets allow [Link]/20
indirect access to the Public IP: [Link]
Private IP: [Link]
internet.
Internet EC2 instance Route table
• The private IP address gateway
never changes. Private subnet
[Link]/20
• Traffic in the VPC stays Private IP: [Link]
Private route table
local. EC2 instance
Destination Target

[Link]/16 local

21
Network address translation with NAT gateways
Availability Zone

VPC
• You use NAT to Internet [Link]/16
protect your
Public subnet
private IP 3
addresses. Source IP: 2 Source IP: Elastic IP: [Link]
[Link] [Link] Private IP: [Link]
• A NAT gateway Internet
NAT gateway
uses an Elastic gateway
IP address as
the source IP Private subnet
address for 1 Source IP:
traffic from the [Link]
private subnet.
Private IP: [Link]

EC2 instance

22
Connecting private subnets to the internet
NAT gateway use case: Connecting resources in a private subnet to the internet

• The route table Availability Zone Public route table

for the private Destination Target
VPC [Link]/16
subnet sends all
[Link]/16 local
IPv4 internet
Internet
traffic to the Public subnet [Link]/0 igw-1234567890abcdef0
NAT gateway.

• The route table

for the public
Internet NAT gateway
subnet sends all
gateway
internet traffic
to the internet Private route table
Private subnet
gateway.
Destination Target

EC2 instance [Link]/16 local

[Link]/0 nat-021345abcdef6789

23
Elastic network interface
Availability Zone

VPC
An elastic network interface
is a logical networking Public subnet
component in a VPC that: Instance
Private IPv4: [Link]
• Can be moved across Customer
resources in the same
Availability Zone
Elastic network interface
• Maintains its private IP Private IPv4: [Link]
Internet
address, Elastic IP
gateway
address, and media
access control (MAC) Instance
address Private IPv4: [Link]

25
 Elastic IP addresses
• Permit
association with
Availability Zone Availability Zone
an instance or a
network interface Internet VPC
• Can be Public subnet Public subnet
reassociated and
Private IP: [Link] Private IP: [Link]
can direct new
Elastic IP: [Link] Elastic IP: [Link]
traffic Internet
immediately EC2 instance EC2 instance
gateway
• Have a default
restriction of five Private subnet Private subnet
per Region, per
Private IP: [Link]
account
• Support Bring EC2 instance
Your Own IP
(BYOIP)

26
Deploy a VPC across multiple Availability Zones
Region
Availability Zone
VPC Public subnet App subnet
• Deploy your VPCs across
multiple Availability
Zones to achieve high
NAT gateway
availability. App servers
• Create subnets in each
Availability Zone.
Elastic Load
• Deploy resources in each Internet Balancing
Availability Zone. gateway
Public subnet App subnet
• Distribute traffic between
the Availability Zones
using load balancers.
NAT gateway App servers

Availability Zone
27
VPC traffic security

“How can we filter inbound and outbound traffic to protect

resources on our network?”

28
Network access control lists (network ACLs)
VPC nacl-PublicSubnet
• A network ACL acts as
Availability Zone 1 Inbound rules
a firewall at the subnet
boundary. Public subnet Rule Type Protocol Port Source Allow or
# Range Deny
• By default, it allows all 100 HTTP TCP 80 [Link]/0 Allow
inbound and outbound 200 HTTPS TCP 443 [Link]/0 Allow
traffic. Web server * ALL Traffic ALL ALL [Link]/0 Deny
instance
• It is stateless, and
Outbound rules
requires explicit rules
Rule Type Protocol Port Source Allow or
for all traffic.
# Range Deny
• It evaluates rules, 100 Custom TCP TCP 1024- [Link]/0 Allow
Rule 65535
starting with the
* ALL Traffic ALL ALL [Link]/0 Deny
lowest numbered rule.

29
Security groups

AWS Cloud
Availability Zone
• A security group is a VPC
virtual firewall that
controls inbound and Public subnet
outbound traffic into
AWS resources. Security group Security group

• It allows traffic based

on IP protocol, port, or
IP address. Instance Instance

• It uses stateful rules.

32
Default and new security groups

Block all Allow all

• Security groups in inbound traffic outbound traffic
default VPCs allow all
outbound traffic. Security group Security group

• Custom security
groups have no
inbound rules, and
they allow all
outbound traffic.

33
Custom security group rules

Inbound
Source Protocol Port Comments

[Link]/0 TCP 80 Allows inbound HTTP access from all IPv4 addresses
[Link]/0 TCP 443 Allows inbound HTTPS traffic from anywhere

Outbound
Destination Protocol Port Comments

Allows outbound Microsoft SQL Server access to instances in the specified

SG ID of DB servers TCP 1433
security group

SG ID of MySQL servers TCP 3306 Allows outbound MySQL access to instances in the specified security group

34
Security group chaining
Availability Zone
Web security group
Inbound rule
• Inbound and Allow HTTPS port 443
outbound rules Source: [Link]/0 (any)
allow traffic
flow from the Web server
top tier to the
App security group Inbound rule
bottom tier.
Allow HTTP port 80
• The security Source: Web security group
groups act as
App server
firewalls to
prevent a
Data security group Inbound rule
subnet-wide
security breach. Allow TCP port 3306
Source: App security group

Database

35
Design your infrastructure with multiple layers of defense

VPC

Security
Internet Public group
subnet Instance
gateway
Security
Route table Network ACL group
Instance

36
Comparing security groups and network ACLs

Security Group Network ACL

Associated to an elastic network interface and implemented Associated to a subnet and implemented
in the hypervisor in the network

Supports Allow rules only Supports Allow rules and Deny rules

A stateful firewall A stateless firewall

All rules evaluated before All rules processed in order

deciding whether to allow traffic when deciding whether to allow traffic

Applies to an instance only if it is associated with the instance Applies to all instances deployed in the associated subnet

37
Review

39
 Present Consider how you would answer the
solutions following:
• How can we make sure that our network has
enough IP addresses to support our
workloads?
• How do we build a dynamic and secure
network infrastructure in our AWS account?
• How can we filter inbound and outbound
Network engineer
traffic to protect resources on our network?

40
Module review

In this module, you learned about the following:

✓ IP addresses
✓ VPC fundamentals
✓ VPC traffic security

Next, you review the following:

Capstone check-in

Knowledge check

41
 Capstone architecture

Region

VPC
Availability Zone
Public subnet App subnet Database subnet

User NAT gateway EFS mount Aurora replica

App servers target

Auto Scaling
group
Application
Internet Load Balancer Amazon EFS
gateway
Public subnet App subnet Database subnet

EFS mount
target Aurora primary
DB instance
NAT gateway App servers
Package
repo Availability Zone

42
 Capstone architecture check-in

Region

VPC
Availability Zone
Public subnet App subnet Database subnet

User NAT gateway

Internet
gateway
Public subnet App subnet Database subnet

NAT gateway
Package
repo Availability Zone

43
Knowledge check

44
 Knowledge check question 1

True or False: A single Amazon Virtual Private Cloud (Amazon VPC) can span multiple Regions.

Choice Response

A True

B False

45
 Knowledge check question 1 and answer

True or False: A single Amazon Virtual Private Cloud (Amazon VPC) can span multiple Regions.

Choice Response

A True

B
False
correct

46
 Knowledge check question 2

Which action must be taken to make a subnet public?

Choice Response

A Route outbound traffic from the subnet.

B Route inbound traffic from the internet gateway.

C Route outbound traffic to the internet gateway.

D Subnets are public by default.

47
 Knowledge check question 2 and answer

Which action must be taken to make a subnet public?

Choice Response

A Route outbound traffic from the subnet.

B Route inbound traffic from the internet gateway.

C
Route outbound traffic to the internet gateway.
correct

D Subnets are public by default.

48
 Knowledge check question 3

Which function does the NAT gateway serve?

Choice Response

A Load balances incoming traffic to multiple instances

B Allows internet traffic initiated by private subnet instances

C Allows instances to communicate between subnets

D Increases security for instances in a public subnet

49
 Knowledge check question 3 and answer

Which function does the NAT gateway serve?

Choice Response

A Load balances incoming traffic to multiple instances

B
Allows internet traffic initiated by private subnet instances
correct

C Allows instances to communicate between subnets

D Increases security for instances in a public subnet

50
 Knowledge check question 4

What should be used to create traffic filtering rules for a subnet?

Choice Response

A NAT gateway

B Route table

C Security group

D Network access control list (network ACL)

51
 Knowledge check question 4 and answer

What should be used to create traffic filtering rules for a subnet?

Choice Response

A NAT gateway

B Route table

C Security group

D
Network access control list (network ACL)
correct

52
 Knowledge check question 5

Which ports are open by default when a new security group is created? (Select TWO.)

Choice Response

A Nothing is allowed inbound.

B Nothing is allowed outbound.

C Anything is allowed inbound.

D Anything is allowed outbound.

E Inbound traffic is allowed on public subnets.

53
 Knowledge check question 5 and answer

Which ports are open by default when a new security group is created? (Select TWO.)

Choice Response
A
Nothing is allowed inbound.
correct

B Nothing is allowed outbound.

C Anything is allowed inbound.

D
Anything is allowed outbound.
correct

E Inbound traffic is allowed on public subnets.

54
End of Module 3

Corrections, feedback, or other questions?

Contact us at [Link]
All trademarks are the property of their owners.

55