Cloud Networking
IT4090 – Cloud Computing
Lecture Outline
• Networking Recap
• Software Defined Networking
• Network Function Virtualization
• Virtual Networks and Subnets
• Access Controlling
• Network Gateway Services
• Network Peering
• Hybrid Connectivity
• Private Access to Cloud Services
• Flow Logs
Networking
Recap
• IP addresses
• Subnets / VLSM
• Basic Routing
• Default Gateways
Software Defined Networking (SDN)
• SDN is a network management architecture that
enables, dynamic, programmable network
configuration in order to improve network
performance and monitoring.
• This architecture decouples the network control
and forwarding functions enabling the network
control to become directly programmable and the
underlying infrastructure to be abstracted for
applications and network services
Network Function Virtualization (NFV)
NFV is a network architecture
which decouples Physical These Virtual Network Cloud-native Network
Network Functions (PNF) from Functions (VNFs) include Functions (CNF) is the successor
proprietary hardware network functions such as of VNFs, which is a software
appliances and run them as firewalls, traffic control, virtual implementation of a PNF which
software in virtual machines routing etc. runs inside a Linux container.
(virtual network functions).
Network Function Virtualization (NFV)
Advantages of CNF
Auto scaling
• Speed
Monitoring • Flexibility
• Efficiency
Deployment
Security • DevOps
• CI/CD
SDN vs. NFV
Similarities Differences
• Both use network abstraction • SDN separates Network Control
• Both depend heavily on Functions from Forwarding
virtualization Functions, while NFV abstracts
all Network Functions from
underlying hardware.
• SDN defines the big picture
aspect of the infrastructure,
while NFV deliver a wide range
of specific functionalities.
Virtual Networks
Cloud networking
service which provides Logically isolated from Has one or more IP
networking functions other virtual networks. ranges.
to cloud resources.
Implementations
Can peer with other • AWS VPC (Virtual Private
Has one or more
virtual networks if IP Cloud)
subnets.
ranges do not overlap. • Azure Virtual Network
Subnets
Segments virtual network IP range even further
Subnet CIDR blocks cannot overlap within a virtual network
Traffic can be restricted using Access Control Lists
AWS offers private and public subnets
• Instances in public subnets can send outbound traffic directly to internet.
• Instances in private subnets cannot send outbound traffic directly to internet.
Azure does not have the public/private subnet concept.
• All subnets can be considered as public subnets
• Can implement private subnet functionality through route tables
Virtual Networks & Subnet Sizing
Allowed IP ranges – RFC 1918 Private IP Ranges
• [Link]/8 – ([Link] – [Link])
• [Link]/12 – ([Link] – [Link])
• [Link]/16 – ([Link] – [Link])
IPv4 Allowed Block Sizes
• Azure – between /2 netmask to /29 netmask
• AWS – between /16 netmask to /28 netmask
Five IPs from each subnet IP block is reserved
• 1st IP – Network Address
• 2nd IP – Reserved for the Router
• 3rd IP – Reserved for DNS
• 4th IP – Reserved for DNS/future use
• Last IP – Network Broadcast Address
Subnet IP Reservation
[Link]/24 1st IP [Link] – Network Address
2nd IP [Link] – Reserved
3rd IP [Link] – Reserved
4th IP [Link] – Reserved
Last IP [Link] – Broadcast Address
First usable IP [Link]
Last usable IP [Link]
Number of usable IPs 28 – 5 = 251
Subnet IP Reservation
[Link]/25 1st IP [Link] – Network Address
2nd IP [Link] – Reserved
3rd IP [Link] – Reserved
4th IP [Link] – Reserved
Last IP [Link] – Broadcast Address
First usable IP [Link]
Last usable IP [Link]
Number of usable Ips 27 – 5 = 123
Subnet IP Reservation
[Link]/27 1st IP [Link] – Network Address
2nd IP [Link] – Reserved
3rd IP [Link] – Reserved
4th IP [Link] – Reserved
Last IP [Link] – Broadcast Address
First usable IP [Link]
Last usable IP [Link]
Number of usable Ips 25 – 5 = 27
Virtual Network Interfaces
Enables a compute
A logical networking
instance to
component which Attaches to a compute
communicate with other
represents the network instance.
compute instances
interface card (NIC).
and/or internet.
Implementations
Can attach more than
Can have one public IP • AWS – Elastic Network
one virtual network Interface (ENI)
and one or more private
interfaces to the same • Azure – Network Interface
Ips
compute instance. Card (NIC)
Access Controlling
Implements a simple firewall functionality to control inbound and outbound traffic
to a subnet / virtual network interface.
Need to add ACL rules which contains
• Rule number
• Protocol
• Source / Destination Port Ranges
• Source / Destination IP Ranges
• Allow / Deny Action
Usage varies in CSPs
• AWS Security Groups – Assigned to an EC2 instance
• AWS Network Access Control List (NACL) – Assigned to a subnet
• Azure Network Security Groups (NSG) – Can be assigned to both subnets and NICs
Stateful / Stateless Rules
Stateful Rules
• Only need to specify the security rule for the request, no need to
specify a security rule for the response.
Stateless Rules
• Need to specify security rules for the request as well as the response.
Implementations
• AWS SG – Stateful
• AWS NACL – Stateless
• Azure NSG - Stateful
Network Gateway Services
Virtual Network Functions associated with providing
connectivity between cloud resources and outside
networks / internet.
Internet Gateway
NAT Gateway
VPN Gateway
Network Transit Gateway
Internet Gateway
Provides connectivity
between internet and Scales horizontally No bandwidth constraints
virtual network
Implementations Azure does not have the
• AWS Internet Gateway internet gateway concept
• Internet connectivity is provided
by default through the default
gateway
NAT Gateway
Provides Network
Prevents connections
Address Translation
to subnets getting
(NAT) to compute
initiated from the
instances in private
internet.
subnets
Implementations
NAT Gateway should • AWS NAT Instance
be deployed in a public • AWS NAT Gateway
subnet. • Azure Virtual Network NAT
AWS Internet Gateway & NAT Gateway
VPN Gateway
VPN Gateways are used to Implementations
create encrypted tunnels • Azure VPN Gateway
over the public internet to • AWS Virtual Private Gateway
send encrypted traffic
between virtual networks
and on-premises networks.
VPN Services
Two types of VPN services are provided by CSPs
• Site-to-site VPN – VPN connectivity between virtual network and on-premises network, or
between two virtual networks
• Point-to-site VPN – VPN connectivity between virtual network and a client PC with a special
client VPN software
Azure VPN Gateway provides both site-to-site and point-to-site VPN
connectivity
AWS Virtual Private Gateway provides only site-to-site connectivity.
AWS provides point-to-site connectivity through a separate service called
AWS Client VPN
Azure VPN Services
AWS VPN Services
Network Transit Gateway
A service which
This architecture used
connects multiple
to be implemented
virtual networks and
through the hub-spoke
on-premises networks
model.
through a central hub.
Implementations
• AWS Transit Gateway
• Azure Virtual WAN
Hub and Spoke Architecture
AWS Transit Gateway
AWS Transit Gateway
Azure Virtual WAN
Network Peering
Allows to connect and communicate between two virtual networks.
Used to be implemented through VPN Gateways.
Each virtual network can be peered to more than one virtual networks.
Can peer virtual networks across accounts / subscriptions.
Does not support transitive peering.
• If VNet A is peered with VNet B and VNet B is peered with VNet C, VNet A cannot
communicate with VNet C and vice-versa
Both AWS and Azure have implemented this feature
AWS VPC Peering
Azure VNet Peering
Bastion Hosts
Also called as a Jump Host
A special compute instance deployed to provide secure management
access to other compute instances in private subnets.
Can connect to private instances without exposing them to internet.
The bastion host must be placed in a public subnet and provided with
a public IP.
Azure Bastion Host
Hybrid Connectivity
Connect Remote Connect Remote
There are few Users Networks
ways we can use • Direct internet • Site-to-Site VPN
to get connected connectivity • Direct Connectivity
• Through VPN • Azure Express
to a virtual
• Azure Point-to- Route
network in CSP Site VPN • AWS Direct
• AWS Client VPN Connect
AWS Direct Connect
Azure Express Route
Private Access to Cloud Services
Private Links
• Provide access to PaaS services of the CSP from the virtual network without
going through the public internet.
Private Endpoints
• Can be connected to a virtual network with an IP
• Provides access between other resources in the virtual network and PaaS services
through Private Links.
Azure Service Endpoints
• Provide secure and direct connectivity to Azure PaaS services over an optimized
route over the Azure backbone network.
• Traffic from the virtual network will still hit the public endpoint of the PaaS
service.
Azure Private Link
Azure Private Link
AWS Private Link
Azure Service Endpoint
Network Flow Logs
Capture information about IP
traffic going in and out of your Log data is collected outside Does not affect network
network interfaces in the of the network traffic path throughput or latency
virtual network.
Use cases
Azure Flow Logs are captured • Troubleshooting connectivity issues
Flow log data can be stored in • Intrusion/anomaly detection
from NSGs, AWS Flow Logs
a separate object storage • Archival for
can be created for VPCs,
(AWS S3 / Azure Blobs) compliance/regulatory/legal purposes
subnets and/or ENIs.