Section 25: Networking - VPC

Question 1

What is CIDR - IPv4?

Answer 1

• CIDR = Classless Inter-Domain Routing, a method for allocating IP addresses

Question 2

Subnet Mask

Answer 2

• XX.XX.XX.XX -> Is the Base IP
• the value after the “/” is the subnet
  - 32/ = No IP can change
  - 24/ = The last IP can change
  - 16/ = The last 2 IP’s can change
  - 8/ = The last 3 IP’s can change
  - 0/ = All the IP’s can change

Question 3

What is Internet Gateway?(IGW)

Answer 3

• Allows resources in a VPC to connect to the internet.
• Must be created separately from a VPC
• One VPC can only be attached to one IGW and vice versa
• Internet Gateway on their own do not allow Internet access
• Route tables must also be edited.

Question 4

What is Bastion Hosts?

Answer 4

• We use a Bastion Host to SSH into our private EC2 instances
  Example
  - When your EC2 instance is in a Private Subnet and you want to ssh to
  it, you connect to a Bastion host in the Public Subnet and then connect
  to the EC2 in the Private Subnet.

Question 5

What is a NAT Intsance?
P294

Answer 5

• NAT = Network Address Translation
• Allows EC2 instances in private subnet to connect to the internet
• Must be launches in a public subnet
• Must have Elastic IP attached to it
• Route Tables must be configured to route traffic from private to the NAT instance

Question 6

What is NAT Gateway?

Answer 6

• AWS managed NAT, higher bandwidth,high availability, no administration
• NATGW is created in a specific Availability Zone, uses an Elastic IP
• Required an IGW (Private Subnet => NATGW=>IGW)

Question 7

What is NACL(Network Access Control List)

Answer 7

• NACL are like a firewall which control traffic from and to subnet
• One NACL per subnet, new subnet are siggned the DEFAULT NACL
• You define NACL Rules:
  - Rules have number(1-32766)
  - First rule match will drive the decision
• Newly created NACL will deny everything
• NACL are great way of blocking specific IP address at the subnet level
• The Default NACL accepts everything inbound/outbound with the subnet its associated with
• NACL is stateless

Question 8

What is VPC Reachability Analyzer?

Answer 8

• A network diagnostic tool that troubleshoots network connectivity between two endpoints in your VPC
• It used the network configuration to determine if two endpoints are reachable.

Question 9

What is VPC Peering

Answer 9

• Privately connect two VPCs using AWS network.
• Make them behave as if they were in the same network.
• You must update route tables in each VPC’s subnets to ensure EC2 instances can communicate with each other.

Question 10

What is VPC Endpoints (AWS PrivateLink)
P306

Answer 10

• VPC Endpoint allows you to connect to AWS services using a private network instead of using the public Internet. Because AWS is exposed to the public, it allows you to connect privately.

Question 11

What 2 VPC Endpoints do you get?

Answer 11

1) Interface Endpoints
- Provisions an ENI(private IP address) as an entry point
- Supports most AWS services.

2) Gateway Endpoints
- Provisions a gateway and must be used as a target in a route table
- Supports both S3 and DynamoDB

Question 12

What is VPC Flow Logs?

Answer 12

• Capture information abut IP traffic going into your interfaces:
  > VCP flow logs
  > Subnet Flow Logs
  > Elastic Network Interface Flow Logs
• Helps to minitor & troubleshoot connectivity issues

Question 13

How to create a VPN connection between your VPC on AWS and on-premis site?

Answer 13

1) Virtual Private Gateway (VGW)
- VPN connector on AWS side.

2) Customer Gateway (CGW)
- Software application or physical device on customer/on-premise side of the VPN connection.

Important steps:
- Make sure to enable Route Propagation for the Virtual Private Gateway.
- If you need to ping your EC2 instances from on-premises, make sure you add the ICMP protocol on the inbound of your security groups.

Question 14

What is AWS VPN CloudHub?

Answer 14

• Provide secure communication between multiple sites, if you have multiple VPN connections.

Question 15

What is Direct Connect (DX)
p332

Answer 15

• Provided a dedicated private connection from a remote network to your VPC.
• Dedicated connection must be setup between your DC AWS Direct Connect locations
• You need to setup a Virtual Private Gateway on your VPC

Question 16

What two resiliency do you get for direct connect?

Answer 16

1) High Resilliency
- One connection for multiple locations
2)Maximum Resiliency
- Having 2 or more connections at a location

Question 17

What can you use as a backup when you use Direct Connect as a primary connection?

Answer 17

You can make use of Site-toSite VPN.

Question 18

What is Transit Gateway?

Answer 18

• When you have multiple VPC’s and you want to connect them all together.
• Support IP Multicast

Question 19

What is Egress-only Internet Gateway?

Answer 19

• Similar to a Nat Gateway but only used for IPv6

Question 20

VPC Section Summary

Answer 20

Goto P341

Question 21

What is AWS Network Firewall?

Answer 21

• Protects your entire Amazon VPC
• From layer 3 to layer 7 protection
• Any network data can be inspected