Scribd
Upload
451 views

Networking in AWS PDF

The document discusses various network designs and configurations on AWS including VPC peering, client VPN, site-to-site VPN, transit gateway, Direct Connect, network firewall, DNS with Route 53 resolver, and content delivery with CloudFront. It provides details on use cases and deployment models for each of these AWS networking services. Key concepts covered are VPC, security groups, NACLs, VPC peering connections, transit gateway attachments, Direct Connect links and link aggregation groups. Reference documentation and blog posts are also listed.

Uploaded by

Zinko Thu
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
451 views

Networking in AWS PDF

The document discusses various network designs and configurations on AWS including VPC peering, client VPN, site-to-site VPN, transit gateway, Direct Connect, network firewall, DNS with Route 53 resolver, and content delivery with CloudFront. It provides details on use cases and deployment models for each of these AWS networking services. Key concepts covered are VPC, security groups, NACLs, VPC peering connections, transit gateway attachments, Direct Connect links and link aggregation groups. Reference documentation and blog posts are also listed.

Uploaded by

Zinko Thu
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 69

Networking in AWS Cloud

What we will discuss today…….


Network Designs on AWS and their use cases:

Concept of Site-to-Site
VPC Peering Cloud Hub Client VPN
VPC VPN

Transit Direct AWS Network Route 53 DNS


Cloud Front
Gateway Connect Firewall Resolver
Start of VPC Concepts
Concept of
VPC
Concept of
VPC
NACL and Security Group
AWS Private
Link
End of VPC Concepts
Start of VPC Peering
VPC Peering
VPC Peering
VPC
Peering
VPC
Peering
With VPC Peering connections With Transit Gateway
End of VPC Peering
Start of AWS Client VPN
AWS Client
VPN

• https://aws.amazon.com/blogs/networking-and-content-delivery/using-
aws-client-vpn-to-scale-your-work-from-home-capacity/
End of AWS Client VPN
Start of Site-to-Site VPN
Site to Site VPN

• Software site to site VPN


• Managed VPN
• AWS Transit Gateway + VPN
• AWS Direct Connect + VPN
• AWS Direct Connect + AWS
Transit Gateway + VPN
Software site
to site VPN
Managed
VPN
AWS Transit
Gateway +
VPN
AWS Direct
Connect +
VPN
AWS Direct
Connect +
AWS Transit
Gateway +
VPN
AWS VPN
CloudHub

• Each of branch offices must have unique ASN.


• The sites must not have overlapping CIDR Ranges.
• Up to 10 customer gateways.
End of Site-to-Site VPN
Start of Transit Gateway
Transit
Gateway
4 Types of TGW Attachments
Transit VPC
End of Transit Gateway
Start of Direct Connect
Direct
Connect

https://docs.aws.amazon.com/directconnect/latest/UserGuide
/Welcome.html
Direct
Connect

https://docs.aws.amazon.com/directconnect/latest/UserGuide
/Welcome.html
Direct
Connect
Gateway

Direct Connect Gateway is a global resource.


Direct
Connect
Gateway

Direct Connect Gateway is a global resource.


Direct
Connect
• https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html

Direct
Connect
Direct
Connect:
Link
Aggregation
Group

https://docs.aws.amazon.com/directconnect/latest/UserGuide/lags.html
Direct
Connect

• https://aws.amazon.com/blogs/apn/achieving-business-agility-in-hybrid-
cloud-with-aws-direct-connect/
Direct
Connect
Direct
Connect
End of Direct Connect
Start of AWS Network Firewall
AWS GWLB
AWS
Network
Firewall

• https://aws.amazon.com/blogs/networking-and-content-
delivery/deployment-models-for-aws-network-firewall/
Distributed AWS Network Firewall deployment model

AWS
Network
Firewall
Centralized deployment model

1. East-West Traffic Inspection Model

AWS 2. North-South: Centralized on-premises egress & ingress via Transit


Network Gateway and Transit VIF/Direct Connect gateway/AWS Site-to-Site VPN
Firewall
3. North-South: Centralized internet egress (VPC to internet via Transit

Gateway) and NAT gateway

4. North-South: Centralized Internet Ingress via Transit Gateway and NLB/ALB

or reverse proxy
1) East-West Traffic Inspection Model
2) North-South: Centralized on-premises egress & ingress via Transit Gateway and
Transit VIF/Direct Connect gateway/AWS Site-to-Site VPN
3) North-South: Centralized internet egress (VPC to internet via Transit
Gateway) and NAT gateway
4) North-South: Centralized Internet Ingress via Transit Gateway and NLB/ALB or
reverse proxy
Combined centralized and distributed deployment model

1. Some VPCs optionally have their own IGW for internet ingress/egress and

AWS traffic is protected by dedicated AWS Network Firewall


Network
Firewall 2. Inspection VPC only for East-West traffic and egress VPC with inspection

for internet
1) Some VPCs optionally have their own IGW for internet ingress/egress
and traffic is protected by dedicated AWS Network Firewall
2) Inspection VPC only for East-West traffic and egress VPC with inspection
for internet
End of AWS Network Firewall
How DNS
works in
AWS
Route 53
DNS Resolver

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide
/resolver.html
Route 53
DNS Resolver

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide
/resolver.html
How CloudFront Works

https://docs.aws.amazon.com/AmazonCloudFront/latest/Devel
operGuide/HowCloudFrontWorks.html
References

• https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-
options/network-to-amazon-vpc-connectivity-options.html
• https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-
vpc.html
• https://docs.aws.amazon.com/redshift/latest/mgmt/enhanced-vpc-
routing.html
You can reach me via

Name: Thurain Oo
Role : Cloud Engineer at Nex4
• Facebook - https://www.facebook.com/thurain.oo.359778/

• Email – mr.zxchero12@gmail.com , t.oo@nex4.net

• LinkedIn - https://www.linkedin.com/in/thurain-oo-222a1415b/
End of Our Knowledge sharing session!

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy