Advanced Networking

Question 1

Global Accelleration vs Cloudfront

Answer 1

GA
Transiting Network data(TCP/UDP quickly and conveniently as possible into a Global Network.

Routing Connections into aws Backbone.

Global TCP/UDP Network Optimization

CF
Caching
HTTP/HTTPS content

Question 2

AWS DX

Answer 2

Low Latency
Consistent Latency

1G, 10G, 100G Physical connection

High-Speed Hybrid AWS Network

Business Premises => DX Location => AWS Region

Question 3

DX Costs

Answer 3

• Outbound Data Transfer Cost
• Port Hourly Cost

Question 4

DX Resilience

Answer 4

Direct Connect is not Resilient by default

Question 5

DX Vs VPN

Answer 5

VPN
Encryption requires processing overhead and Transit over the Public Internet.

DX
Dedicated Port Delivers Max possible Speed

Can access AWS Private Services (VPCs) and AWS Public Services - NO INTERNET

Question 6

VIF (Virtual Interface)

Answer 6

Virtual connections over the dx physical connection for resilience and HA.

• Transitive VIF
• Private VIF (Connection from Customer Location All the way to VPC)
• Public VIF (Connection from Customer Location Through to AWS Public Services)

Question 7

Transit Gateway

Answer 7

This is a Network Transit Hub that connects VPCs to on-premises networks.

• It Significantly reduces network complexity
• It’s a Single network object - HA and Scalable
• It Implements Attachments to other network types: VPC, Site-to-Site VPN & Direct Connect Gateway

Question 8

Transit Gateway

Answer 8

Works like a Network Switch for AWS Connections. Can Link many VPCs together and ROute the VPCs to a Customer Gateway with a single Netwrok routing Device.

TGW needs a Subnet in a AZ for set up

TGW can pair with other TGW across AWS Regions and accounts and VPCs

Question 9

VPC Pairing vs Transitive Gateway

Answer 9

Transitive gateway is recommended over VPN pairing for VPC pairing and Larger scale cross-network connections.

• Supports transitive routing
• Can be used to create global networks
• Share between accounts using AWS RAM
• Peer with different regions … same or cross account
• Less complexity vs w/o TGW

Question 10

Route Table Association

Answer 10

Only One route table can be associated with a Subnet at a time. This is either the MAIN or CUSTOM route table.

All subnets are either Automatically Associated with the Main or Explicitely Re-Associated using a Custom RT

Main implicitely Associates All Subnets. If Custom is dissociated, the subnet Automatically routes back to MAIN

RT Quotas:
50 Static Routes and 100 Dynamic Routes

Question 11

CIDR Overlap

Answer 11

VPC Peering cannot be established between two VPCs with Overlapping CIDRs

Question 12

Routing Overlaping CIDRs

Answer 12

Method1 - Split Routing
Create separate routes for each subnet one Subnet pointing to VPC-A and Subnet-B to VPC-B

Method 2 - Dedicated
Using a /32 CIDR as one of the Destinations for one of the connection routing to Target VPC-A, and /16 to VPC-B. RT Prioritizes the longer Prefix of both destinations first.

Question 13

Gateway Route Table

Answer 13

An Ingress Rout Table for the IGW or VGW that explicitly defines the landing destination of incoming traffic.

Gateway route tables can be used to direct a gateway (e.g. IGW) to take actions on inbound traffic - such as forwarding it to a security appliance

Question 14

Accelerated Site-to-Site-VPN

Answer 14

VPN over AWS Backbone. However, CGW first has to connect to a DX Location via a DX or Public Internet. And then Connection is terminated over a Transit Gateway at the VPC. Not VGW or IGW.

Acceleration can be enabled when creating a TGW VPN attachment. Not compatible with VPNs using a VGW

Question 15

VGW, TGW, IGW

Answer 15

• IGW - Public Internet
• VGW - Public Internet to CGW
• TGW (Transit Gateway) - AWS Backbone
• CGW - Customer Gateway/On Prem Gateway
• Gateway Endpoint - VPC-to-DynamoDB&S3 only
• Interface EndPoint - VPC-To-S3 and other AWS Private services

Question 16

VPC .2

Answer 16

VPC .2 or +2 is the IP Address reserved for DNS resolver in any VPC. It is used for DNS resolution by all services within the VPC

Question 17

Route53 Endpoints

Answer 17

A route53 service that manages hybrid DNS services etween VPC and an external DNS resolver. Eg, On-Prem. It uses ENI as its vpc endpoint and connection is done over DX, vpc peer, or VPN(the Existing hybrid connection.)

Question 18

Site-To-Site-VPN

Answer 18

Upon creation of a Site-to-Site-vpn, aws creates two Endpoints, ie, private and public endpoints. Each with its tunnel. Therefore a. Site-to-site-vpn connection is a dual tunell connection.
This connection is terminated at VGW(AWS side and CGW(Customer premise).

This connection Terminating on a Single CGW has a single point of failure. Resilience can be implemented by adding another router/CGW on the customer side in the same or preferably different Location.