AWS Networking Facts Flashcards
Can a ENI be moved across AZs?
No. ENIs are specific to subnets since they get an IP address in the subnet’s CIDR range.
You can move a network interface from one instance to another, if the instances are in the same Availability Zone and VPC but in different subnets. e.g. Multihoming.
Can ENIs be detached from an instance?
You can detach secondary network interfaces when the instance is running or stopped. However, you can’t detach the primary network interface.
Can VPCs span AZs and Regions?
VPCs are specific to a Region and hence cannot span a Region.
VPCs can span multiple AZs
What are the 5 IP addresses in each subnet reserved by AWS?
.0 - Network Address .1 - Router address .2- DNS Address .3-Reserved for future use .255 - Broadcast (not supported/hence reserved).
What are the attributes of an ENI?
- A primary private IPv4 address from the IPv4 address range of your VPC
- One or more secondary private IPv4 addresses from the IPv4 address range of your VPC
- One Elastic IP address (IPv4) per private IPv4 address
- One public IPv4 address
- One or more IPv6 addresses
- One or more security groups
- A MAC address
- A source/destination check flag
- A description
Can ENIs support multiple Security Groups?
Yes. An ENI can have up to 5 security groups.
How do multiple SGs work?
A single SG can be associated with multiple ENIs.
A single ENI can have multiple SGs.
When multiple SGs are used, the rules are the product of all of them.
SGs are stateful.
They have an implicit deny - i.e. you can only specify “Allow”.
All rules are evaluated before proceeding (i.e. the rules are OR’ed - so if SG allows a particular traffic even if other don’t explicitly allow, then traffic is allowed)
How do NACLs work?
A single NACL can be associate with multiple subnets.
However, a single subnet can have only one NACL.
NACLs are stateless.
Both “Allow” and “Deny” can be specified.
Rules are evaluated in order.
The very last rule is a DENY ALL.
How do you configure ephemeral ports in NACLs?
- Client initiating connection always chooses the ephemeral port. So, inbound/outbound rules have to be specified according to who the client is.
- Ephemeral ports vary based on operating system.
- In general, it is best to have inbound/outbound ports opened from 1024-65536 to cover all OS.
- You can have a specific DENY rule earlier to deny traffic from malicious ports, before the rule that allows such a broad range of ports.
What port does the “Port Range” in SGs rules refer to?
The port ranges are all destination ports - NOT source ports.
What’s the difference between default NACL and Custom NACL?
Your VPC automatically comes with a modifiable default network ACL. By default, it allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic.
You can create a custom network ACL and associate it with a subnet. By default, each custom network ACL denies all inbound and outbound traffic until you add rules.
What’s the difference between default SG and Custom SG?
Your VPC automatically comes with a default security group. All inbound traffic (from itself) is permitted. All outbound traffic is permitted.
When you create a new security group, it has no inbound rules. Therefore, no inbound traffic originating from another host to your instance is allowed until you add inbound rules to the security group.
By default, a security group includes an outbound rule that allows all outbound traffic.
What does statefulness for SG mean?
It means that if inbound traffic is permitted, then the corresponding outbound traffic is also permitted - i.e. the outbound rules are not evaluated and vice versa.
What makes a subnet public?
A public subnet is a subnet that’s associated with a route table that has a route to an Internet gateway.
Note also that: instances in the subnet must have a globally unique IP address (EIP, IPv4 or IPv6). Or else, they must use a NAT GW or instance if they only have a private address.
Additionally, NACLs and SGs must permit the relevant traffic.
What are the different types of VPC Endpoints?
Interface Endpoints
Gateway Load Balancer Endpoints
Gateway Endpoints
What are the functions of the IGW?
IGW performs two functions:
a) to provide a target in your VPC route tables for internet-routable traffic, and
b) to perform network address translation (NAT) for instances that have been assigned public IPv4 addresses.
What are CIDR Range limitations in VPC Peering?
The requester and acceptor VPCs cannot have overlapping CIDR ranges.
However, a hub VPC can peer with two spoke VPC with overlapping CIDR range. The two spoke VPCs essentially communicate with different subnets in the hub VPC each with their own route table pointing to a different peering connection.
In VPC Peering, what is the impact of Regions on Security Groups?
Peer VPCs can be in the same account, different account in the same Region or in different Regions.
When VPCs are in the same Region, the SGs can reference each other in the SG-rules.
Across Regions, the SG rules have to use CIDR blocks.
If SG reference is “Stale” -that indicates that the peer deleted the referenced SG or the peering connection itself is terminated.
How does DNS resolution work in VPC Peering?
By default, if instances on either side of a VPC peering connection address each other using a public DNS hostname, the hostname resolves to the instance’s public IP address. To change this behavior, enable DNS hostname resolution for your VPC connection. After enabling DNS hostname resolution, if instances on either side of the VPC peering connection address each other using a public DNS hostname, the hostname resolves to the private IP address of the instance.
Where can VPC Flow Logs be attached?
a) VPC
b) Subnet
c) ENI.
Can capture Accepted, Rejected or All traffic.
Different combinations can be setup - e.g. one VPC Flow Log for accepted and another for rejected.
Flow Logs cannot be modified once created. Delete and recreate.
Flow Logs are NOT real-time. There may be a delay of up to 5 minutes (for Cloudwatch) and up to 10 minutes (for S3) after the close of the aggregation window.
They are customizable; can be stored to S3 or Cloudwatch. Some fields can only be captured to S3.
What are the fields in Flow Logs?
There are two FL formats a) Default and b) Custom.
Default cannot be modified - a subset of all available fields. Includes version#, acct id, interface id, src/dst port/IP, protocol, pkt, bytes, time (start and end), action (accept/reject), status (OK, NO DATA, SKIP DATA).
Custom formats are customizable.
What is a Flow Log Aggregation Interval?
This specifies the capture window. Default is the maximum of 10 minutes.
You can set it to 1 minute, but this would mean more logs.
What traffic does VPC Flow Logs NOT capture?
a) Traffic to Amazon DNS Server
b) Windows instance license activation
c) Instance metadata to 169.254.169.254
d) Traffic to time sync: 169.254.169.123
e) DHCP
f) Traffic to VPC Router
g) Traffic between an ENI and ELB.
How does FL integrate with CW?
When publishing to CloudWatch Logs, flow log data is published to a log group, and each network interface has a unique log stream in the log group. Log streams contain flow log records.
In the flow logs what are the key TCP Flags value?
The bitmask value for the following TCP flags: SYN: 2 (Client to Server) SYN-ACK: 18 (Server back to Client) FIN: 1 (Bidirectional) RST: 4
A flag value of 3 means client sent both SYN and FIN and it was recorded in the same flow log.
A flag value of 19 means, server sent both SYN-ACK and FIN and it was recorded in the same flow log.
What is the difference between regular and jumbo frames?
Regular frames are Ethernet v2 which support a Max Transmission Unit (MTU) size of 1500 bytes. Most of the internet is limited to this.
In AWS, some EC2 instances support a MTU of 9001 bytes - Jumbo frames. But this is only within AWS environment. When they leave the boundaries of AWS (including VPN connections) they are broken into 1500 MTUs.
Jumbo frames are supported only within a single Region. Inter-region traffic is limited to 1500 MTU.
Jumbo frames are supported over VPC peering connections, however, not if it is inter-Region VPC peering. JFs are supported over DX Private/Transit VIFs.
Jumbo frames are enabled by default within a VPC. Instances don’t have to be within a placement group to take advantage.
What are the high performance computing instance types?
Compute Optimized instances are ideal for HPC - c4, c5 and c6 instance types.
However, for graphics use the G3 instance. These are the latest generation of Amazon EC2 GPU graphics instances that deliver a powerful combination of CPU, host memory, and GPU capacity.
What are the different placement groups?
Cluster
Partition
Spread
All placement groups are specific to a single AZ.
What are the characteristics of the Cluster PG?
Cluster - best for low network latency, high network throughput, or both.
All instances in the group reside in the same AZ (does not say same HW rack/host, but it does say it in the same high-bisection bandwidth segment of the network). Instances can span peer VPCs.
Supports up to 10 Gbps for single-flow traffic within placement group. Limited to 5 Gbps for Direct Connect.
Limited to 5 Gbps for flows outside the placement group - e.g. traffic between AZs, flow between EC2 and S3 etc.
What are the characteristics of the Partition PG?
Groups of instances (called partitions) are hosted on separate HW. No partition shares a rack with another.
Best for large distributed and replicated workloads, such as HDFS, HBase, and Cassandra, across distinct racks.
What are the characteristics of the Spread PG?
Instances are spread across distinct HW (separate power and network). Can span AZs.
What is Enhanced Networking?
ENA uses single root I/O virtualization to provide high-performance networking capabilities on supported instance types.
SR-IOV is a method of device virtualization that provides higher I/O performance and lower CPU utilization when compared to traditional virtualized network interfaces.
Enhanced networking provides higher bandwidth, higher packet per second (PPS) performance, and consistently lower inter-instance latencies.
What are the two types of enhanced networking?
Elastic Network Adapter - a network driver, ENA can support network speeds of up to 400 Gbps for supported instance types (current instances only support 100 Gbps).
Intel 82599 Virtual Function Interface - supports network speeds of up to 10 Gbps for supported instance types.
Why would you want to have multiple IP addresses for EC2 instances?
a) Host multiple websites on a single server - associate SSL certs with a specific IP
b) For network appliances like Firewalls and LBs
c) Redirect internal traffic to a standby by moving secondary IP to a standby instance.
When you add a secondary IP to an instance are you also adding a new network interface?
No. You can assign a secondary private IPv4 address to any network interface.
Security Groups apply to network interfaces and hence all IPs associated with an interface are subject to the SG rules.
What is an Elastic IP Address?
An Elastic IP address is a static public IPv4 address, which is reachable from the internet. No IPv6 Elastic IP.
What are the attributes on an ENI?
A primary private IPv4 address from the IPv4 address range of your VPC
One or more secondary private IPv4 addresses from the IPv4 address range of your VPC
One Elastic IP address (IPv4) per private IPv4 address
One public IPv4 address
One or more IPv6 addresses
One or more security groups
A MAC address
A source/destination check flag
A description
How do you enable enhanced networking with ENA?
Do the following:
a) Choose an instance type that supports ENA; set the instance attribute to enable ENA
b) Choose an OS/AMI that supports it (e.g. Amazon Linux 2); enable enhanced networking attribute.
This should automatically enable it.
How do you enable enhanced networking with Intel 82599 VF I/F?
a) Choose an appropriate instance type
b) Launch using HVM AMI (Hardware Virtual Machine). - e.g. Amazon Linux HMV AMI.
What’s an Elastic Fabric Adapter?
An Elastic Fabric Adapter (EFA) is a network device that you can attach to your Amazon EC2 instance to accelerate High Performance Computing (HPC) and machine learning applications.
How’s an EFA different from an ENA?
ENAs provide traditional IP networking features that are required to support VPC networking. EFAs provide all of the same traditional IP networking features as ENAs, and they also support OS-bypass capabilities.
OS-bypass enables HPC and machine learning applications to bypass the operating system kernel and to communicate directly with the EFA device.
ENAs are used by traditional TCP/IP stacks provided by the OS.
EFAs are used by HPC applications that bypass TCP/IP. They use something called Libfabric that interacts directly with the EFA device.
What is a Gateway Route Table?
A route table that is associated with an Internet GW or Virtual GW. Has Destination and Targets that is used by the Gateways to route.
What is Ingress Routing?
Traffic destined for a VPC is routed by IGW or VGW based on Gateway Route Table.
For example, internet traffic destined for Instance B, could be routed by the IGW, based on the GW Route Table to instance A’s ENI (which provides firewall services - e.g. Palo Alto FW).
Instance A (in this case) is the next hop (i.e. an explicit router) which inspects traffic and then forward it to the destination.
What is a Transit Gateway?
- TGW is a Regional network construct that allows large scale (up to 5,000) communication between VPCs.
- Supports VPN and Direct Connect communications.
- Peering connections between TGWs in different regions (Static routes must be added)
- Support multiple route tables (VRF/Network Segmentation) - up to 20 TGW RT and 10,000 routes per TGW.
- Attachments are their own objects (e.g. connects VPCs to TGW)
- Each attachment is associated with one route table
- Each attachment propagates routes to one or more route tables
- Attaching a VPC - specify one subnet in each AZ. Otherwise resources in that AZ cannot reach TGW even if the route table has an entry.
- VPC route tables must be updated to route traffic to the TGW.
- TGW Route Tables support blackhole routes.
*
What do the enableDnsHostnames and enableDnsSupport in a VPC configuration do?
enableDnsHostnames -Indicates whether instances with public IPv4 addresses get corresponding public DNS hostnames. If this attribute is true, instances in the VPC get public DNS hostnames, but only if the enableDnsSupport attribute is also set to true.
enableDnsSupport-Indicates whether the DNS resolution is supported. If this attribute is false, the Amazon Route 53 Resolver server that resolves public DNS hostnames to IP addresses is not enabled.
If this attribute is true, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC IPv4 network range plus two will succeed.
When you launch an instance into a VPC, it always receives a private DNS name.
No DNS hostnames for IPv6.
What is the size of the smallest subnet you can create?
The size is /28 (16 IPv4 addresses).
Remember (5 of the 16 addresses are not usable).
Also, to deploy a ELB, you must have a subnet that is /27 or larger with at least 8 available IP addresses.
What’s the size of the VPC’s IPv6 CIDR block?
A /56 is automatically assigned by AWS. You cannot select your own range.
What’s the size of a IPv6 subnet?
A /64 is automatically assigned.
What is a IPv6 GUA?
Global Unicast Addresses in IPv6 always start with a “2” or “3”.
2000::/3 (first three bits are 001). Leftmost 64 bits are the network segment and the rest (64 bits) are the node.
How many rules can you have per Security Group?
You can have 60 inbound and 60 outbound rules per security group (making a total of 120 rules). Separately enforced for IPv4 and IPv6 - i.e. 60 inbound IPv4 rules and 60 inbound for IPv6 rules.
Security groups per network interface = 5 (default) and 16 (max).
No more than 1,000 rules total (#of SG * # of rules/SG).
How many IPsec tunnels are there in a VPN connection?
2 IPsec tunnels per VPN Connection.
Each tunnel terminates to a specific public IP address (on the VGW). 2 public IPs total.
If a second VPN connection is terminated on the same VGW, then the VGW allocates two more new IP addresses - total 4 Public IPs.
Each tunnel can support up to 1.25 Gbps depending on packet size. But the VGW itself has a max of 1.25 Gbps (this means if there are two tunnels, each tunnel can only support .625 Gbps, if there are multiple connections to a single VGW, then they can only support less than that!).
To increase bandwidth you can forward traffic to both endpoints. Requires support of Equal Cost Multipath on the CGW. However, on the return side, AWS will always pick a single tunnel.
What are the two types of VPN in AWS?
1) Hardware VPN: Involves VGW and CGW;
2) SW VPN: EC2 instances run VPN SW (no VGW is involved).
What types of routing does the VGW support?
Dynamic Routing (uses BGP) Static Routing
Note:
1) A VGW must be assigned a private ASN whether you plan to use BGP or not.
2) VGWs support only IPv4 based VPN tunnels. However, TGWs support IPv6.
3) Firewall at the customer location must be opened for UDP Port 500 (Phase 1 Tunnel/IKE) and IP Protocol #50 (ESP Traffic - Phase 2 Tunnel).
4) If behind NAT-GW, then NAT-T must be supported and port 4500 must also be opened.
5) For every VPN connection you terminate on a VGW, two IP addresses are assigned. So, if you have two VPN connections (4 tunnels) then VGW presents 4 IP addresses.
6) New: You can use a certificate from the customer device to connect to the VGW. In this case, when you create the CGW, you don’t need to specify the IP address. This is useful when the CGW uses dynamic addressing.
Can ENIs be moved across subnets?
No. Since ENIs are allocated a Private IP address from the subnet addressing space, they cannot be moved.
However, ENIs can be attached to instances that have their primary ENIs in another subnet - so long as the instances are in the same AZ.
ENIs are essentially scoped to AZs and cannot be used across AZs.
Can ENIs be used across AZs?
No. ENIs can only be attached to instances in the same AZs.
Instances can have ENIs in multiple subnets within an AZ (multihoming).
Can multiple ENIs be used to increase bandwidth?
No. NIC teaming cannot be used to increase bandwidth.
In a VPC Gateway Endpoint is transitive routing supported?
No. VPC Gateway Endpoints do not support transitive routing - this means, you cannot access them from across a VPN connection/Direct Connect/VPC Peering connection.
You can get around this using proxy routing - see Page 63.
Can VPC I/F Endpoint be accessed from Direct Connect?
Yes. IFEP can be accessed from DX and S2S-VPN. However, not over VPC Peering.
GW EPs, on the other hand, cannot be access from DX, VPN/VPC Peering conns.
What are the key differences between VPC Peering and Private Link Interface End Points?
VPC Peering - allows two way comms between VPC whereas PL/IEP allow only the consumer to initiate a request to the VPC.
PL/IEP more scalable than peering - can supports thousands of VPCs.
PL/IEP Network LB does Source NAT - hence, source IP is not available to the Service Provider.
How many secondary CIDRs can you add to a VPC?
Besides the primary, you can add up to 5 secondary CIDR ranges, if you run out of address space.
You can increase the limit beyond this by contacting AWS Support.
Can you create a VPN Connection between two VGWs?
No. Because neither VGW will initiate the connection.
Note: a VGW will never initiate a tunnel to a CGW. If the tunnel drops due to inactivity, then, an EC2 instance in a VPC wanting to send traffic to an on-prem server will not be able to do so. However, when the tunnels is up, EC2 can initiate traffic anytime.
Do AWS Private Link support UDP?
No. Only TCP traffic is supported.
Note: Interface Endpoints only support IPv4 traffic - which means that if an EC2 instance wants to access a
Does Direct Connect support static routing?
No. Direct connect only supports BGP. 802.1q VLAN tagging is also a requirements.
On Direct Connect, what defines a VIF?
A VIF is defined by the VLAN tag and BGP session.
Note: DX GW is a Layer 2 circuit. VIFs define layer 3 information. You can support multiple VIFs (L3) by separating information at L2 using VLANs.
What is the Routing Preference inside a VPC?
- Local Routes to the VPC preferred over overlapping propagated routes (even if propagated routes are more specific).
- Longest prefix match first
- VPC Static routes preferred over matching dynamic propagated routes
- Dynamic routes:
a) Prefer DX BGP routes i) Shortest Path ii) if equivalent, balance traffic flow (ECMP)
b) VPN static routes
c) BGP Routes from VPN (shortest AS Path).
Does DX Gateway work with Public VIFs?
No. DX GW is only about Private VIFs and Transit VIFs.
Do NLBs support static IPs?
Yes. NLBs can be referenced by static IPs in each AZ.
Contrast this with ALBs and CLBs - which should only be referenced by FQDNs since their IPs change when scaling.
When using ELBs, how is the client’s source IP address and port preserved?
For CLB, enable proxy protocol which injects this information into the request before sending it to the backend.
For ALB, nothing is needed, since ALB inserts the HTTP X-Forwarded-For headers.
Ensure that the CLB is not behind a proxy server already. Proxy server may already have added a request to the header. CLB may add another header causing duplication errors.
NLBs, provides client IP pass through to Amazon EC2 instances (if you use instance id when configuring a target). However, if you can only register targets by IP address, then enable proxy protocol v2 on the NLB.
How does the NLB select a target?
NLB uses a flow-hashing algorithm. Uses protocol, source IP/port, Dest IP/port, TCP sequence#.
Each individual TCP connection is routed to a single target for the life of the connection.
Can Root zone (domain) have a CNAME record?
No.
In DNS, you cannot create a CNAME record for a root zone. For example, you cannot have a CNAME record for “example.com”
What type of distributions does Cloudfront support?
Web Distribution (using HTTP/HTTPS) Media Streaming Distribution (using HTTP and RTMP).
How can you serve private content in Cloudfront?
a) Signed URL
b) Signed cookies
c) Origin Access Identity (OAI) - works with S3 bucket origins when used with bucket policies.
How does RTMP distribution work in Cloudfront?
a) Media player is served using HTTP (Basic Distribution)
b) Streaming media is served using RTMP (streaming distribution.
c) RTMP origins always have to be a S3 bucket.
What type of origin servers does Cloudfront support?
a) Amazon S3 buckets
b) Amazon S3 static websites
c) EC2 instances
d) Elastic Load Balancers
e) Custom Origin Servers (e.g. on-prem servers).
How does Cloudfront handle HLS, HDS, DASH etc.
Cloudfront will break video into smaller chunks that are cached in the cloudfront network for improved performance and scalability.
How can you use HTTPS and Cloudfront?
You can configure users to connect to cfrnt using HTTP.
Similarly, you can use HTTPS between edge and origin.
You can also apply field level encryption - by uploading public/private key pairs.
What two techniques does R53 use to provide 100% Availability?
a) Shuffle Sharding
b) Anycast Striping - multiple name servers share the same IP address; clients routed to nearest NS by BGP.
