Hybrid Environments & Migration Flashcards
What is BGP? What is BGP made up of?
Exterior GW Routing Protocol
Made up of self-managing systems called “Autonomous Systems” which are just a collection of routers owned by an SP which connect/share information with each other on how to traverse the internet .
What is an ASN?
Autonomous System; uniquely identifies entities/peers within a BGP network(s).
What is the AS Path?
Routing info exchanged between two BGP peers when a relationship is set up.
Only the BEST PATH to the destination is shared between peers.
What is the AS Path Prepending?
Mechanism how you influence paths to destinations IF the shortest path is actually not the best path.
Adds weight to a specified path to make it not as desirable.
What is an AWS Site to Site VPN?
The best/easiest way to link an AWS environment to something that’s not AWS; logical connection between a VPC and a private, non-AWS network.
What are some benefits of a S2S VPN?
- easy/fast to setup
- offers encryption in transit
- runs over public internet
- offers HA if designed accordingly
What are the 2 gateways that terminate a S2S VPN?
Customer side: CGW
AWS side: VGW
How many VGWs can a VPC be connected to?
ONE
A VPC can be attached to ONE Virtual Private GW (VGW), and ONE VGW can be attached to any VPC. The VGW sits in the public zone.
REVIEW:
Static VPN v Dynamic VPN aka BGP
Dynamic:
- Dynamic VPN uses BGP, so the CGW would have to support BGP for it to work
- Can communicate the state of links and failover between links between VGW and CGW
- You can still add static routes with “Route Propagation” enabled – you create a static route that is then propagated and be dynamically learned on the other route tables
Static:
- create static routes going to static networks
- uses IPSEC (no BGP)
- no failover or load-balancing
VPN Considerations
→ Speed maximum for AWS VPN is ~ 1.25GB; if you need more than this, you have to use something else (like direct connect)
○ All VPN connections connecting the to VGW is 1.25GB
→ Latency is inconsistent because it traverses the public internet; more hops = variability
→ Cost - hourly cost, GB of data going out of AWS cost
→ Very quick and easy to set up because VPN’s are all SW-defined
→ Dynamic VPNs require BGP support on the CE router (much less common)
→ VPNs can be used as a backup for Direct Connect (DX)
→ You can start with a VPN but then add/change to a DX later on
What is a DX?
Direct Connect
Similar to a SW/logical VPN, but it’s an actual physical connection into the AWS environment from on-premise/customer environment.
DX is a physical 1G or 10G port that a customer plugs into.
How is the DX and CE router connected?
a Single, SMF cable is cross connected from Port on DX to Port on CE router.
DX Considerations
→ Takes MUCH longer to provision than a SW VPN
○ DX port provisioning is quick, but the cross connect takes much longer because the customer is responsible for setting up/managing the rest of the way to their campus network, usually through a Telco provider
→ You can get a SW VPN up and running first as you work out/setting up the physical DX connection
○ You can then use the VPN as a backup
→ Much faster than a VPN - uses 1/10G ports and can be aggregated for up to 40GB of bwd
→ Provides consistent low latency because it’s not going over the public internet; does not consume your regular internet bwd/connections
→ CAVEAT: DX provides no built-in/native encryption like a VPN
*** any data going over a private VIF to a DX is then put into plain text because most applications will see the DX as private networking hidden from outside world
*** workaround:
○ Create a VPN
○ Instead of using the public internet as the transit network, use the public VIF running over DX instead
○ This allows you to use IPSEC VPN over the public VIF
○ Get’s you all the benefits of the DX but also the encryption of IPSEC
What is a VIF as it relates to DX?
Virtual Interface
These can run on top of the physical cross-connect link. Each VIF is a VLAN and a BGP connection between the CE router and the AWS DX router which data can pass over going in/out of AWS.
Is HA native to DX?
HA is only on the AWS side i.e a Region will have multiple connections going to a DX location(s) over high-speed backbone links.
There is no native HA on the cross-connect side for the customer i.e single SMF fiber link going to a CE router port.
→→→ DX is a PHYSICAL ARCH, which is not HA/resilient be default.. The only way to add HA is to add PHYSICAL connections/locations/HW
REVIEW:
How to implement HA in a DX scenario.
○ provisioning multiple DX routers, and cross-connects into multiple customer DX routers going over multiple connections to the on-premise network
○ Use a different cable route (physical route) for each connection going to the on-premise network, or multiple Telco providers running a line from the DX routers to the customer network
○ You can use 2 different DX locations with different customer DX routers AND run those into different customer premises locations
** ultimate HA ** – 2 x DX locations each with 2 x DX routers in each going into 2 x customer DX routers… then each is extended to dual CE routers @ the customer locations
What is an AWS Transit GW?
A network gateway/Hub which can be used to significantly simplify networking between VPC’s, VPNs, and Direct Connects.
→ A TGW is just a Transitive Routing point that connects to other TGW’s, VPC’s, and on-premise DC’s.
