Module 8: Connecting networks

Question 1

AS an organization grows, so does the network of the company. As more and more VPC are added they need to be connected with each other so that they can interact with each other.
In that context what is called a full mesh?

Answer 1

A full mesh is a network in which each of the VPC are connected to each of the others VPC. The numbers of connection to set up and managed grows up exponentially, creating a greater workload and maintenance on the operations.

Question 2

What is the alternative to a full mesh to connect the VPCs ?

Answer 2

Create a central hub to manage connectivity. Each VPC connects only to the hub

Question 3

What AWS service can serve as a hub

Answer 3

AWS transit gateway

Question 4

Key features of AWS Transit Gateway

Answer 4

1.Scales automatically
2.Can be peered with other transit gateways
3.chargee by number of connections and amount of traffic
4.has a flow log feature

Question 5

How to connect to a transit gateway ?

Answer 5

Every AZ in a VPC must have a network interface to connect to the transit gatway. It means one dedicated subnet for each AZ must be created.
Adjust the route tables to connect to the transit gateway through the 10.0.0.0/8 IP range.
Add the connection on the Route table of the transit gateway to individual VPC

Question 6

For added security you can organize your network so that only one Egress VPC points to the internet while all other will point to the transit gateway. It is calle a centralized outbound routing. What does the Egress VPC contains ?

Answer 6

A subnet with a network interface to receive the traffic from the transit gateway and another subnet with a NAT Gateway to direct oubound traffic to it
Finally a pointer between the NAT gateway and an internet Gateway.

Question 7

Advantage of centralized outbound routing.

Answer 7

Cost efficient because only one NAT gateway, and added security.
For redundancy consider running a NAT Gateway for each of the AZ in the egress VPC.

Question 8

Can the principle of a centralized outbound routing be applied to other services?

Answer 8

Yes. and it has a lot of advantages for simlifying the managemnt of the ressources as well as a better access control

Question 9

What is the module used to link two transit gateways together called ?

Answer 9

A transit gateway peering attachement

Question 10

Why should I still consider a mesh architecture when I could you a transit gateway?

Answer 10

If the number of VPC is small and if budget is limited. Indeed VPC peering is free.
Also because it’s point to point it keeps a low latency

Question 11

Can you apply a mesh that connects to other region or accounts ?

Answer 11

Yes. But data between region incur cost equal to the standard data transfer rates.

Question 12

If VPC A connect to VPC B and VPC B connects to VPC C, with no direct connection from A to C, can A and C communicate ?

Answer 12

No because transitive peering is not supported.
It can be useful to isolate errors and protect the network.

Question 13

What if CIDR blocks overlaps between two VPC ?

Answer 13

Use a privatelink with a network load balancer to establish connectivity

Question 14

How do yo connect your on permises corporate cnironment to a VPC ?

Answer 14

By using an AWS site-to-site VPN. It creates VPN tunnels between the two locations.
It connects to the customer gateway

Question 15

What is a VPN Vloud hub used for?

Answer 15

It is to centralize VPN connections to many on permises networks

Question 16

What service can you use to accelerate your VPN connections

Answer 16

AWS Global Accelerator (relying on edge locations)

Question 17

What if you want your on permise to access all VPC but you don’t want your VPCs to communicate with each other?

Answer 17

Use a transit gateway with several route tables.

Question 18

What is AWS Direct Connect?

Answer 18

It ‘s a dedicated private VLAN. It increases bandwidth throughput and provides a more consistent network experience than internet based connection

Question 19

Why use direct connect

Answer 19

Hybrid environments, large datasets, predictable network performance, secrutiy and compliance requirments.

Question 20

Direct connect for high resiliency?

Answer 20

implement connection at multiple locations

Question 21

Direct connect for high availability?

Answer 21

Couple a direct connect with another classic VPN connection using a different VPN provider to limit single point of failure.

Question 22

Best practices for RELIABLE network?

Answer 22

Provision redundant connectivity with your VPN
Prefer hub and spoke to mesh

Question 23

Best practices for a SECURE network

Answer 23

Control traffic at all layer (site to site VPN or Direct connect)
Authenticate network connections
Enfore encryption in transit

Question 24

Best Practices for a PERFORMANT network

Answer 24

Choose a right size dedicated connectivity or VPN
Choose the workload location based on requirements

Question 25

Best Practices for a Cost Optimized Network

Answer 25

Select component to optimize data transfer costs
Implement services to reduce data transfer costs