Networking and Hybrid Flashcards by Rob Zelada

What services does DCHP provide to a client?

IP address, subnet mask, default gateway. Also DNS servers. Netbios name server, NTP

How well did you know this?

Not at all

Perfectly

At what network layer does DHCP start its communicaiton?

Layer 2

How well did you know this?

Not at all

Perfectly

Are DHCP option sets changeble once implemented?

No, immutable

How well did you know this?

Not at all

Perfectly

How many VPCs can DHCP option sets be associated with?

0 to many

How well did you know this?

Not at all

Perfectly

How many DHCP option sets can VPC have?

0 or 1

How well did you know this?

Not at all

Perfectly

Are changes to DHCP option sets immediate?

Yes, but client DHCP renew takes time

How well did you know this?

Not at all

Perfectly

Can you provide your own EC2 domain names using DHCP option sets?

Yes, you have to configure your own custom domains and DNS servers and add config to the option set

How well did you know this?

Not at all

Perfectly

What is the default gateway for an AWS DHCP option set?

VPC router (subnet +1)

How well did you know this?

Not at all

Perfectly

What is the default DNS server in an AWS DHCP option set?

R53 resolver (VPC +2)

How well did you know this?

Not at all

Perfectly

Is the VPC router HA?

Yes, it is highly available across the region when you provision a VPC

How well did you know this?

Not at all

Perfectly

How does the VPC router participate in each subnet?

It has an interface in each subnet, which is the subnet +1 address and is the default gateway in a DHCP option set.

How well did you know this?

Not at all

Perfectly

How do you configure the behavior of the VPC router?

By using route tables

How well did you know this?

Not at all

Perfectly

At what level of the VPC do route tables work?

Trick quesiton: They are defined at the VPC level, but associated to a subnet

How well did you know this?

Not at all

Perfectly

Can a subnet be associated to more than one route table at a time?

How well did you know this?

Not at all

Perfectly

Explain how the default route table works

Created at the time of the VPC, associated with all subnets

How well did you know this?

Not at all

Perfectly

If a route table has two paths to a destination, how does it select the route it will use?

Selects the most specific path first.

How well did you know this?

Not at all

Perfectly

Name on other time route tables can be associated with

Gateways

How well did you know this?

Not at all

Perfectly

What does target = local mean on a route table

in the current VPC

How well did you know this?

Not at all

Perfectly

What is always in the route table and uneditable?

The local route

How well did you know this?

Not at all

Perfectly

What is the primary concern with using stateless firewalls?

You have to account for both incoming and outgoing connections of a communication chain. Often means you have to allow all outbound to ephemeral ports.

How well did you know this?

Not at all

Perfectly

Where do NACLs fit in the VPC hierarchy?

They operate at the subnet boundary…things coming into the subnet and things going out

How well did you know this?

Not at all

Perfectly

What two sets of rules do NACLs have?

Inbound
Outbound

How well did you know this?

Not at all

Perfectly

NACLs allow both of what

Explicit Allows
Explicit Denies (different that SGs)

How well did you know this?

Not at all

Perfectly

Explain NACL rule evaluation

First it selects direction
Then it starts with the lowest rule number
Stops at first match

How well did you know this?

Not at all

Perfectly

What is the catch all rule in NACLs?

a \* that catches everything and Denies

NACL screen shot

Default NACL

Rule 100 that allows all Catch all that Denies if that first rule didn't exist.

At what level are NACLs defined?

At the VPC level, but are associated with different subnets. A subnet can have one NACL assoicated at a time. A NACL can be assigned to many subnest in the VPC.

Can you use AWS logical resources in NACLs?

No, only IPs, IP ranges, and ports.

What can you not do with SGs

You cannot explicitly deny traffic with SGs

What can you do with SGs that you can't do with NACls?

You can apply them to enis You can use IP/cidr ranges...and AWS logical resources...and reference other SGs...and reference yourself!

What is automatically allowed with SGs?

response traffic

Name a benefit of security groups

Self reference, basically allows all communication between everything with this SG.

Parent region

The region that a local zone is tied to and relies upon for management and operational support

us-west-2-las-1

Parent region: us-west-2 Local zone: las-1

Can you have more than one local zone in an area?

Yes

Do local zones have built in resilience like and AZ?

In local zones, some services utilize services in the parent region

EBS snapshots a good example here. Snapshots sent to S3 in the parent region to achieve redundancy and HA

Numbers 0-65535 allocated by IANA

ASNs Autonomous System Numbers

64512-65535

Private ASNs

BGP operates over this

TCP 179

BGP exchanges network topology with its peers and is focused on determining the best path to a destination (least hops, not fastest), which is also know as this

ASPATH

How many routes does a BGP route advertise to the other BGP routers it is peered with?

One, the shortest path

What if a BGP path is slow and an admin want's to force a different path?

AS Path Prepending can be used…make the ASPATH artificially longer

What type of address allows a single IP to be “assumable” by many devices in different locations, with the result of the traffic going to the device closest to the request?

Anycast IP

What type of addressing does Global Accelerator use to route traffic to the nearest edge location, and then over the AWS transit network?

Anycast IP

Key difference between AWS Global Accelerator and CloudFront

AWS Global Accelerator is any network traffic (TCP/UDP), CloudFront HTTP/HTTPS and caching etc. Global accelerator trying to get you to the closest service endpoint on the fastest route possible.

Which phase of an IPSEC VPN tunnel is associated with key exchange and considered slow and heavy?

IKE Phase 1

Which phase of an IPSEC VPN tunnel is associated with encryption algorithm negotiation, bulk key agreement, and runs over IKE Phase 1?

IKE Phase 2

Which IKE phase is considered permanent, and one that is fired up for “interesting traffic”?

IKE Phase 1 permanent IKE Phase 2 interesting

What type of VPN is an AWS Site-to-Site VPN?

IPSEC

What are the three components of a site to site VPN?

Virtual Private Gateway (VGW) Customer Gateway (CGW) VPN Connection between the two

Three key components of the Virtual Private Gateway (VGW)

Logical gateway that you can attach to the VPC It can be the target of routes Lives in the AWS Public Zone

Customer Gateway (CGW)

Must contain all of the data about the physical router on the customer site, but is a logical representation of that device in AWS.

Is a Virtual Private Gateway (VGW) highly available?

Yes, it has at least two public IPV4 endpoints in different AZs in the AWS public zone.

When you configure a VPN to communicate between the VGW and a CGW, how many tunnels are established?

Two, one from each public endpoint of the VGW.

What is a static VPN?

Routes to the on-premises traffic are configured to route through the VGW on the AWS side, and routes to AWS are configured to route through the CGW on the on prem side.

To acheive HA with a site to side VPN, do you need two VGWs?

No, but you do need two CGWs, preferably one in a different building on the customer site. From the VGW, it can understand the second CGW and create new VPNs using new public enpoints.

What key technology is in use for Dynamic VPNs?

BGP

Can you use static routing over Dynamic VPNs?

Yes, you can, but you can also enable route propagation on your VGW and the BGP routers will advertise their routing information to each other.

AWS enforced limit on site to site VPNs

1.25 Gbps

If latency is an issue for your application, should you choose VPN?

Not if you have faster, better performing, more reliable options

AWS VPN Cost

Hourly, GB out

If speed of setup is your key factor, what private connection technology should you choose

Site to Site VPN

What are the 3 valid attachment types for Transit Gateways?

VPC Site-to-Site VPN Direct Connect Gateway

Transit Gateway has these two properties out of the box

HA Scalable

Does VPC peering support transitive routing?

No, if you peer A and B and B and C, you still need to peer A and C…and set up routes.

Can you terminate a site-to-site VPN on a Transit Gateway, or do you have to terminate it on a Virtual Private Gateway in a VPC?

Can terminate at TG

Is transit gateway routing transitive?

Yes, one you peer a VPC to a TG, it can transitively route traffic

Does TG have any limitations for regions and accounts?

No, you can peer/share across regions and accounts.

What tech would one use to share a TG across accounts?

RAM - Resource Access Manager

By default, how many route tables does a Transit Gateway have ?

Three properties of the TG default route

All attachments use this route table All attachments dynamically add to it All attachments can route to all attachments

Do peered transit gateways propgate route information?

No. You need to use static routes to

Just like VPC peering traffic, traffic is this in transit between TG to TG peers

Encrypted

How many route tables can a TG attachment be associated with?

How many attachments can TG route tables be associated with?

Many

Steps to isolate routing with TG

# Define route tables on the TG Propogate routes to route tables that you want to enable communication, exclude propgating CIDR ranges that you don't want to route to Attach route table to appropriate TG attachments

What direction of traffic does a route table apply to?

Stuff coming out of an attachment, VPC, etc