![Page 1: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/1.jpg)
![Page 2: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/2.jpg)
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS NetworkingBuilding your network from 0 to millions of clients
3 2
Sébastien Stormacq
Developer Advocate
Amazon Web Services
![Page 3: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/3.jpg)
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Amazon Virtual Private Cloud
![Page 4: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/4.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Subnets
![Page 5: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/5.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
EC2 instances
Instance Instance
Instance Instance
![Page 6: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/6.jpg)
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Instance Instance
Instance Instance
Public subnet Public subnet
Private subnet Private subnet
Gateways, endpoints & peering
![Page 7: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/7.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Web server Web server
Application
server
Application
server
Example web application
Web server
security group
Application server
security group
ELB
![Page 8: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/8.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
IP addressing
![Page 9: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/9.jpg)
Private IP address range for your VPC – IPv4
• ”CIDR” range?• Classless inter-domain routing
• No more class A, B, C
• RFC1918• 192.168.0.0 /16
• 172.16.0.0 /12
• 10.0.0.0 /8
• How much?• /16
• /28
![Page 10: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/10.jpg)
Subnet Subnet
Subnet Subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Where to use IPv4 addresses?
172.31. 172.31.
172.31. 172.31.
![Page 11: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/11.jpg)
IPv6 basics
IPv6: Colon-separated hextet notation + CIDR
2001:0db8:0ec2:0000:0000:0000:0000:0001/64 0000:0000:0000:0000:0000:0000:0000:0001/128
2001:db8:ec2:0:0:0:0:1/64 0:0:0:0:0:0:0:1/128
2001:db8:ec2::1/64 ::1/128
Unicast addresses
Loopback address ::1
Link local address (LLA) fe80::/10 (fe80::/64 in practice)
Global unicast address (GUA) 2600:1f16:14d:6300::/64
Multicast addresses (ff00::/8)
All nodes ff02::1
All routers ff02::2
Solicited node ff02::1:ff00:0/104
![Page 12: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/12.jpg)
IPv6 on AWS
• /56 VPC
• /64 subnets
• Dual stack
• Link local address and global unicast address requiredIPv4 private address
IPv6 link local address (private)IPv6 global unicast address (public)
![Page 13: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/13.jpg)
Subnet Subnet
Subnet Subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Where to use IPv6 addresses?
2600:1f16:14d:6300::/56
172.31. 172.31.
172.31. 172.31.
2600:1f16:14d:6300::/64 2600:1f16:14d:6301::/64
2600:1f16:14d:6328::/64 2600:1f16:14d:6329::/64
![Page 14: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/14.jpg)
The “5 things” required for internet traffic
1. Public IP address
2. Internet gateway attached to a VPC
3. Route to an internet gateway
4. Network ACL Allow rule
5. Security group Allow rule
![Page 15: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/15.jpg)
Public IP addresses for your instances
• Auto-assign public IP addresses
• Elastic IP addresses
• Amazon Elastic IP address pool
• Bring Your Own IP (BYOIP) pool
![Page 16: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/16.jpg)
Subnet Subnet
Subnet Subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Public IP addresses
![Page 17: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/17.jpg)
Internet access
![Page 18: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/18.jpg)
Internet access
![Page 19: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/19.jpg)
Different routes for different subnets
Public subnet
Private subnet
![Page 20: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/20.jpg)
Public & private subnets
Public subnetPrivate subnet
![Page 21: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/21.jpg)
Network address translation (NAT) gateway
Public subnetPrivate subnet
![Page 22: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/22.jpg)
Network security
• Network ACLs
• Security groups
• VPC Flow Logs
• Amazon VPC Traffic Mirroring
![Page 23: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/23.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Web server Web server
Application
server
Application
server
Network ACLs
![Page 24: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/24.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Web server Web Server
Application
server
Application
server
Security groups: Inbound
Web server
security group
sg-0f004ca5495132527
Application server
security group
sg-090a960aee374b3cd
![Page 25: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/25.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Web server Web server
Application
server
Application
server
Security groups: Outbound
Web server
security group
sg-0f004ca5495132527
Application server
security group
sg-090a960aee374b3cd
![Page 26: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/26.jpg)
VPC Flow Logs
• Amazon CloudWatch Logs or Amazon S3
• Does not impact throughput or latency
• Apply to VPC, subnet, or elastic network interface
• Accepted, rejected, or all traffic
![Page 27: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/27.jpg)
Amazon VPC Traffic Mirroring
• Mirror to another elastic network interface or Network Load Balancer with UDP listener
• Packet copy; shares interface bandwidth
• Traffic mirror filters to define “interesting traffic”
• Traffic mirror session is the combination of source, target, and filter
Filter 1
![Page 28: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/28.jpg)
Connecting between VPCs
VPC
VPC
VPC
AWS Cloud
![Page 29: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/29.jpg)
VPC
VPC
VPC
AWS Cloud
VPC peering: Same Region
![Page 30: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/30.jpg)
VPC
VPC
VPC
Peering
AWS Cloud
VPC peering: Same Region
![Page 31: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/31.jpg)
VPC
VPC
Peering
AWS Cloud
VPC peering: Same Region
![Page 32: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/32.jpg)
Peering
VPC
VPC
VPCPeering
Peering
AWS Cloud
VPC peering: Same Region
![Page 33: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/33.jpg)
Peering
VPC
VPC
VPCPeering
Peering
AWS Cloud
VPC peering: Same Region
![Page 34: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/34.jpg)
Peering
VPC
VPC
VPCPeering
Peering
AWS Cloud
VPC peering: Same Region
![Page 35: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/35.jpg)
VPC peering: Same Region
VPC
VPC
VPCPeering
Peering
AWS Cloud
![Page 36: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/36.jpg)
VPC peering: Same Region
VPC
VPC
VPCPeering
Peering
AWS Cloud
![Page 37: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/37.jpg)
VPC peering: Different Region
![Page 38: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/38.jpg)
VPC peering: Different account
![Page 39: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/39.jpg)
VPC peering: Things to know
Can reference security groups from the peer VPC in the same Region
Can enable DNS hostname resolution to return private IP addresses
Can peer for both IPv4 & IPv6 addresses
Cannot have overlapping IP addresses
Cannot have multiple peers between the same pair of VPCs
Cannot use jumbo frames across inter-Region VPC peering
![Page 40: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/40.jpg)
Interconnecting VPCs at scale: VPC peering
Peering
VPC
VPC
VPCPeering
Peering
AWS Cloud
![Page 41: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/41.jpg)
Interconnecting VPCs at scale: VPC peering
Peering
VPC
VPC
VPCPeering
Peering
VPC VPC
Peering
VPC
Peering
Peering
Peering Peering
AWS Cloud
![Page 42: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/42.jpg)
Multiple VPCs access model: AWS Transit Gateway
VPC
VPC
VPC
VPC VPC
VPC
AWS Transit Gateway
AWS Cloud
![Page 43: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/43.jpg)
VPC
AWS Transit Gateway with AWS site-to-site VPN
VPC
VPC
VPC
AWS Transit Gateway
VPN attachment
VPC route table
172.16.0.0/16 via TGW
TGW route table
172.16.0.0/16 via VPN
Corporate data center
172.16.0.0/16
![Page 44: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/44.jpg)
AWS Transit Gateway with AWS Direct Connect gateway
Corporate data center
172.16.0.0/16
Customer
router
DX location
AWS
router
AWS Global Network
Customer
router
VPC
10.0.0.0/16 Transit virtual
interface
VPC
10.1.0.0/16
VPC
10.2.0.0/16
Region
Region
AWS
Transit
Gateway
AWS
Transit
Gateway
DX
gateway
![Page 45: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/45.jpg)
Web server
High availability & scale
![Page 46: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/46.jpg)
Web serverElastic Load Balancing
Web server
Web server
Elastic Load Balancing
Elastic Load Balancing (ELB) distributes incoming application or network
traffic across multiple targets, such as Amazon EC2 instances, containers,
Lambda functions, and IP addresses, in multiple Availability Zones
![Page 47: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/47.jpg)
Elastic Load Balancing: Options
Application Load Balancer Classic Load BalancerNetwork Load Balancer
![Page 48: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/48.jpg)
Web serverElastic Load Balancing
IP target
Web server
Application Load Balancer: Components
Health check
Health check
Listener
Target
Target group
Default
Forward /img/*
Listener rule
![Page 49: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/49.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Web server Web server
Application
server
Application
server
Example web application
Web server
security group
Application server
security group
ELB
![Page 50: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/50.jpg)
Public subnet Public subnet
Private subnet Private subnet
VPC
Availability Zone
US-EAST-1A
Availability Zone
US-EAST-1B
Web server Web server
Application
server
Application
server
Example web application – Final
Web server
security group
App server
security group
ELB
Private subnet Private subnet
![Page 51: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/51.jpg)
APN Cloud Management Tools Competency Partners
Visit the Partner Discovery Zone to meet the partner and view the full list of APN Competency Partners
![Page 52: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/52.jpg)
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
![Page 53: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/53.jpg)
Amazon CloudFront
CloudFront is the AWS content delivery network
It securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds
CloudFront is integrated with AWS; physical locations are directly connected to the AWS Global Cloud Infrastructure and other AWS services
It features a global network of >200 points of presence (PoPs)
![Page 54: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/54.jpg)
What benefits does CloudFront deliver?
• Built-in security & DDoS protection
• Massive scale
• Performance-based request routing
• Connection optimization
• Dedicated, private AWS backbone
• Multi-tiered caching architecture for origin
protection and offload
• Lower data transfer costs than regional endpoints
![Page 55: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/55.jpg)
Amazon CloudFront: >200 PoPs
China
Launched in China with
4 new cities:
Beijing, Shanghai,
Zhongwei, Shenzhen
EMEA
4 new countries:
Bahrain, Belgium,
Portugal, Israel
13 embeds in UK
South America
Added 3 new countries:
Argentina, Chile, and
Colombia
56% price cut
North America
Added 50% more PoPs in last year
Launched in 2 new cities: Houston and Salt Lake City
India / Australia
16 PoPs in India
Added 3 PoPs in
Sydney; currently 6
PoPs in Australia
210 PoPs in 79 cities, 37 countries
75+ PoPs added in 2019
Japan
Added 6 PoPs in Tokyo
Currently 17 PoPs in
Japan
![Page 56: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/56.jpg)
Latency benefits with PoP launches
Argentina55% Latency reduction
79 ms 35 ms
Chile73% Latency reduction
104 ms 28 ms
PoP launches ensure connectivity with majority views and redundant AWS backbone
Bahrain: 40% Latency reduction
38 ms 27 ms
![Page 57: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/57.jpg)
Distributions
• Unique CloudFront.net domain name to reference objects (abc123.cloudfront.net)
• Custom domains
• Custom TLS configuration
• Enable H2, IPV6 & logging to Amazon S3
• Associate to AWS WAF ACL
Origins
• Any HTTP(S) endpoint
• TCP ports & timeouts
• TLS configuration
Building blocks of a CloudFront configuration
Behaviors
• Path condition
• Select origin
• HTTP methods
• Caching and forwarding policy
• Enable object compression
• Configure features (Lambda@Edge triggers, field-level encryption, signed URLs)
![Page 58: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/58.jpg)
Advanced security capabilities
Advanced ciphers
Certificate manager
OCSP stapling
Session tickets
Perfect forward secrecy
Protocol enforcement
Half or full bridge connections
TLSv1.0, 1.1, 1.2
Field-level encryption
Encrypted connections
Custom origin protection
Header and ACL
Content protection
Signed URL / Cookies
Content restriction
geo blocking
Amazon S3 origin access identity
Access control
• AWS Identity and Access Management (IAM)
![Page 59: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/59.jpg)
API acceleration with CloudFront
• TLS termination at edge
• Network optimizations: persistent connections, connection pooling, keep-alive
• AWS private backbone
• Edge DDoS protection
“The performance gains are amazing, positively impacting our app’s usage
across the globe, especially in Regions further from US EAST 1.”
Sample data from a customer test
![Page 60: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/60.jpg)
Lambda@Edge
• Improve viewer performance
• Reduce origin load / simplify origin architecture
Continuous
scaling No servers
to manage
Globally
distributed
Never pay for idle –
no cold servers
Lambda@Edge is an extension of AWS Lambda that enables you to run Node.js functions at
AWS global edge locations in response to CloudFront events
![Page 61: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/61.jpg)
CloudFront and Lambda@Edge
CloudFront
cache
Origin
response
OriginViewers
Origin
request
Viewer
response
Viewer
request
![Page 62: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/62.jpg)
Lambda@Edge use cases
Pretty URLs
Origin failover
URL rewriting
Security headers
Token authentication
Sign requests to origin
Resize images
Render pages
A/B testing
Cache header manipulation
3xx follow redirection
Query string / UA normalization
PerformanceDynamic content
generation
Origin independence
Security
![Page 63: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/63.jpg)
Financial Services
Ecommerce, Social
Media, Digital
Advertising, EdTech
Media &
EntertainmentGaming
![Page 64: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/64.jpg)
Learn networking with AWS Training and Certification
Free digital courses cover topics related to networking and content delivery, including Introduction to Amazon CloudFront and AWS Transit Gateway Networking and Scaling
Resources created by the experts at AWS to help you build and validate cloud networking skills
Validate expertise with the AWS Certified Advanced Networking –Specialty exam
Visit the advanced networking learning path at aws.amazon.com/training/path-advanced-networking
![Page 65: AWS Networking - Sipart Networking Building your... · 2020. 11. 2. · Amazon VPC Traffic Mirroring ... AWS Transit Gateway with AWS site-to-site VPN VPC VPC VPC AWS Transit Gateway](https://reader033.vdocuments.us/reader033/viewer/2022060916/60a92dae7028ad28986e68a5/html5/thumbnails/65.jpg)
Thank you!
© 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sebastien Stormacq
@sebsto