↓Skip to main content
Hugo’s IT journal Hugo's IT journal

AWS Certified Advanced Networking - Specialty

·
cert exam aws networking
Table of Contents
Resources>

Resources #

TODO>

TODO #

  • take notes
  • revision
  • whizlabs
  • mocks (by topic)
  • mock 1 (udemy)
  • mock 2,3,4 (whizlabs)
  • examtopic
  • udemy quiz + exercise
Revision>

Revision #

The numbers below are the page no of the udemy course’s pdf: AWS Certified Networking Specialty Slides v1.1.

Summary>

Summary #

  • DNS (151)
  • Advanced Networking (188)
  • VPC Endpoint (292, 298)
  • Site-to-site VPN (347, 401, 407)
  • VPN Tunnels and Routing (348, 352)
  • DX Gateway with VGW (532)
  • DX with TGW (547)
  • DX Billing (624)
  • DX (630)
  • Troubleshooting in DX (626)
  • Gateway Load Balancer (816)
Q & A>

Q & A #

  • ALB (677)
  • DX (625)
Good to know>

Good to know #

  • SG (46)
  • BYOIP (90)
  • VPC Traffic Mirroring (105)
  • DHCP Option Sets (124)
  • TGW (251)
  • AWS Site-to-Site VPN (403)
  • Network Load Balancer (656)
Comparisons>

Comparisons #

  • private, public and EIP (33)
  • IPv4, IPv6 (36)
  • NACL, SG (48)
  • NAT Gateway, Instance (64)
  • VPC Peering vs Transit Gateway
  • Cloudfront function vs lambda@edge (703)
  • AWS global accelerator vs Cloudfront (711)
Exam Essential>

Exam Essential #

  • VPC Fundamentals (67)
  • Advanced VPC (190)
  • VPC Peering Endpoint (301)
  • AWs Site-to-Site VPN (402)
  • Direct Connect (632)
  • Firewall (806)
  • Gateway Load Balancer (817)
Revision by topic>

Revision by topic #

Playlists>

Playlists #

References>

References #

VPC Fundamentals (17)>

VPC Fundamentals (17) #

What is TCP/IP?>
What is TCP/IP? #
Answer

  • application (data)
  • transport (segment)
  • network (packet)
  • link (frame)
  • physical (frame)

    • What is OSI? (306)>
    What is OSI? (306) #
    Answer

  • application
  • presentation
  • session
  • transport
  • network
  • link
  • physical

    • ##### How to calculate the no of address in a CIDR (like 192.168.0.1/28)? (18)
    Answer

    2^(32-28)=16

    Can we override the main route table in VPC? (26)>
    Can we override the main route table in VPC? (26) #
    Answer

    override it at subnet level

    Which IPs are reserved for a vpc? (29)>
    Which IPs are reserved for a vpc? (29) #
    Answer

    5

  • 0=network
  • 1=router
  • 2=dns
  • 3=reserved
  • last=broadcast

    • What is the default behaviour of SG (inbound and outbound)? (46)>
    What is the default behaviour of SG (inbound and outbound)? (46) #
    Answer

  • inbound: block all
  • outbound: allow all

    • How is the NAT gateway charged? (59)>
    How is the NAT gateway charged? (59) #
    Answer

  • hourly charge
  • data transfer fee

    • Can we apply SG on a NAT gateway? (59)>
    Can we apply SG on a NAT gateway? (59) #
    Answer

    no

    What is the port range NAT gateway needs for outbound connection? (59)>
    What is the port range NAT gateway needs for outbound connection? (59) #
    Answer

    1024-65535

    Why don’t we need cross-AZ failover in NAT ? (62)>
    Why don’t we need cross-AZ failover in NAT ? (62) #
    Answer

    because if az down, nat and app are down too

    What is the most important setting to setup NAT with EC2? (63)>
    What is the most important setting to setup NAT with EC2? (63) #
    Answer

    disable the source and destination check

    Advanced VPC (72)>

    Advanced VPC (72) #

    What is the limitation of adding a secondary CIDR? (79)>
    What is the limitation of adding a secondary CIDR? (79) #
    Answer

  • aws defines cidr in 3 classes. 172 169 10192.168 172.16 10.0
  • if the primary cidr is in one of the classes, the secondary cidr must be in the same class or not in any class with an equal / more specific prefix
  • if the primary cidr is not in one of the class, the secondary cidr must not in any class with equal / more specific prefix
  • 5ipv4 1ipv6

    • How many private, public and elastic ip and sg can one ENI have? (81, 85)>
    How many private, public and elastic ip and sg can one ENI have? (81, 85) #
    Answer

  • private - depends on the instance type
  • public - 1
  • elastic - 11 eip per private ip

    • What is the use case of dual home setup with multiple ENIs? (84)>
    What is the use case of dual home setup with multiple ENIs? (84) #
    Answer

  • 1 eni for internal traffic
  • 1 eni for internet traffic

    • What are the prerequisites of BYOIP? (89, 90)>
    What are the prerequisites of BYOIP? (89, 90) #
    Answer

  • you should own that ip
  • ip should have a good record
  • each account can bring 5 ips (ipv4 & ipv6)
  • ROA
  • ipv4: /24; ipv6: /48 pub; /56 pri

    • What type of Flow Logs can we capture from a VPC? (92)>
    What type of Flow Logs can we capture from a VPC? (92) #
    Answer

  • vpc
  • subnet
  • eni

    • Where does the Flow Logs Action field come from? (97)>
    Where does the Flow Logs Action field come from? (97) #
    Answer

    security group / nacl

    What type of record cannot be captured in a flow log? (98)>
    What type of record cannot be captured in a flow log? (98) #
    Answer

  • traffic from aws dns / metadata
  • dhcp, windows licence activation server

    • What can be the source & target of a VPC Traffic Mirror? (102, 105)>
    What can be the source & target of a VPC Traffic Mirror? (102, 105) #
    Answer

  • source: eni
  • target: eni, nlb

    • What port does the VPC Traffic Mirror require? (105)>
    What port does the VPC Traffic Mirror require? (105) #
    Answer

    udp 4789

    How to set a custom domain / dns on an EC2 instance? (113)>
    How to set a custom domain / dns on an EC2 instance? (113) #
    Answer

    change the dhcp-option

    VPC DNS and DHCP>

    VPC DNS and DHCP #

    What does enableDNSSupport do? (117)>
    What does enableDNSSupport do? (117) #
    Answer

    resolve the dns

    What does enableDNSHostname do? (117)>
    What does enableDNSHostname do? (117) #
    Answer

    assign hostname to the ec2 instance

    How to resolve the hostname in VPC peering and TGW? (132)>
    How to resolve the hostname in VPC peering and TGW? (132) #
    Answer

    enable dns support

    How to resolve the hostname in Hybrid cloud (AWS to on-premise, on-premise to AWS) (old & new way)? (132-150)>
    How to resolve the hostname in Hybrid cloud (AWS to on-premise, on-premise to AWS) (old & new way)? (132-150) #
    Answer

    old:

  • aws -> on-premise: setup ad / dns server on aws; set dhcp to that server; forward query to that server in on-premise dns
  • on-premise -> aws: setup ad / dns server on aws; use that server in on-premise

    • new:

  • aws -> on-premise: setup outbound endpoint to on-premise dns, set forward rule to that endpoint
  • on-premise -> aws: setup inbound endpoint, forward query to that endpoint in on-premise dns

    • VPC Network Performance and Optimization>

    VPC Network Performance and Optimization #

    Formula of throughput (154)>
    Formula of throughput (154) #
    What is Jumbo frame? (154)>
    What is Jumbo frame? (154) #
    Answer

    MTU > 1500 (9001 / 8500)

    What is Path MTU Discovery? (155)>
    What is Path MTU Discovery? (155) #
    Answer

    check the max MTU support between 2 routes

    What are the advantages of using placement group - cluster (162)>
    What are the advantages of using placement group - cluster (162) #
    Answer

    low latency higher bandwidth

    What is the bandwidth limitation between VPC, EC2 instances, VPN and DX (179-183)?>
    What is the bandwidth limitation between VPC, EC2 instances, VPN and DX (179-183)? #
    Answer

  • vpc = 100%
  • to igw / other region = 50%
  • ec2 = 5gbps 10gbps (placement group) single flow
  • vpn (tgw) 1.25gbps per tunnel and sum up to 25gbps
  • vpn (vgw) 1.25gbps
  • dx (vgw/tgw) = 1/10/100gbps

    • VPC Peering>

    VPC Peering #

    What is the limitation of VPC Peering? (207)>
    What is the limitation of VPC Peering? (207) #
    Answer

    non-transitive cannot access igw, nat, vpn, peer, gateway endpoint

    TGW>

    TGW #

    What is the difference between vgw and tgw? (211)>
    What is the difference between vgw and tgw? (211) #
    Answer

    vgw is non-transitive cannot access igw, nat, vpn, peer, gateway endpoint

    what attachments does TGW support? (211)>
    what attachments does TGW support? (211) #
    Answer

    vpn vpc tgw dxgw

    What is the special route in TGW? (230)>
    What is the special route in TGW? (230) #
    Answer

    custom route table for each tgw attachment

    VPC Endpoint>

    VPC Endpoint #

    How many types of VPC endpoint? What is the difference between them? (258)>
    How many types of VPC endpoint? What is the difference between them? (258) #
    Answer

  • interface = has eni attached
  • gateway = use route table
  • private link = attach to alb or nlb
  • all has vpc endpoint policy

    • Can on-premises network access to the gateway endpoint with VPN/DX? (273)>
    Can on-premises network access to the gateway endpoint with VPN/DX? (273) #
    Answer

    no

    What kind of source can be used in a private link? (281) #
    Answer

    nlb and alb

    How to use hostname in interface endpoint? (288)>
    How to use hostname in interface endpoint? (288) #
    Answer

    enable private dns

    How to use the interface endpoint without private DNS? (290)>
    How to use the interface endpoint without private DNS? (290) #
    Answer

    use the dns name with "region"

    When should we use a private link? When should we use VPC Peering (297) #
    Answer

  • Many clients need to access the service from different accounts (>125)
  • use peering when there are many services that need to be accessed

    • AWS Site-to-Site VPN>

    AWS Site-to-Site VPN #

    What port does IPsec need? (309)>
    What port does IPsec need? (309) #
    Answer

    udp/500

    Range of public and private ASN (313)>
    Range of public and private ASN (313) #
    Answer

  • 0-65525
  • 64512-65534

    • 4 common BGP Param for routing (319)>
    4 common BGP Param for routing (319) #
    Answer

  • weight as_path med
  • local-preference

    • What type of VPN does AWS support Site-to-Site VPN? (327)>
    What type of VPN does AWS support Site-to-Site VPN? (327) #
    Answer

    ipsec

    What routing method does AWS support in Site-to-Site VPN? (329)>
    What routing method does AWS support in Site-to-Site VPN? (329) #
    Answer

    bgp / static

    What port is required in VPN for NAT-T? (335)>
    What port is required in VPN for NAT-T? (335) #
    Answer

    udp/4500

    VPN Tunnels and Routing>

    VPN Tunnels and Routing #

    How to set Active/Active tunnel (351)>
    How to set Active/Active tunnel (351) #
    Answer

  • advertise the same prefix. use BGP and ECMP for load balancing <- this will cause the traffic to go randomly
  • advertise diff prefix. more specific prefixes will be prefered
  • or use AS_PATH or MED to control the traffic from aws

    • What is DPD? Port to send messages? default timeout? timeout action? (354)>
    What is DPD? Port to send messages? default timeout? timeout action? (354) #
    Answer

    dead peer detection. detect the dead peer tunnel. 30s. action: clear, restart, none

    How to prevent a tunnel from terminating due to inactivity (355)>
    How to prevent a tunnel from terminating due to inactivity (355) #
    Answer

    ping the aws network each 5 seconds to prevent idle tunnel

    How to monitor the tunnel status? (357)>
    How to monitor the tunnel status? (357) #
    Answer

    set alarm with cloudwatch metrics

    DX>

    DX #

    What is the fibre mode of DX? (450)>
    What is the fibre mode of DX? (450) #
    Answer

    single

    what is the data link requirement of DX (450) #
    Answer

    fibre 802.1vlan LX

    What are the requirements for a customer router? (450)>
    What are the requirements for a customer router? (450) #
    Answer

    bgp

    What is the port of BGP? (457)>
    What is the port of BGP? (457) #
    Answer

    179/tcp

    What is BFD? How to enable it? (458)>
    What is BFD? How to enable it? (458) #
    Answer

    auto failover dx is enabled by default. enable it on the customer router lower the failure detection time

    How long does it take for failover with and without BFD? (458, 597, 598)>
    How long does it take for failover with and without BFD? (458, 597, 598) #
    Answer

    300ms * 3times = 1s default 30s * 3 = 90s; DPD = method to detect the failure (for ipsec+bgp). BFD = method to lower the failure detection (for bgp)

    How can a user whitelist the ips range from AWS? (459)>
    How can a user whitelist the ips range from AWS? (459) #
    Answer

    whitelist the ip in ip-range.json

    How many VIF can a hosted connection have? (465)>
    How many VIF can a hosted connection have? (465) #
    Answer

    1

    What Ip type does DX support? (498)>
    What Ip type does DX support? (498) #
    Answer

    ipv4 and ipv6

    How many route prefixes can the public vif advertise? (503)>
    How many route prefixes can the public vif advertise? (503) #
    Answer

    1000

    How many route prefixes can a private vif advertise? (507)>
    How many route prefixes can a private vif advertise? (507) #
    Answer

    100

    What is the limitation of vif and vgw location? (507)>
    What is the limitation of vif and vgw location? (507) #
    Answer

    in the same region

    What service cannot access inside a VPC with DX? (510)>
    What service cannot access inside a VPC with DX? (510) #
    Answer

    nat, nat + igw, peered vpc, gateway endpoint ,dns

    What is the usage of DX gateway? (517)>
    What is the usage of DX gateway? (517) #
    Answer

    connect dx and vpc in any regions (pri/transit vif)

    How many vif can a DX connection have? (526)>
    How many vif can a DX connection have? (526) #
    Answer

    50(pub + pri)

    How many transit vif can a DX connection have? (547)>
    How many transit vif can a DX connection have? (547) #
    Answer

    1(transit)

    How many DX gateways can a vif have? (530)>
    How many DX gateways can a vif have? (530) #
    Answer

    1

    How many vif can a DX gateway connect to? (530)>
    How many vif can a DX gateway connect to? (530) #
    Answer

    30

    How many vgw can a DX gateway have? (526,547)>
    How many vgw can a DX gateway have? (526,547) #
    Answer

    10

    How many tgw can a Dx gateway have? (538)>
    How many tgw can a Dx gateway have? (538) #
    Answer

    3

    What is the charge for using Dx gateway? (533)>
    What is the charge for using Dx gateway? (533) #
    Answer

    no

    How many routes can be advised per TGW through the DX gateway? (539)>
    How many routes can be advised per TGW through the DX gateway? (539) #
    Answer

    100 (bgp)

    what is ECMP (251, 556) - only support BGP>
    what is ECMP (251, 556) - only support BGP #
    Answer

    load balancing between different dx connection the same dx location

    how to setup Active-Active with public vif and public ASN (554, 558)>
    how to setup Active-Active with public vif and public ASN (554, 558) #
    Answer

  • advertise same prefix route
  • use ECMP (by aws)

    • how to setup Active-Active with private vif and public ASN (558)>
    how to setup Active-Active with private vif and public ASN (558) #
    Answer

    no

    how to setup Active-Passive with public vif and public ASN (561)>
    how to setup Active-Passive with public vif and public ASN (561) #
    Answer

  • advertise same prefix route
  • as_path / med for incoming traffic to aws
  • local-pref for outgoing traffic to aws

    • how to setup Active-Passive with public vif and public ASN (561)>
    how to setup Active-Passive with public vif and public ASN (561) #
    Answer

    advertise more specific prefix route

    how to constrain the adviser routes to on-premises with public vif (567)>
    how to constrain the adviser routes to on-premises with public vif (567) #
    Answer

    on-premises routes advertise the bgp communities to ask aws to advertise specific routes only (region / inter-region / global)

    how to filter the adviser routes from aws in on-premises with public vif (567)>
    how to filter the adviser routes from aws in on-premises with public vif (567) #
    Answer

    based on the bgp communities from aws. it tells where the route comes from

    what is the routing policy with private vif (577, 582)>
    what is the routing policy with private vif (577, 582) #
    Answer

  • advise more specific route
  • bgp: as_path / med or local preference (same dx location)
  • bgp-communities

    • What is LAG? (584)>
    What is LAG? (584) #
    Answer

    aggregate the dx connection to a larger bandwidth

    How many DX connections can a LAG have? (584)>
    How many DX connections can a LAG have? (584) #
    Answer

    4

    What is the bandwidth requirement of a LAG? (584)>
    What is the bandwidth requirement of a LAG? (584) #
    Answer

    same bandwidth and on the same customer device

    What is the operation connection attribute in LAG? (589)>
    What is the operation connection attribute in LAG? (589) #
    Answer

    no of connection that aws treating the LAG is up and running

    how to increase the resiliency of DX? (3 methods) (590)>
    how to increase the resiliency of DX? (3 methods) (590) #
    Answer

  • multi device (development)
  • multi location (resiliency)
  • multi device and multi dx location (max)
  • one more -> dx over vpn

    • how to encrypt DX traffic? (2 methods) (601)>
    how to encrypt DX traffic? (2 methods) (601) #
    Answer

  • dx over vpn (ipsec)
  • macsec

    • When will the Dx connection be charged? (Hosted and Dedicated connection) (621)>
    When will the Dx connection be charged? (Hosted and Dedicated connection) (621) #
    Answer

  • dedicated: once aws create the connection for you (aws did their job, give you the LOA)
  • hosted: once you accept the connection

    • What will be charged in Dx? (615)>
    What will be charged in Dx? (615) #
    Answer

  • data out and port charge

    • Who will be charged for the DTO fee? (622)>
    Who will be charged for the DTO fee? (622) #
    Answer

    the resource owner to send out the traffic

    ELB>

    ELB #

    What Layer ALB, CLB, NLB, GLB belong to? (639)>
    What Layer ALB, CLB, NLB, GLB belong to? (639) #
    Answer

  • alb 7
  • clb 7/4
  • nlb 4
  • glb 3

    • What protocol does ALB, CLB, NLB, GLB support? (641)>
    What protocol does ALB, CLB, NLB, GLB support? (641) #
    Answer

  • alb http https
  • clb http https tcp tls
  • nlb tcp udp tls
  • glb ip

    • Why does NLB have less latency than ALB? (652)>
    Why does NLB have less latency than ALB? (652) #
    Answer

    do not need to read the packets (we only check the ip port and protocol)

    What kind of target can be used in the ALB and NLB target group? (653)>
    What kind of target can be used in the ALB and NLB target group? (653) #
    Answer

  • alb: ip ec2 lambda
  • nlb: ip ec2

    • What kind of protocol is supported in the health check? (653)>
    What kind of protocol is supported in the health check? (653) #
    Answer

    tcp

    What are the connection idle timeouts of ALB, NLB, CLB? (657)>
    What are the connection idle timeouts of ALB, NLB, CLB? (657) #
    Answer

  • alb 60
  • nlb 350for tcp 120 for udp cannot be configured
  • clb 60

    • What routing algorithm supported by ALB, NLB, CLB (659)>
    What routing algorithm supported by ALB, NLB, CLB (659) #
    Answer

  • alb, clb: least outstanding, round-robin
  • nbl: hash flow hash

    • How to keep the client ip in ALB, NLB (671, 672)>
    How to keep the client ip in ALB, NLB (671, 672) #
    Answer

    alb & clb: x-forwarded-For nlb: proxy protocol 2 clb: proxy protocol 1

    How to keep the client on the same instance for a period of time? (661)>
    How to keep the client on the same instance for a period of time? (661) #
    Answer

    sticky session

    What is Cross-Zone Load Balancing? (663)>
    What is Cross-Zone Load Balancing? (663) #
    Answer

  • by default enabled in alb, the traffic are load balanced to all instances evenly
  • disabled in nlb
  • disabled in clb (api), enabled in clb (console)

    • What is SNI and which ELB does it support? (667)>
    What is SNI and which ELB does it support? (667) #
    Answer

  • sni = domain name in certmulti ssl certs in one web server
  • alb and nlb support it

    • What is Connection Draining (670)>
    What is Connection Draining (670) #
    Answer

    remove opening connections from died instance (auto scaling group)

    Cloudfront>

    Cloudfront #

    What services / source can be Cloudfront’s origin? (683)>
    What services / source can be Cloudfront’s origin? (683) #
    Answer

  • any public ip
  • s3
  • media package and mediastore container

    • Why public access is needed in cloudfront’s origin (683)>
    Why public access is needed in cloudfront’s origin (683) #
    Answer

    Cloudfront does the health check from the internet

    What is the origin group (687)>
    What is the origin group (687) #
    Answer

  • primary & secondary of group of origin for failover
  • one primary and one secondary origin for failover
  • create a origin group, select primary & secondary origin, then select the group in cloudfront origin

    • How to change custom header / behaviour in Cloudfront? (698)>
    How to change custom header / behaviour in Cloudfront? (698) #
    Answer

    use lambda@edge or cloudfront actionfunction

    How to restrict the content to specific geolocation? (696)>
    How to restrict the content to specific geolocation? (696) #
    Answer

  • map the origin to geolocation the allow / block list
  • choose either whitelist / blacklist and the countries for restriction

    • What is AWs global accelerator? What does it work (709)>
    What is AWs global accelerator? What does it work (709) #
    Answer

    use anycast(2ips). will send traffic to aws edge locations and then reach to your service through aws backbone network

    What is the difference between AWS global accelerator and cloudfront? (711)>
    What is the difference between AWS global accelerator and cloudfront? (711) #
    Answer

    cloudfront only supports http / https. accelerator using a transport layer so it can be udp volip mqtt

    Route53>

    Route53 #

    What is the longest and shortest TTL in route53 (721)>
    What is the longest and shortest TTL in route53 (721) #
    Answer

  • 60s
  • 24hr

    • What are the alias targets in route53 (724)>
    What are the alias targets in route53 (724) #
    Answer

  • s3
  • beanstalk
  • vpce
  • accelerator
  • api gateway
  • elb
  • cloudfront
  • other route53 record(same hosted zone)

    • How to bind an RDS DB instance in route53 (748)>
    How to bind an RDS DB instance in route53 (748) #
    Answer

    cname

    Routing Policies in Route53? (725)>
    Routing Policies in Route53? (725) #
    Answer

  • simple
  • multivalue
  • failover
  • latency
  • weighted
  • geolocation
  • geoproximty

    • How does Route53 perform the health check in a private VPC? (732)>
    How does Route53 perform the health check in a private VPC? (732) #
    Answer

    setup a health check with cloudwatch alert

    How to setup hybrid DNS (754)>
    How to setup hybrid DNS (754) #
    Answer

    use route53 forwarderresolver. create outbound(forward on-premise domain query to on-premise dns) and inbound (for on-premise forwarderresolver to forward the query to aws vpc domain) endpoint

    How does AWS ensure the HA in route53? (807)>
    How does AWS ensure the HA in route53? (807) #
    Answer

  • random sharding
  • anycast striping

    • Network firewall>

    Network firewall #

    What layer SG, NACL, network firewall, WAF, shield?>
    What layer SG, NACL, network firewall, WAF, shield? #
    Answer

  • sg = 7 3/4
  • nacl = 4 3/4
  • network firewall 7-4 7-3
  • waf = 7
  • shield = 3

    • What is the VPC level in SG and NACL? (766)>
    What is the VPC level in SG and NACL? (766) #
    Answer

  • sg = vpc instance
  • nacl = subnet

    • When should we use nacl instead of sg? (768, 769)>
    When should we use nacl instead of sg? (768, 769) #
    Answer

    to block something (sg cannot block traffic)

    When should we use WAF instead of lacl ? (770)>
    When should we use WAF instead of lacl ? (770) #
    Answer

  • block many ips / handle ddos
  • block ip for the application cloudfront / alb behind

    • Stateless and stateful of sg, nacl, network firewall, shield? (773)>
    Stateless and stateful of sg, nacl, network firewall, shield? (773) #
    Answer

  • sg = stateful
  • nacl = stateless
  • network firewalld = both (stateless -> stateful)
  • shield = stateless

    • How can a SYN cookie prevent DDos in packet flooding? #
    Gateway Load balancer>

    Gateway Load balancer #

    what is the use case of gateway load balancer (813)>
    what is the use case of gateway load balancer (813) #
    Answer

    applicane (ip ec2)

    what port does gateway load balancer need for GENEVE (817)>
    what port does gateway load balancer need for GENEVE (817) #
    Answer

    GENEVE UDP 6081

    Other>

    Other #

    Centralised VPC Interface endpoint 295>
    Centralised VPC Interface endpoint 295 #
    access s3 with endpoint>
    access s3 with endpoint #
    use a private link to access a web server (NLB/EC2) #
    VPC peering connections (125)>
    VPC peering connections (125) #
    VPC peering allows using Security group (301)>
    VPC peering allows using Security group (301) #
    how many ip can BYOIP bring in (90)>
    how many ip can BYOIP bring in (90) #
    How many VPC CIDRs can a VPC have? (72)>
    How many VPC CIDRs can a VPC have? (72) #
    dns of vpc .2 169.254.169.253 (117)>
    dns of vpc .2 169.254.169.253 (117) #
    Why is edge location safe? (711)>
    Why is edge location safe? (711) #
    What must be enabled to use route53 in vpc?>
    What must be enabled to use route53 in vpc? #

    Demo (266)

    Hand-on Labs>

    Hand-on Labs #

    https://www.whizlabs.com/learn/course/aws-advanced-networking-speciality/195

    EC2>

    EC2 #

    • 30
    CloudFront>

    CloudFront #

    • 1
    • 2
    • 10
    ALB>

    ALB #

    • 3
    • 4
    • 5
    WAF>

    WAF #

    • 11
    • 12
    ACL>

    ACL #

    • 18
    • 29
    VPN>

    VPN #

    • 21
    Endpoint>

    Endpoint #

    • 23
    • 24
    • 25
    Flow Log>

    Flow Log #

    • 26
    Container>

    Container #

    • 28
    VPCs Connectivities>

    VPCs Connectivities #

    Solution / Situationsame regioncross accountcross region
    VPC PeeringOKOKOK
    TGW PeeringOKOKOK
    TGW (attach VPC)OKOKNO
    AWS Managed VPNOKOKOK
    EC2 Based VPNOKOKOK

    Private Link is something like tgw peer but for specific service only. It can cross regions and accounts.

    Scope>

    Scope #

    ResourceScope
    VGWVPC
    TGWVPC
    NLBVPC
    ALBVPC
    Route53VPC
    NATSubnet
    Common Pattern>

    Common Pattern #

    • Routing (582)
    Site-to-Site Connection routing>

    Site-to-Site Connection routing #

    • Static - Active/ Active Tunnels (349)
    • Static - Active/ Passive Tunnels (350)
    • Dynamic - Active/ Active Tunnels (351)
    TGW>

    TGW #

    • Centralised NAT gateway (241)
    • Centralised NAT instance (243)
    • Centralised NAT instance + VPN (244)
    • Centralised VPC interface endpoint + VPN (245)
    • Hybrid VPN (247)
    • Hybrid DX (248)
    VPC Peering>

    VPC Peering #

    Failed cases>

    Failed cases #

    PageTitle
    207CIDR overlap or transitive routing
    208from DX or VPN
    209to IGW
    Site-to-site VPN / DX with VGW>

    Site-to-site VPN / DX with VGW #

    Use cases>

    Use cases #

    PageTitle
    335Site-to-site Connection with NAT-Traversal
    361Single Site-to-site Connection with VGW
    363Multiple Site-to-site Connection with VGW
    365Redundant VPN connections for HA
    Failed cases>

    Failed cases #

    PageTitle
    340Site-to-site VPN to IGW
    341Site-to-site VPN to NAT
    343Site-to-site VPN to VPC Peering
    344Site-to-site VPN to VPC Gateway endpoint
    Successful cases>

    Successful cases #

    PageTitle
    342Site-to-site VPN to NAT Instance
    345Site-to-site VPN to VPC Interface endpoint
    345Site-to-site VPN to on-premise NAT to Internet
    Site-to-site VPN with TGW>

    Site-to-site VPN with TGW #

    PageTitle
    362Multiple Site-to-site Connection with TGW
    VPN CloudHub>

    VPN CloudHub #

    • 369
    EC2 Based VPN>

    EC2 Based VPN #

    PageTitle
    375Single instance
    376HA
    378Horizontal scaling - VPN EC2 per subnet
    379Horizontal scaling - Split traffic
    Transit VPC>

    Transit VPC #

    PageTitle
    391Transit VPC
    398global regions with single Transit Hub
    398global regions with multiple Transit Hub (GRE)
    549Direct Connect and Transit VPC
    DX>

    DX #

    Use cases>

    Use cases #

    PageTitle
    591VPN as a backup
    592Dual Devices
    593Dual locations
    594Dual locations with DX connection backup
    602VPN over DX
    Failed cases>

    Failed cases #

    PageTitle
    530DX Gateway with multiple customer sites
    542DX Gateway with multiple TGWs
    Successful cases>

    Successful cases #

    PageTitle
    546DX Gateway with multiple customer sites
    Network Firewall>

    Network Firewall #

    Use cases>

    Use cases #

    • Centralised: single firewall subnet / vpc. connect with tgw (791)
    • Distributed: firewall subnet per vpc (790)
    Limitation>

    Limitation #

    VPC Limit

    Peering>

    Peering #

    VPC Peering: 125

    Routing>

    Routing #

    ResourceLimit
    Private VIFs100
    Public VIFs1000
    MTU (159)>

    MTU (159) #

    ResourceLimit
    VPC9001
    VPC Peering1500
    DX9001
    TGW (to DX)8500
    TGW (to VPN)1500
    VPC Endpoint1500
    NAT1500
    IGW1500
    VPN1500
    Bandwidth>

    Bandwidth #

    VPC (180)>

    VPC (180) #

    ResourceLimit
    VPC Peerno
    IGWno
    NAT5-45 Gbps
    TGWdepends
    VGW1.25Gbps
    VGW (to DX)depends on DX
    TGW>

    TGW #

    • 1 VPN can have 2 tunnels
    ResourceLimit per resource
    VPC50Gbps
    DX50Gbps
    TGW50Gbps
    VPN tunnel1.25Gbps
    VPN Tunnel>

    VPN Tunnel #

    1.25Gbps

    EC2>

    EC2 #

    EC2 network performance rules:

    • single flow limit
    • within regions and other
    SituationLimit
    w/i the region100%
    to other regions50%
    igw50%
    dx50%
    Single Flow>
    Single Flow #
    SituationLimit
    w/i placement group10Gbps
    other5Gbps
    Aggregated>
    Aggregated #
    SituationLimit
    w enhanced networking100Gbps
    w/o enhanced networking25Gbps
    Network DriverLimit
    Intel 82599VF10Gbps
    ENA100Gbps
    EFA100Gbps