网络课程笔记

00:00 Hi all, welcome to this lecture.

00:01 This is essentially the last lecture of this section,

00:05 so we are going to summarize what we saw

00:07 and we will also talk about the important thing

00:10 you need to remember for your exam.

00:13 So we started with,

00:14 how to map your physical network to virtual network,

00:18 how the lands and the routers

00:22 relate to the network inside VPC.

00:25 Then we saw the VPC and its components,

00:28 the placement of VPC in region

00:31 and how VPC spans across multiple Availability Zones.

00:36 Then we started with how to address the VPC

00:38 using the CIDR notation.

00:40 And then we saw the significance of a prefix,

00:44 how does it resolve the bits

00:47 for your network addressing and rest of the bits

00:50 are used for the host addressing inside the VPC.

00:54 Then we saw how the VPC can be subdivided

00:57 into a smaller networks in the form of subnets.

01:00 And then VPC has a default main route table,

01:04 but you can create a custom route table

01:06 and then attach those route tables to subnet

01:08 so that you can take a better control over which traffic

01:13 and how the traffic should be routed inside your subnets.

01:17 We also saw that we need to have Internet Gateway attached

01:21 to our VPC so that it can communicate with the internet.

01:24 So Internet Gateway has to be created

01:27 and then attached to your VPC.

01:30 Then we saw different type of IP addresses,

01:32 we started with IPv4 and IPv6 addresses,

01:36 and then we also saw private, public

01:39 and elastic IP addresses

01:41 and what are the differences between those.

01:44 We also saw how EC2 instance get IP address,

01:47 that is using the elastic network interface,

01:50 and then we saw a couple of features

01:52 of elastic network Interface,

01:54 as in, it depends on your EC2 instance type,

01:58 how many network interfaces you can attach.

02:01 And also every network interface

02:03 comes with one or more secondary private IP addresses

02:07 as well as elastic IP addresses,

02:09 so that's what we saw in this section.

02:13 Later then we moved to firewalls,

02:15 and inside VPC, we saw two kinds of firewalls,

02:18 security groups and network ACLs.

02:20 And we saw the placement of these two firewalls,

02:25 and the differences between

02:26 the two importantly security group works

02:29 at instance-level and network ACLs works at subnet level.

02:32 security groups are stateful, network ACLs are stateless.

02:37 Security group can only have the allowed rules

02:43 and the network ACL can have both allow and deny rules.

02:46 And then we also saw how the traffic

02:49 can be restricted using the network ACL.

02:52 That means you can block certain IP addresses,

02:54 which cannot be done using the security group.

02:57 Then we actually set up the labs where we created VPC

03:02 and public subnet and then private subnet,

03:05 and we saw how to reach to the instance in a public subnet,

03:09 and from there you can reach

03:10 to the instance in private subnet.

03:12 Also, we saw that private EC2 instances

03:15 cannot access the internet,

03:16 and the solution to that was NAT,

03:19 so we understood how the NAT functionality works

03:22 and then AWS provides a managed NAT service

03:25 in the form of NAT Gateway.

03:27 And then we created a NAT Gateway

03:29 and modified the route tables,

03:32 for your private subnets to direct the traffic

03:36 from those subnets to the internet via NAT Gateways.

03:40 In certain cases, you might need NAT

03:43 as a your own EC2 instance.

03:45 And we saw you need to take care of certain things,

03:49 like for example,

03:50 you have to disable the source destination check.

03:53 Otherwise EC2 instance only accepts the traffic

03:56 where the destination address is its own IP address,

04:00 so we have to disable that setting.

04:02 So in short, these are the very basic things about the VPC

04:06 and you should be very well aware of all this concept

04:11 so that you can choose a right answer during your exam.

04:15 With respect to the exam essentials,

04:18 quick recap again, for VPC and the subnet,

04:22 the maximum size of CIDR could be /16,

04:26 and which allows you to create two raised 16,

04:29 that is 65536 IP addresses inside the VPC.

04:34 Similarly for subnets and VPC, the minimum size is /28,

04:40 which means two raised to four,

04:41 that is 16 IP addresses can be allocated,

04:45 but those 16s are not usable of course,

04:47 five IP addresses are unused in any given range,

04:52 first four IP addresses

04:53 and the last IP addresses is reserved

04:55 and you cannot allocate that to EC2 instance.

04:58 Now subnet is associated with Availability Zone,

05:03 that means one subnet

05:04 cannot span across multiple Availability Zone,

05:08 however, one AZ can have multiple subnet.

05:11 And we saw that in logical diagram as well.

05:15 Now, all subnets by default follow

05:17 the VPCs main route table.

05:18 That's what we saw, we started with,

05:21 but good idea is to have

05:23 the dedicated route table for your subnets

05:27 and then you modify the routes there

05:29 rather than modifying the main route table.

05:33 All the route tables have a default local routes,

05:36 which is for which the destination address

05:39 again the VPC CIDR, which allows the communication

05:43 between all the subnets within the same VPC.

05:46 And whether you have the main route table

05:49 or custom route table, this local route will always be there

05:52 and you cannot remove that.

05:54 That means by default at a network layer,

05:57 at least all EC2 instances within a VPC

06:00 can communicate with each other

06:02 irrespective of, in which subnets they are created.

06:06 So additionally, you need to know few more things,

06:10 for example, if you want to block the IP address,

06:12 you can't do that with security group,

06:14 you have to do that with network ACL deny rule.

06:18 Security groups are stateful,

06:20 you'd no need to have explicitly outbound rule

06:22 for incoming return traffic, right.

06:26 And in case of network ACL, they are stateless.

06:29 That means for return traffic as well,

06:32 you need to open the outbound rule

06:34 and typically it will be open for if few middle port range,

06:37 and that's what we had seen.

06:40 Now NAT Gateways or NAT Instance,

06:42 must be created in public subnet,

06:44 and they are highly available within the same AZ.

06:48 That means if you need to have NAT Gateways

06:50 to be resilient to AZ failure,

06:54 you need to have multiple NAT Gateways across those Azs.

06:58 NAT Gateways does not have security groups,

07:01 and hence that traffic can only be controlled

07:03 using the network ACL, which works at subnet level.

07:07 You don't get access to underline NAT Gateway machine,

07:10 it's completely managed by AWS.

07:13 So NAT Instance is a kind of replacement

07:16 and it may be a cost effective solution,

07:18 but it is not as performant and as resilient as NAT Gateway

07:23 because NAT Gateway is completely managed service.

07:27 And remember for NAT Instance,

07:29 you have to disable the source destination check

07:31 at that EC2 instance-level.

07:33 So essentially these are the important thing you need

07:36 to remember for the exam from this section,

07:40 and with that, we will end this section

07:42 and now we'll get into the advanced VPC concept.

07:47 So thanks for staying during this lecture,

07:50 and I hope you understood what we covered in this lecture.

07:54 So thank you for watching.