网络课程笔记

00:00 Hi.

00:00 So in this lecture let's understand about the elastic network interfaces or Enis.

00:06 Now as the name suggests these are network interfaces.

00:10 And you know that network interface is a basic building block of any network which provides the IP address

00:17 and which ultimately enables the network communication.

00:21 Now in AWS world it is called Elastic Network Interface.

00:25 So as of now we are talking about EC2 machine and corresponding IP address.

00:32 But how EC2 instance gets that IP address.

00:35 Now that IP address is assigned using the Eni that AWS creates when you launch EC2 instance.

00:42 So Enis are the logical component in the VPC that represents the virtual network card.

00:48 Now this is very similar to the physical network card that you have in your laptop or in any server

00:55 machine.

00:56 So in AWS world you have EC2 and whenever you provision the EC2 instance, AWS will create automatically

01:05 an Eni and it will be associated with that EC2 instance.

01:10 So here you can see that Eni has the address eth0 and it acts as a primary network interface for your

01:18 EC2 instance.

01:20 So which means whenever we talk about the IP addresses, we are actually talking about the elastic network

01:25 interfaces.

01:27 And one more thing is that you can attach multiple Enis to your EC2 instance.

01:33 And shortly we will see how many Enis you can attach to a given instance.

01:38 But like there is ETH zero, you can also add one more Eni and associate that with the same EC2 instance,

01:47 right?

01:47 Okay, now let's understand a few more properties of the Enis.

01:51 So Enis are bound to a specific AZ, which makes sense because EC2 instance scope is also AC level,

01:59 which means if you create Eni in one AZ, you cannot associate that with the EC2 instance in another

02:05 AZ.

02:06 Okay, moving forward, let's understand the attributes of the Enis.

02:11 And there are a lot of properties of the Enis.

02:13 So we'll just quickly talk about that.

02:16 And I don't think you need to remember all those.

02:18 But I will highlight the things which are important to remember.

02:22 So every Eni that you create has of course the primary IPv4 address that it gets from the subnet in

02:29 which you create that Eni.

02:32 And that's where EC2 instance gets the private IPv4 address when you launch it.

02:37 Now similarly, Eni can also provide the IPv6 address.

02:42 And that really depends whether your VPC has IPv6 Cidr block.

02:47 Now so far we are just talking about the primary IPv4 address.

02:52 But Enis can also have secondary additional IP addresses.

02:58 Now here we are not talking about secondary enis but secondary IP's of the same Enis.

03:05 That means when any can have multiple IP addresses.

03:10 So one or more secondary private IPv4 addresses from the range of the VPC and the subnet in which those

03:17 Enis are provisioned.

03:19 Now, along with private IPv4 address, Eni will also have one or more elastic IP address, one public

03:26 IP address, and one or more IPv6 addresses.

03:31 Now other important thing that you should remember is the security group that you attach to EC2.

03:36 Instances are actually attached to the Enis.

03:41 So Eni can have one or more security groups.

03:45 Now there is a limit of five security groups so far.

03:48 And this limit can change over the time.

03:51 Now another feature of Eni is a mac address.

03:55 And this is important because a lot of software licenses are bound to a mac address.

04:00 So if your instance terminates for some reason, then probably you would have to buy another software

04:06 license.

04:07 Now, in that case, you can preserve your inis and then you can launch another instance and can attach

04:13 this eni to that instance.

04:16 That's where your license will still work.

04:19 So whenever you see questions around licensing and Mac addresses, remember this thing.

04:25 And finally, you can also have source destination flag for the Eni.

04:30 Now if you remember in the Nat exercise where we had configured Nat on the EC2 instance, we had disabled

04:37 the source destination check.

04:40 And in that case we actually disabled that on the Eni of that EC2 instance.

04:46 So that feature actually comes from the Eni.

04:49 And because the Inis can be attached and detached from the EC2 instance and we are talking about the

04:55 secondary Eni, then you can definitely detach that secondary Eni from one EC2 instance and can attach

05:03 to another EC2 instance.

05:06 Now you can't do that with the primary Enis Nice because that's primary.

05:10 But definitely you can do that with the secondary.

05:14 Ines.

05:15 Okay.

05:16 Now one question that I did not answer is how do you know that?

05:19 How many Ines or IP addresses your instance can have?

05:24 Now that really depends on EC2 instance type.

05:28 And this is available in AWS documentation where it clearly defines that depending on the instance type,

05:35 how many network interfaces you can have and how many IP addresses per network interface can have.

05:42 So accordingly, you can make your calculations that how many maximum IP addresses you can have on that

05:48 particular instance.

05:50 And this becomes essential or important whenever you work in say, Kubernetes world where Kubernetes

05:57 pods get a IP from the secondary IP addresses of your Ines.

06:03 And we are going to talk about this in very detail in the ECS networking section.

06:09 But point here is that number of IP addresses that you can have for EC2 instance actually depends on

06:14 instance type and corresponding Enis, right?

06:17 So I hope that is clear.

06:20 Okay.

06:20 Now let's look at some of the use cases of the Enis.

06:24 So there are many use cases.

06:25 But I will highlight four use cases which are important for your exam.

06:30 So the use cases are requester managed Enis.

06:34 Then how you can have your EC2 instance as a dual home.

06:38 Then how can you have a low cost solution for high availability.

06:43 And then how can you use the secondary IP addresses of the Eni for the EKS pods?

06:50 So let's talk about these use cases okay.

06:53 So very first use case is requester managed Enis.

06:57 And this means that AWS creates the Eni into your VPC on behalf of some other AWS service.

07:05 So if you have ever used rds, DB instances or say Nat gateways, you have used requester Managed Ennis.

07:13 And to explain it a little further, when you create a RDS DB instance, you know that it's a fully

07:19 managed AWS service, which means AWS takes care of its provisioning, patching, maintenance, everything.

07:26 But still, you can control the traffic to the DB instance using the security groups.

07:31 Now here AWS creates the Eni on behalf of RDS service into your customer VPC.

07:38 And that's how it can control the rest of the activities for that DB instance.

07:44 And similarly, if you ever used ECS service that is Elastic Kubernetes service, entire control plane

07:51 stays into AWS managed VPC.

07:54 Now in this case, even the instances for that control plane is created in AWS managed VPC.

08:01 And this control plane communicates with the data plane which is inside your VPC using those requester

08:07 managed Enis.

08:09 So essentially there are two types of resources the resources which are created in the customer VPC.

08:15 And that's an example of the RDS db instance.

08:18 And the other use case where the underlying compute service is provisioned inside the AWS managed VPC.

08:25 And it allows you to access that service using this requester managed Enis.

08:31 Right.

08:31 So that's the second example.

08:33 And third example could be the Lambda service or say Amazon Workspaces or AppStream service.

08:39 So AppStream and workspaces are like managed compute instances which you can use as your VDI environment.

08:46 And in this case as well AWS creates the requester managed Enis.

08:50 And just to show you how exactly it works.

08:53 So as you can see here, the actual workspace instances which are nothing but underlying EC2 instances

09:00 are launched in AWS managed VPC.

09:03 However, you can access your workspace instances from within your VPC, or you can even connect your

09:09 VPC to the corporate data center and then can access these instances from this network interface.

09:16 Now for this AWS creates this Enis which are requester managed Enis.

09:23 Now another example is using the Lambda functions.

09:25 Now when you create a Lambda function, AWS also asks you whether you want to provision this Lambda

09:30 function inside your VPC.

09:32 And that's for the reason.

09:33 If through lambda function, you want to access a rds db instance.

09:38 Now in that case, AWS provisions this Eni and then associate that with the Lambda function so that

09:45 Lambda can access the resources inside your VPC, and which also means if you don't use requester managed

09:52 Eni, then Lambda will be provisioned in a separate compute environment which is completely managed

09:57 by AWS.

09:58 And then Lambda won't be able to access your resources inside your VPC.

10:03 So to enable that communication, AWS uses requester managed Enis.

10:08 So I hope it is clear how requester managed Enis work.

10:12 Okay, so moving on.

10:14 Another example of the Enis as you know, is creating dual home instances.

10:20 Now in this case you have this EC2 instance and one Eni is providing access to the application over

10:27 the internet.

10:28 So you can put right security groups here.

10:31 But at the same time, if you want to manage or connect to this EC2 instance from your on premise network,

10:37 then you can have another Eni which is in a private subnet, and then you can connect to it over Dhe

10:43 or a VPN connection.

10:45 So this kind of implementation can happen using multiple Enis.

10:51 And now further another use case where you can have high availability solution which is low cost.

10:56 Now typically for Ha you might have multiple instances running at the same time.

11:01 But here you can have one instance which is serving the traffic.

11:04 And there is this Eni.

11:06 And now if for some reason this EC2 instance goes down, you can preserve your Eni saying that don't

11:13 delete the Eni when instance terminates and then you can launch the replacement instance, which is

11:18 also called as hot standby instance.

11:21 And then you can attach this Eni to this instance.

11:25 Now while doing so your client doesn't understand that the EC2 instance has changed.

11:30 You don't need to change any DNS configuration and everything works now.

11:35 Momentarily you could have the traffic loss, but if it is not super critical business application then

11:42 this is better with respect to your cost of running multiple instances.

11:47 So as I said, you can attach the Eni to another instance and no other changes are required.

11:54 And finally, you can use the Eni secondary IP addresses to allocate IP address to exports.

12:01 And we are going to dive deep into this architecture in the EKS networking section.

12:07 But that's another area where Enis secondary IPS are used.

12:13 Okay, so before we wrap up, I just wanted to summarize what we learned and some important thing to

12:19 remember for your exam.

12:21 So number of IP addresses or any depend on the instance type.

12:26 Then with respect to the Eni attachment or detachment you cannot detach the primary Eni.

12:31 But you can definitely do that with the secondary Eni.

12:35 You actually associate security group with the Enis and not with the EC2 instances.

12:41 And as of now, you can associate up to five security groups to a given.

12:46 Any further.

12:48 If it is about the Mac addresses and the licensing thing, then you can use the same Eni and your licensing

12:55 will still work.

12:57 Further, you can have multiple Enis and you can have architectures like Multi-home.

13:03 Of course EC2 has to be in the same AZ, but then this Enis can also be created in other AWS account

13:10 and that's how the requester managed Enis work.

13:14 Now Eni cannot be used for Nic teaming.

13:16 Now we haven't talked about that.

13:18 So Nic teaming is a general feature of the networking where you can combine multiple Enis to provide

13:25 the higher performance and higher bandwidth.

13:27 But in AWS world this is not supported.

13:31 So which means if EC2 has the maximum bandwidth limit of five GB, then you cannot have two Enis and

13:37 then it will become ten GB.

13:39 This is not supported.

13:42 And finally, a word of caution.

13:43 When you have multiple Enis from the same subnet attached to the instance because it may create the

13:50 asymmetric routing.

13:52 Now asymmetric routing means that the incoming traffic comes from one Eni but the returning traffic

13:58 goes through another Eni.

14:00 And in many cases it may create a routing problem.

14:04 So instead, if you want to have multiple IP addresses in the same subnet, then you just use a single

14:11 Eni.

14:12 And then you use multiple IP addresses of those Eni for that purpose.

14:18 So that's it about the Enis and I hope you learned something new.

14:22 So thanks for watching and stay tuned.