网络课程笔记

00:00 So now let's talk about

00:01 what you need to know from an exam perspective

00:03 for the network load balancer.

00:05 So here is the classic architecture of a NLB.

00:09 So the NLB sits between two AZs.

00:12 The clients are connected to the NLB.

00:14 The NLB has fixed IP addresses, so it's connected to ENIs

00:18 with static IPs.

00:19 And then the ENI are going to send the traffic directly

00:23 into our EC2 instances that are sitting in the target group

00:26 that can span of course across multiple AZs.

00:30 So the network load balancer operates at the layer 4,

00:32 which is TCP or UDP protocols or Secure TCP so TLS.

00:37 It's meant for really high performance,

00:40 so it can handle millions of requests per second.

00:43 And as you know, the NLB has one static IP per AZ

00:47 and you can assign an Elastic IP

00:50 in case it is an internet-facing NLB,

00:53 which is very helpful if you need to whitelist IP addresses

00:56 from a firewall perspective.

00:58 Now, load balancing is possible to be done

01:01 on multiple applications running on the same machine.

01:03 So for example, containers with Amazon ECS,

01:05 so it has the same port mapping feature as the ALB.

01:10 There is less latency than the ALB,

01:12 so we get a hundred milliseconds latency for the NLB

01:15 versus maybe 400 milliseconds for the ALB.

01:18 It supports the WebSocket protocol

01:20 and you would use an NLB in these cases mostly

01:24 if you need extreme performance or you have a custom TCP

01:27 or UDP traffic protocol.

01:29 And in case, you're using also AWS private link.

01:32 And this is used when you want to privately expose

01:35 an internal service to another account in AWS for example.

01:39 So target groups of the NLB can be EC2 instances,

01:43 in which case these EC2 instances can be managed by an ASG

01:46 or ECS tasks managed by the ECS service itself

01:49 or IP addresses and they must be private IP addresses

01:53 for TCP listeners only.

01:55 So this is going to be for example, the on-premises servers

01:59 that are going to be connected to your cloud

02:02 using Direct Connect or a VPN connection.

02:04 Also IP addresses can be for inter-region peered VPC.

02:08 So this is a cool feature (indistinct) remember

02:10 in case you have a VPC in another region,

02:12 it is possible to have it connected

02:14 to an NLB in another region using a IP address mapping

02:18 and also peered VPCs.

02:21 So an important point you need to know is that

02:23 you cannot register your EC2 instances by ID on your NLB

02:28 if these EC2 instances are in another VPC of your NLB.

02:32 Even if that VPC is peered with NLB, this is not possible.

02:36 Instead, you need to register these instances

02:39 by IP address directly using the IP address features

02:43 of your target group.

02:44 In terms of health checks,

02:45 you have the supported protocol of HTTP, HTTPS and TCP

02:49 and you have two types of health checks.

02:51 The active health check will periodically send a request

02:54 to the registered targets,

02:56 whereas the passive health check will observe

02:58 how targets respond to connections and then they will...

03:01 This is a feature for you that allows you

03:02 to detect unhealthy instances

03:05 before the active health checks are being made.

03:07 So you cannot disable this or configure it.

03:11 Now, if we have a look at the architecture of your NLB,

03:15 you could have multiple rules and listeners,

03:17 but this works for both TCP and UDP traffic, okay?

03:22 Why am I saying this?

03:23 Well, because there is something very important to learn

03:25 about client's IP preservation.

03:28 So this is the architecture we have

03:30 and we want to understand if the client's IP address

03:33 is going to be forwarded to targets or not.

03:36 And this is something you have to remember by heart.

03:38 So, if you are registering your instances by ID

03:42 or within your ECS tasks,

03:44 then automatically the client's IP will be preserved

03:47 and your EC2 instances will see traffic originating

03:50 directly from your clients.

03:52 If you are registering your targets by IP addresses

03:56 using TCP or Secure TCP, so TLS protocol,

04:00 then by default the client's IP preservation is disabled.

04:06 Now if you are using the UDP or the TCP_UDP protocol,

04:09 then by default this is enabled.

04:13 Now, if this is disabled, for example,

04:15 for the IP address register registration for TCP and TLS,

04:19 you can enable it, okay, by using the Proxy Protocol v2.

04:25 and this is a setting you have to enable

04:27 on your network load balancer.

04:29 We'll see this later on in another lecture,

04:32 but these Proxy Protocol v2 will add headers to the request

04:37 and these headers will be giving the opportunity

04:41 for your EC2 instances to understand

04:44 who was the originating clients.

04:47 Okay, now in terms of mapping of listener and targets,

04:50 we can have TCP to TCP or TCP_UDP;

04:54 TLS to TCP or TLS and then UDP to UDP or TCP_UDP

04:59 and TCP_UDP to TCP_UDP.

05:02 Now, I haven't seen this to be helpful

05:04 for an exam perspective, but I'm just leaving it out there

05:06 just in case this is necessary.

05:08 So now some very interesting fact in networking regarding

05:12 network balancer and availability zones.

05:15 So say we have a target group with EC2 instances

05:19 spread across two availability zones,

05:22 then you need to know that you must enable an AZ

05:26 on the NLB itself before traffic is sent to that AZ.

05:31 That means that if you only have an NLB

05:33 with Availability Zone 1 enabled,

05:36 it will only send traffic to the EC2 instances in AZ 1.

05:41 It will not send traffic to the second AZ,

05:45 even if your EC2 instances are in the target group.

05:49 So to have this NLB send traffic to AZ 2,

05:54 you must add or enable an AZ and this can be done

05:58 even after the network load balancer is created.

06:02 Very important because the exam will ask you this.

06:04 Also, you cannot remove an AZ after it is enabled, okay?

06:08 You can add over time, but you cannot remove.

06:10 If you wanted to remove an AZ,

06:12 you would have to recreate a new network load balancer.

06:16 Now you may say, what about Cross Zones Load Balancing?

06:20 How does that work?

06:21 Well, they only work for the AZs

06:23 that are enabled on the NLB.

06:25 So now if we consider three availability zones

06:27 and target group with EC2 instances in all AZ,

06:31 then what's going to happen is that say we enabled

06:33 AZ 1 and AZ 2 with our NLB,

06:36 then thanks to Cross Zones Load Balancing,

06:39 the traffic can go from AZ 1 to AZ 2 at the NLB level.

06:44 But again, because we have not enabled AZ 3,

06:47 then even if we have Cross Zones Load Balancing,

06:50 it's not going to send traffic to AZ 3

06:53 because it is not enabled.

06:55 So if you understand this,

06:57 you understand the key networking concepts

06:59 on the network load balancer.

07:01 Now another one is around Zonal DNS Name.

07:04 So if you resolve what's called the regional NLB DNS name,

07:08 which is the DNS name you would use by default,

07:11 then it's going to return all the IPs

07:13 for all the NLB nodes in all the enabled AZs.

07:17 So this is your NB DNS name.

07:20 And so if we have the NLB here enabled in three AZ

07:23 and we do a DNS query for this NLB DNS name,

07:27 then we're going to get three IP as a return,

07:30 which will correspond to the three AZ that are enabled.

07:34 But sometimes you may want to resolve the Zonal DNS name

07:38 and the idea is that the NLB has DNS name

07:41 for each of their nodes so based on the available zone

07:44 and using this Zonal DNS Name,

07:46 we can resolve only one IP address,

07:49 which is the IP address of each node.

07:51 So for example, if you wanted to know

07:52 what was the IP address of the node in US-east-1a,

07:56 then you would add US-east-1a, to your DNS name,

07:59 and then it would return only the first IP.

08:03 So why would you do this?

08:04 Why would you want to resolve a specific node

08:06 while this could be, for example,

08:08 to minimize latency or data transfer cost?

08:10 For example, say you have an application

08:13 and it's deployed on your VPC in three different AZ

08:18 and it's going to then talk to an NLB.

08:21 Then you absolutely want, for example,

08:23 your instances in US-east-1a,

08:26 to talk through the NLB node in US-east-1a.

08:29 Because there is going to be no data transfer cost

08:32 and lower latency.

08:33 So in that case, you would resolve the Zonal DNS name

08:36 for your NLB and only find the one IP

08:39 that will ensure you don't have any networking cost.

08:42 Because if you use the regional NLB name,

08:44 then there's a chance for you

08:45 that your application sends traffic from one AZ

08:48 to the other one, therefore incurring some cost.

08:51 So to make sure your application sends traffic

08:54 to the right NLB node,

08:55 you need to implement application specific logic.

08:58 Your application needs to understand

09:00 in which AZ it is operating from

09:02 and then how to query the right DNS name for your NLB.

09:07 Okay, so some things are good to know

09:09 for your network load balancer.

09:11 You cannot disable or remove an AZ

09:13 after you create it for your NLB,

09:15 and you cannot modify the ENIs

09:17 created for the NLB in each AZ.

09:18 You can only view them

09:19 while this is because we have a fixed IP.

09:21 You cannot change the elastic IPs

09:23 or private IPv4s attached to the ENIs

09:26 after you create the load balancer.

09:27 So that means that everything is static

09:29 from the moment you create your NLB.

09:31 Your NLB supports 440,000 simultaneous connections

09:34 per minute per target.

09:36 If you go over that, you will get a port allocation error.

09:40 And the solution to this is to just add more targets

09:42 to the target group.

09:43 Finally, and this is very, very important

09:45 from a networking perspective.

09:47 So in case, you have an internet facing load balancer,

09:50 then the subnets for you to deploy this into

09:53 must have at least 8 IP addresses that are available.

09:58 So that means that your subnet size

10:00 must be a minimum of /28.

10:03 In case you're using an internal balancer,

10:04 this is only relevant if you let AWS select

10:07 the private IP addresses from these subnets.

10:10 So remember, 8 available IP addresses for the NLB,

10:14 which is a /28 CIDR for your subnets.

10:18 So that's it. I hope you like this lecture,

10:20 and I will see you in the next lecture.