# SAA - C03 Certification: Networking

# Public and Private IP

* **Private IP**
    
    * 10.0.0.0 - 10.255.255.255 (10.0.0.0/8)
        
    * 172.16.0.0 - 172.31.255.255 (172.16.0.0/12) ← AWS default VPC in that range
        
    * 192.168.0.0 - 192.168.255.255 (192.168.0.0/16) ← home networks
        
* **Public IP**: All the rest of the IP addresses
    

# Subnet

* AWS reserves 5 IP addressed (first 4 and last 1) in each subnet
    
    * Example: if CIDR blocks 10.0.0.0/24, then reserved IP addresses are:
        
        * **10.0.0.0** - Network Address
            
        * **10.0.0.1** - reserved by AWS for the VPC router
            
        * **10.0.0.2** - mapping to Amazon-provided DNS
            
        * **10.0.03** - future use
            
        * **10.0.0.255** - Network Broadcast Address
            

# NAT Instance

* Allows EC2 Instances in a private subnet to connect to the Internet
    
* **Must be launched in a public subnet**
    
* **Must disable EC2 Setting: Source/destination Check**
    
* **Must have Elastic IP attached to it**
    
* Route Tables must be configured to route traffic from **Private Subnets** to the **NAT Instance**
    

## Comments

* Pre-configured Amazon Linux AMI is available
    
    * Reached the end of standard support on 31/12/2020
        
* Not HA / Resilient setup out of the box
    
    * It would help if you created an ASG in multi-AZ + resilient user-data script
        
* Internet traffic bandwidth depends on EC2 Instance Type
    
* You must manage Security Groups & Rules:
    
    * Inbound
        
        * Allow HTTP/HTTPS traffic coming from Private Subnets
            
        * Allow SSH from your home network
            
    * Outbound
        
        * Allow HTTP/HTTPS traffic to the Internet
            

# NAT Gateway

* AWS-managed NAT, higher bandwidth, HA, no administration
    
* Pay per hour for usage and bandwidth
    
* NATGW is created in a specific AZ, uses an Elastic IP
    
* Cannot be used by EC2 instance in the same subnet
    
* **Requires an IGW** (Private Subnet → NATGW → IGW)
    
* 5 Gbps of bandwidth with automatic scaling up to 100 Gbps
    
* No Security Groups to manage/required
    

## NAT Gateway with HA

* NAT Gateway is resilient within a single AZ
    
* Must **create multiple NAT Gateways** in multiple AZs for fault-tolerance
    

# VPC Peering

* You can create VPC Peeing connections between VPCs in different AWS accounts/regions
    
* You can reference a security group in a peered VPC (works cross accounts - same region)
    

# VPC Endpoints (AWS PrivateLink)

* Every AWS service is publicly exposed (public URL)
    
* VPC Endpoints (powered by AWS PrivateLink) allows you to connect to AWS services using a private network instead of using the public internet
    

## Types of Endpoints

* Interface Endpoints (powered by PrivateLink)
    
    * Provisions an ENI (private IP address) as an entry point (must attach a Security Group)
        
    * Supports most AWS Services
        
    * $ per hour + $ per GB of data processed
        
* Gateway Endpoints
    
    * Provisions a gateway and must be used as a target in a route table (does not use security group)
        
    * Supports both **S3** and **DynamoDB**
        
    * Free
        

# AWS Site-to-Site VPN

* **Virtual Private Gateway (VGW)**
    
    * VPN concentrator on the AWS side of the VPN connection
        
    * VGW is created and attached to the VPC from which you want to create the Site-to-Site VPN connection
        
    * Possibility to customize the ASN (Autonomous System Number)
        
* **Customer Gateway (CGW)**
    
    * A software application or physical device on the customer side of the VPN connection
        

> Enable Route Propagation for the **VGW** in the route table that is accociated with subnets

## AWS VPN CloudHub

* Provide secure communication between multiple sites, if you have multiple VPN connections
    
* Low-cost hub-and-spoke model for primary or secondary network connectivity between different locations (VPN only)
    
* It’s a VPN connection so it goes over the public internet
    
* To set it up, connect multiple VPN connections on the same VGW, set dynamic routing, and configure route tables
    

# Direct Connect (DX)

* Provides a dedicated private connection from a remote network to VPC
    
* Supports both IPv4 and IPv6
    
* Use Cases:
    
    * Increase bandwidth throughput
        
    * More consistent network experience
        
    * Hybrid Environments (on-prem + cloud)
        

## Connection Types

* Dedicated Connections: 1 Gbps, 10 Gbps and 100 Gbps capacity
    
* Hosted Connections: 50 Mbps, 500 Mbps, to 10 Gbps
    
* Lead times are often longer than 1 month to establish a new connection
    

## Encryption

* Data in transit is not encrypted but is private
    
* AWS Direct Connect + VPN provides an IPsec-encrypted private connection
    
* Good for an extra level of security
    

> In case Direct Connect fails, you can set up a backup Direct Connect connection (expensive), or a Site-to-Site VPN connectio

# Transit Gateway

* For having transitive peering between thousands of VPC and on-prem connection
    
* Regional resources can work cross-region
    
* Supports IP Multicast
    

# Traffic Mirroring

* Allows to capture and inspect network traffic in VPC
    
* Route the traffic to security appliances
    
* Capture the traffic
    
    * From (Source)
        
    * To (Targets)
        

# Egress Only Internet Gateway

* Used for IPv6 only (similar to a NAT Gateway but for IPv6)
    
* Must update the **Route Tables**