In this session, we walk through the fundamentals of connectivity with AWS. First, we cover build-out and design fundamentals for VPCs, including picking your IP space, subnetting, routing, security, NAT, and much more. We then transition to different approaches and use cases for connecting your physical data center to AWS. This mid-level architecture discussion is aimed at architects, network administrators, and technology decision makers interested in understanding the building blocks.

1. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Evgeny Vaganov - AWS Solutions Architect
Network & Connectivity Fundamentals
3rd July 2019

2. Introductory – 200
“These sessions provide an overview of AWS services
and features, and they assume that attendees are new
to the topic. These sessions highlight basic use cases,
features, functions, and benefits."

4. Default VPC
172.31.0.128
172.31.0.129
172.31.1.24
172.31.1.27
54.4.5.6
54.2.3.4
Amazon Virtual Private Cloud (Amazon VPC)
Subnet in availability zone
(AZ) 1
Subnet in availability zone
(AZ) 2
/16 IPv4 CIDR block
(172.31.0.0/16).
/20 default subnet
Connected Internet
Gateway
Security Group (SG)
Network Access Control
List (NACL)

5. VPC concepts & fundamentals

6. IP
addressing
Creating
subnets
Routing in a
VPC
Security
VPC concepts & fundamentals
DNS in-VPC with
Amazon Route 53

7. Choosing an IP address range

8. Choosing an IP address range for your VPC
172.31.0.0/16
Recommended:
RFC1918 range
Recommended:
/16
(65,536 addresses)
Avoid ranges that overlap with
other networks to which you
might connect

9. Creating subnets in a VPC

10. VPC subnets and Availability Zones
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
172.31.0.0/24 172.31.1.0/24 172.31.2.0/24
ap-southeast-2a ap-southeast-2b ap-southeast-2c

11. IPv6 in your VPC
• Can have a dual-stack VPC by adding an IPv6 CIDR
• Fixed sizes for VPC and subnets:
• /56 VPC (4,722,366,482,869,645,213,696 addresses)
• /64 subnets (18,446,744,073,709,551,616 addresses)

12. VPC subnets and Availability Zones
172.31.0.0/16
Availability Zone Availability Zone Availability Zone
VPC subnet VPC subnet VPC subnet
172.31.0.0/24 172.31.1.0/24 172.31.2.0/24
2600:1f16:14d:6300::/56
2600:1f16:14d:6300::/64 2600:1f16:14d:6301::/64 2600:1f16:14d:6302::/64
ap-southeast-2a ap-southeast-2b ap-southeast-2c

13. Routing in a VPC

14. Routing in your VPC
• Route tables contain rules for which packets go where
• Your VPC has a default route table
• But, you can create and assign different route tables to different
subnets

15. Traffic destined for my VPC
stays in my VPC

16. DNS in a VPC

17. VPC DNS options
Use Amazon DNS server
Have EC2 auto-assign DNS
host names to instances

18. Amazon Route 53 private hosted zones
Private Hosted
Zone
example.demohostedzone.org 
172.31.0.99

19. Amazon Route 53 Resolver for hybrid clouds
Route 53 Resolver
endpoints
Conditional forwarding
rules

20. Network security
Flow logsNetwork access
control list
Security groups

21. Network security
Flow logsNetwork access
control list
Security groups

22. “MyWebServers” security group
“MyBackends” security group
Allow only “MyWebServers”
Security groups follow application structure

23. Security groups example: Web servers
Allow HTTP traffic from
anywhere

24. Security groups example: Backends
Allow application traffic
from web servers only

25. Network security
Flow logsNetwork access
control list
Security groups

26. Security groups vs. NACLs
Security group Network ACL
Operates at instance level Operates at subnet level
Supports allow rules only Supports allow and deny rules
Is stateful: return traffic is automatically allowed
regardless of any rules
Is stateless: return traffic must be explicitly
allowed by rules
All rules evaluated before deciding whether to
allow traffic
Rules evaluated in order when deciding whether
to allow traffic
Applies only to instances explicitly associated
with the security group
Automatically applies to all instances launched
into associated subnets
Doesn’t filter traffic to or from link-local addresses (169.254.0.0/16) or AWS-reserved IPv4 addresses;
these are the first four IPv4 addresses of the subnet (including the Amazon VPC DNS server)

27. Network security
Flow logsNetwork access
control list
Security groups

28. VPC flow logs
AZ 2AZ 1
• Visibility
• Troubleshooting
• Analyze traffic
Amazon S3 Amazon CloudWatch

29. VPC flow logs: Setup
VPC traffic metadata
captured in Amazon S3
or Amazon CloudWatch Logs

30. VPC flow logs format

31. Connectivity options for VPCs

32. Internet
connectivity or
not
Connecting to
other VPCs
Connecting to your
on-premises network
Connecting your VPC

33. Internet connectivity or not

34. Internet
gateway
Destination Target
10.0.1.0/24 local
0.0.0.0/0 igw_id
Inbound internet
access
198.51.100.3
Destination Target
10.0.2.0/24 local

35. Internet
gateway
Outbound internet
access
NAT
gateway
198.51.100.4
Destination Target
10.0.1.0/24 local
0.0.0.0/0 igw_id
Destination Target
10.0.2.0/24 local
0.0.0.0/0 Nat_gateway
_id
198.51.100.3

36. Demo

37. Connecting to other VPCs
VPC Peering Transit
Gateway

38. Connecting to other VPCs
VPC Peering Transit
Gateway

39. VPC peering
• Full private IP connectivity
between two VPCs
• Can peer VPCs across regions
• VPCs can be in different
accounts
• VPC CIDR ranges must not
overlap

40. Establish a VPC peering: Initiate request
Step 1
Initiate peering
request
172.31.0.0/16 10.55.0.0/16

41. Establish a VPC peering: Accept request
Step 1
Initiate peering
request
Step 2
Accept peering
request
172.31.0.0/16 10.55.0.0/16

42. Establish a VPC peering: Create a route
Step 1
Initiate peering
request
Step 2
Accept peering
request
Step 3
172.31.0.0/16 10.55.0.0/16
Traffic destined for the peered VPC
should go to the peering

43. Connecting to other VPCs
VPC Peering Transit
Gateway
and beyond

44. VPN connectionCustomer gateway Amazon VPC Amazon VPC
AWS Direct Connect Gateway
VPC peering
VPC peering VPC peering
Amazon VPC Amazon VPCVPC peering
VPN connection
VPN connection
VPC peering
Before Transit Gateway …

45. With Transit Gateway …
Transit
Gateway
Amazon VPCAmazon VPC
Amazon VPCAmazon VPC
Customer
gateway
VPN
connection
AWS Direct
Connect Gateway

46. Connecting to on-premises
networks:
AWS VPN
AWS
Direct Connect

47. AWS VPN basics
customer
gateway
CGW
virtual
private
gateway
VGW
Two IPSec tunnels192.168.0.0/16 172.31.0.0/16
192.168/16
Your networking device
VPN connection

48. AWS Direct Connect basics
AWS Direct Connect location
Customer or
partner cage AWS cage
Customer network
192.168.0.0/16
AWS services
172.31.0.0/16
VGW
Private virtual
interface
Public virtual
interface