AWS-VPC-1

-

OSI (Open System Interconnection) Model

There are 7 Layers:

  1. Application Layer - http request and so on
  2. Presentation Layer
  3. Session Layer
  4. Transport Layer - wrap data to be a segment/datagram, there is one example in the load balancer
  5. Network Layer - wrap data to be a package to transfer
  6. Data Link Layer - wrap data to be a frame to transfer
  7. Physical Layer - communication by using bit unit

TCP/IP (default protocol in this course, the most famous protocol suite)

  1. Using TCP (Transmission Control Protocol) in the Transport Layer. In this layer, UDP also is a famous protocol we are using.
  2. Using IP (Internet Protocol) in the Network Layer., in this layer, ICMP also is a famous protocol we are using, which is like we are typing `ping` in cmd.

IP Address

  1. `ipconfig`, check your IP information, like IP address.
  2. LAN/WAN (local area network, wide area network), the private IP address is existing in LAN, and the public IP address is existing in WAN.
  3. Only the public IP address is able to communicate with and be accessed by public internet.
  4. *Each IP address is a potential security risk.

House LAN IP Diagram


    IPv6 and IPv4

    1. IPv6: 8, segments, and each segment consist of 4 hex digits.
      • for example: 
        • 2001:0db8:85a3:0000:0000:8a2e:0370:7334
        • 2001:  db8:85a3:      0:      0:8a2e:  370:7334 // the 0s at the front could be removed, each segment should at least has one hex digit
        • 2001:  db8:85a3         ::        8a2e:  370:7334 // continue 0s could be replaced by ::
      • IPv6 could be disabled in AWS configuration, but IPv4 cannot
    2. IPv4: skip

    Region and Availability Zone

    1. Region is an independent existence (geographical span), there are so many regions existed in AWS.
    2. Each region has at least two availability zones.
    3. AZs are connected by the low latency network, also could be understood as geographical span, but smaller.
    4. Regions are connected by reserved bandwidth provided by internet service providers.

    VPC (Virtual Private Cloud) and Subnet

    VPC

    1. VPC is your own virtual data center, each VPC is independent of outside.
    2. Each vpc has to be assigned to a Region, and it could across multiple availability zones, but it cannot across multiple regions.
    3. When creating a new VPC, we need to assign a CIDR to it, and it should be between 28 ~ 16.

    Subnet

    1. Logically, separating different small chunk of areas from VPC, each of them we called subnet.
    2. Each of subnets from VPC has to be assigned to an availability zone. (Thinking: each VPC has to be assigned to a Region, in this region, there are many availability zones. The subnet is one part of separate chunks, each part should work properly so that it should be assigned to an integral infrastructure, that is availability zone.)
    3. When creating a new subnet from VPC, we need to assign a CIDR to it, and it should be distinguished with others, each CIDR for subnet also should between 28 ~ 16.
    Because of AWS reserve the front 4 bits and last 1 bit IP, so that the CIDR should be between 28 ~ 16. The front 4 bits is for AWS itself's requirements and the last 1 bits is for broadcasting IP address.

    CIDR (Classless Inter-Domain Routing)

    1. IPv4, 4 segments/32 bits (be consist of 4 segments, each segment is consist of 8 bits so that total there are 32 bits).
    2. CIDR block, counting from the left side, blocking the number of bits (unavailable to use).
    3. Overlap, left close, right open. (172.12.16.0/20, and 172.12.32.0/20, they are not overlapped, because of the range of {1} is [16, 32), and the range of {2} is [32, 48). )

    Rout Table and Routing

    1. In each VPC, there is an implicit Router existed which user can use it by configuring the Routing Table.
    2. Each time the user creates a new VPC, the system will automatically generate the main routing table. This main routing table will be the default route table assigned to this VPC's new subnet.
    3. Each main route table for VPC cannot be removed directly, because each VPC has to have the main route table. If need, user should create a new routing table and set it as the new main routing table for the VPC, and then it is legal to remove the old main routing table (at this time, the old routing table will be normal routing table, because the "main" already be assigned to the other routing table).
    4. Each subnet will be assigned only one route table, but each route table could be assigned to multiple subnets.
    5. The VPC CIDR will default exist in all routing tables (In each route table, based on CIDR there is one routing path named "local" related to the VPC CIDR. If there are multiple CIDRs, then for each VPC CIDR, there is one "local" be configured for.).
    6. IPv4 and IPv6 routing paths are separated, independently. 
    7. Priority is based on CIDR, the CIDR range more specific, the higher priority.

    Internet Gateway and NAT Gateway

    Internet Gateway

    Existed in VPC, for communicating with the public internet, it is two-way bindings (inbound and outbound).

    NAT (Network Address Translation) Gateway

    In the NAT device, there is a public IP address. For the hosts placed in the private subnet if they want to connect public internet, they need to access to NAT gateway, then connect to the internet gateway for outside access (Private IP address translate to Public IP address). It is single-binding (outbound), because, there is no way to access to internal service, only can send the request to outside.

    For the usage of personal or small-scale company, it is better to use NAT instance (actually it is an EC2 virtual machine which purpose is for internet address translation) instead of using NAT gateway for avoiding high-cost. (If do this, please uncheck the "source destination check")

    Public Subnet and Private Subnet

    1. In the public subnet, all of the hosts have their own public IP address and private IP address.
    2. In the private subnet, all of the hosts only have their own private IP address, but they don't have their public IP address.

    Elastic IP Address


    1. Elastic IP address is a static public IPv4 address which is bounded to user's AWS account.
    2. User can associate an elastic IP address to an EC2 instance or ENI (Elastic Network Interface).
    3. Generally, assign the elastic IP address to a stable instance, like NAT instance, load balancer, tec.
    4. User can use their own IP pool, BYOIP; or use AWS IP pool, Amazon pool to assign the elastic IP address. (Different to BYOIP, the elastic IP address comes from AWS IP pool is not for free, but if the user satisfied with three scenarios, a. the elastic IP associated to an EC2 instance, b. the EC2 instance is running, c. there is only one elastic IP address associated with the EC2 instance, the use of IP addresses).

    Connect to your VPC

    VPN (Virtual Private Network)

    1. In each VPN connection, between the data center and VPC, there are two tunnels which applied encrypt protocol. 
    2. At the AWS VPC endpoint, the tunnel connected to VPG (Virtual Private Gateway), and at the Customer endpoint, the tunnel connected to CG (Customer Gateway).
    3. Set up fast, and cheep.

    DX (Direct Connect)


    1. Reserve customer's own connection channel from the internet service partner. 
    2. At the AWS VPC endpoint, the connection connected to VPG (Virtual Private Gateway), but for the customer endpoint, because of the customer is connecting the AWS DX partner, the AWS DX partner will provide a customer router to directly connect to customer router. Between AWS DX location and AWS VPC endpoint, the connection connected to Direct Connect Endpoint from AWS DX location through Private Virtual Interface. Not only able to connect VPG but the DCG also able to connect to AWS services and resources through Public Virtual Interface. Through the private virtual interface, AWS DX endpoint also connects DCG (Direct Connect Gateway) which is able to connect multiple VPCs
    3. Set up slow and expensive, but speed fast and stable.

    Redundancy

    1. Active VPN + Active VPN
      VPC only need one VPN, but if internet failure, then both of VPNs won't work because of both of customer endpoints connected to the same virtual private gateway.
    2. Active DX + Active DX
      The company uses different devices to setup two DX, but both of them connected to the same virtual private gateway.
    3. Active DX + Axtive VPN
      The company set up DX to make sure that all of the data transmission goes through DX with high priority, but if DX got a failure, then switch to VPN to keep connection available.

    Comments

    Post a Comment

    Popular posts from this blog

    Union Find 模板

    -
    Union Find Union Find Union Find 动态的计算联通块问题 结构 global variables constructor() find(int x) union(int a, int b) 模板 (Map) global variables private Map<Integer, Integer> f; constructor() UnionFind(int n) { this.f = new HashMap<Integer, Integer>(); for (int i = 0; i < n; i++) { f.put(i, i); } } find(int x) int find(int x) { int root = x; // 找到“根” while (f.get(root) != root) { root = f.get(root); } // 拆“整”为“零”，把每个元素直接接到“根”上 while (root != x) { int nx = f.get(x); f.put(x, root); x = nx; } return root; } union(int a, int b) void union(int a, int b) { int rA = find(a); int rB = find(b); if (rA != rB) { f.put(rB, rA); } } 例题 Friend Circles 根据模板添加额外的全局变量，比如此题需要count，在每次合并的时候 count-- ，在初始化的时候或者写一个 setter 和 getter 去给 count 赋值和取值 public class Solution { class UnionFind { private int count; private Map...
    Read more

    Tree的经典题

    -
    Tree的经典题 Tree的经典题 找第k小 Kth Smallest Element in a BST 在树上就不需要使用Heap了，因为inorder traversal本身就是一个从小到大的序列，这里我们有几种方法 1. Recursive traversal 创建全局变量，记录traverse到哪儿了，当走到k的时候把值赋给result即可 时间复杂度 O(n) public class Solution { //设置全局变量 private int count = 0; private int result = 0; public int kthSmallest(TreeNode root, int k) { traversal(root, k); return result; } private void traversal(TreeNode root, int k) { if (root == null) { return; } traversal(root.left, k); //如果count等于k的时候才把结果赋给result //注意count从0开始，所以count先++之后再判断 count++; if (count == k) { result = root.val; } traversal(root.right, k); } } 2. Quick Select on Tree 首先要traverse计算每个点到它的时候子树总共有多少个点，然后用quick select，如果大于k，直接去左边找，如果小于k，判断当左边的个数加1正好等于k，那么这个k就落在root上，如果加1之后还小于k那么就要去向右边找了，因为此时左边没有第k个点。 时间复杂度 O(n) 最好最坏都是 public class Solution { public int kthSmal...
    Read more

    Tree DFS

    -
    Tree DFS Tree DFS Tree上的DFS分为两种（Divide Conquer + Traversal和纯Divide Conquer） 建立当前/用全局变量（根据不同的方式） root 为 空 （ 返回 什么/ 更新 指针） 左 节点和 右 节点 都 为 空 ，用 root 构建 当前 解（ 返回 什么/ 更新 指针） 左 节点和 右 节点 不 为 空 ，用 左右 构建 当前 解 返回 当前 /选择 左 ， 右 ， 中 Divide Conquer + Traversal 不同 一般 没有 全局变量， 创建当前 变量作为当前最终解 通过 左 节点的最终解和 右 节点的最终解， 计算 并更新 当前 变量 判断 左 节点的最终解， 右 节点的最终解， 当前 变量，在三个解中 选择 一个 作为当前层的最终解 返回 更新传入的参数指针 （ 有时会单独建立 class Result 类 ） 流程 建立 当前 变量（不一定第一步） root 为 空 （ 返回 什么） left 节点和 right 节点 都 为 空 ，用 root 构建 当前 解（ 返回 什么/ 更新 指针） left 节点和 right 节点 不 为 空 ，用 左右 解 leftResult , rightResult 计算 当前 解 选择 符合的解 比较 （ leftResult ， rightResult ， result ） + 选出 合适的解 直接使用 ：当前解 使用 选中的解 返回 更新 传入的指针 例题（Minimum Subtree） public class Solution { class Result { TreeNode minSubtree; int minSum; int sum; Result(TreeNode minSubtree, int minSum, int sum) { this.minSubtree = minSubtree; this...
    Read more