Black Belt Tips makes a comeback for the sixth consecutive year. How you used the AWS platform last year should be different to how you utilise it today. In this session we will review the new networking features like Amazon VPC sharing and AWS Transit Gateway. Learn how to architect shared networks, hybrid connectivity, and have network observability at scale. Take your Cloud Operations to the next level with the curated set of tips and network perspective in mind.

1. S U M M I T
SYDNEY

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Black belt tips for cloud network
operations
Evgeny Vaganov
Solutions Architect
Amazon Web Services

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Select difficulty level:
Basic
Normal
Hard
Black Belt

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Select difficulty level:
Basic
Normal
Hard
Black Belt

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Networking baseline
• Different protocols: IP,
TCP/UDP/ICMP
• DNS and basic routing
• Tuple – used to refer to a
“number set” of things.
• A TCP connection is identified
by a 5-tuple.
TCP/IP Packet
IPHeaderTCP

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Private subnetPrivate subnet
Public subnetPublic subnet
Edge Location
VPC
AWS Region
Availability Zone A
Auto Scaling group
Availability Zone B
Auto Scaling group
NAT Gateway NAT Gateway
Instance Instance
Instances Instances
Internet
gateway
You should already know about AWS

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS networking beyond one VPC
Shared Services VPC
VPC VPC VPC VPC
VPC VPC VPC VPCVPCVPCVPCVPCVPCVPCVPCVPC
VPCVPCVPCVPCVPCVPCVPCVPC
VPCVPCVPCVPCVPCVPCVPCVPC
VPCVPCVPCVPCVPCVPCVPCVPC
VPCVPCVPCVPCVPCVPCVPCVPC
VPCVPCVPCVPCVPCVPCVPCVPC
VPC
VPC
VPC
VPC
VPC
VPC

8. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Access application!
Accessing your application is not this straightforward
Intro to cloud networking

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Local ISP Network A B C D E F
It can take many networks to reach the application
Paths to and from the application may differ
Each hop impacts performance and can introduce risk
Intro to cloud networking

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Intro to cloud networking
Private Public

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Introducing AWS Global Accelerator
1

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Network
Edge Location
Local ISP
Leverage the Global AWS Network
Resulting in improved performance
166 Points of Presence
In 65 cities across 29 countries
Amazon
CloudFront
AWS Global
Accelerator
Introducing AWS Global Accelerator

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Static anycast IP addresses
1.2.3.4
2.3.4.5
3.4.5.6

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Static anycast IP addresses
1.2.3.4
2.3.4.5
3.4.5.6

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Static anycast IP addresses
1.2.3.4
2.3.4.5
3.4.5.6
Cache
192.0.2.1

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Global Accelerator
192.0.2.1
192.0.2.1
192.0.2.1

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Global Accelerator

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Compartmentalisation AKA fault isolation
192.0.2.0/24
Network Zone A
198.51.100.0/24
Network Zone B
Anycast BGP
announcements

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Optimal endpoint selection
5 tuple
Protocol: UDP/TCP
Src IP: 1.2.3.4 Dest IP: 5.6.7.8
Src Port: 32759 Dest Port: 80
Region : us-east-1
Region : eu-west-1
Optimal region
Hash (5 tuple)

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Optimal endpoint selection: Client affinity
5 tuple
Protocol: UDP/TCP
Src IP: 1.2.3.4 Dest IP: 5.6.7.8
Src Port: 32759 Dest Port: 80
Region : us-east-1
Region : eu-west-1
Optimal region
Hash (2 tuple)

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Comparison
AWS Global Accelerator Amazon CloudFront
Supported protocols Any TCP & UDP HTTP/HTTPS
Deployed in Edge
Locations
Yes Yes
Caching of static content,
TLS termination,
Lambda@Edge
No Yes
Anycast IP address Yes No
AWS WAF integration No Yes
Target support EIP, ELB Any public IP, S3

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Summary
www.example.com
3.3.3.3
AWS Global
Accelerator
Endpoint A Endpoint B
1. Helps create a more robust architecture
2. Increases network stability
3. Provides automatic health checking and
routing
AWS
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
X

24. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Critical criteria for the Cloud Network

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Critical criteria for the Cloud Network
AWS Transit Gateway
Easily scale connectivity across VPCs,
accounts and on-premises networks

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
VPN connectionCustomer gateway Amazon VPC Amazon VPC
AWS Direct Connect Gateway
VPC peering
VPC peering VPC peering
Amazon VPC Amazon VPCVPC peering
VPN connection
VPN connection
VPC peering
Before AWS Transit Gateway

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
With AWS Transit Gateway
Transit
Gateway
Amazon VPCAmazon VPC
Amazon VPCAmazon VPC
Customer
gateway
VPN
connection
AWS Direct
Connect Gateway*
Available Q2 2019

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Critical criteria for the Cloud Network

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Critical criteria for the Cloud Network
VPC sharing
Easily share VPC networks between AWS accounts,
providing central oversight and control for
networking engineers

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
VPC sharing
Avoid creating a single large VPC and sharing it with an entire
organization. Instead, use VPC sharing together with Transit
Gateway and AWS Private Link

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Before Amazon VPC sharing
VPC
Infra Prod Acc
Finance Prod Acc
Ops Prod Acc
VPC
VPC VPC
10.1.0.0/16 10.2.0.0/16
10.4.0.0/1610.3.0.0/16
Digital Prod Acc
Dev1 Dev2
UAT STG
VPC VPC
VPC VPC
Instances
Amazon Redshift AWS lambdaELB
Instances Amazon RDS

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
After Amazon VPC sharing
VPC
Infra Prod Acc
Finance Prod Acc
Ops Prod Acc
VPC
10.1.0.0/16 10.2.0.0/16
Digital Prod Acc
Dev1 Dev2
UAT STG
VPC
Instances
Amazon Redshift AWS lambdaELB
Instances Amazon RDS
Participant Participant
ParticipantOwner Owner
Owner
Participant
Participant

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Inline services
Inside the account
At the VPC
Advanced architecture considerations
Account Account
Account Account
VPN
AWS Direct
Connect *
Route
Tables
Route
Tables
Transit Gateway
Account Account
Account
Available Q2 2019
Transit Gateway
http://tiny.cc/aws-sdwan
IKEv2

36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
100.64.0.0/16
Outbound VPC
SNAT
SNAT
Outbound services VPC
Transit Gateway
VPC Route Domain
10.1.0.0/16 10.2.0.0/16
Outbound Route Domain
Spoke route table Outbound VPC route table
VPC A VPC B
ECMP
VPN
BGP advertisement
Route Destination
10.2.0.0/16 Local
0.0.0.0/0 tgw-xxxxxxxxx
Route Destination
100.64.0.0/16 Local
10.0.0.0/8 tgw-xxxxxxxxx
0.0.0.0/0 igw-xxxxxxxxx
BGP prefix Next hop
0.0.0.0/0 Local IP
0.0.0.0/0 Outbound VPC VPN 10.1.0.0/16 vpc-att-a
10.2.0.0/16 vpc-att-b
Apply SNAT
outbound to the
internet
SNAT
Use cases:

37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
http://bit.ly/fortinet-tgw

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
http://bit.ly/paloalto-tgw

39. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Summary

40. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

41. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Network debugging within Amazon VPC
AWS Systems Manager
SSM
Automation
AWSSupport-SetupIPMonitoringFromVPC
VPC
Amazon
CloudWatch
Logs
Amazon
CloudWatch
Dashboard
http://bit.ly/net-debug

42. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Network debugging within Amazon VPC
VPC Corporate data center
http://bit.ly/net-debug

43. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon CloudWatch Log Insights
Amazon
CloudWatch
Logs
VPC Flow
logs
AWS CloudTrail
Amazon Route 53
AWS Lambda
Custom Logs
Amazon
CloudWatch
Logs Insights
Users

44. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

45. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Evgeny Vaganov
evgeny@amazon.com