Network segmentation (for example, subnetting, IP addressing, connectivity among VPCs)

What is network segmentation and why is it important in an AWS environment?

Network segmentation is the practice of dividing a network into multiple subnetworks or segments, each acting as a smaller, distinct network. In an AWS environment, it increases security by limiting the attack surface, enables traffic management, reduces congestion, and provides a way to enforce compliance and control access. For example, sensitive data can reside on a separate subnet with restricted access.

Can you explain the concept of subnetting within an Amazon VPC and how it supports network segmentation?

Subnetting within an Amazon VPC involves dividing the VPC’s IP address range into smaller networks, each with its own CIDR block. This allows for segregation of resources based on factors like function, security requirements, or compliance needs. Subnetting also aids in controlling the flow of traffic, improving network management, and providing security through isolation of resources.

What is the purpose of Network Access Control Lists (NACLs) in the context of subnetting in AWS?

NACLs act as a firewall for subnets in an AWS VPC, controlling the inbound and outbound traffic at the subnet level. They are stateless, meaning they evaluate rules each way separately and provide an additional layer of security, ensuring that only allowed traffic can flow in and out of the subnets, aiding in network segmentation.

How can AWS Security Groups be used alongside NACLs to enhance network segmentation security?

AWS Security Groups are associated with individual EC2 instances and operate as stateful firewalls, tracking the state of connections. Security Groups complement NACLs by providing instance-level traffic filtering, allowing fine-grained control over the traffic to and from instances within a subnet. The combined use of Security Groups and NACLs provides a robust network segmentation and security mechanism.

Describe how IP addressing works within a subnet in AWS VPC and the significance of the reserved IP addresses.

Within an AWS VPC subnet, the IP addressing is defined by the subnet’s CIDR block. Each subnet reserves the first four IP addresses and the last one for AWS purposes, such as VPC router, DNS, future use, and network broadcast respectively. This means they are not available for assignment to instances and must be factored into subnet capacity planning.

When connecting multiple VPCs, what connectivity options does AWS provide, and which would you recommend for a highly available architecture?

AWS provides VPC Peering, AWS Transit Gateway, and VPN connections for inter-VPC connectivity. For a highly available architecture, AWS Transit Gateway is recommended as it allows transitive connectivity between thousands of VPCs and on-premises networks with redundancy and simplified network management.

What is the main difference between VPC Peering and AWS Transit Gateway?

The main difference is scalability and management complexity. VPC Peering is a one-to-one connection between two VPCs and becomes complex as the number of VPCs grows. AWS Transit Gateway provides a hub-and-spoke model allowing centralized management and scalable connectivity among multiple VPCs and external networks, simplifying network architecture.

How does subnetting facilitate efficient IP address utilization in a VPC?

Subnetting enables efficient IP address utilization by allowing network administrators to allocate IP space based on the number of hosts needed in each subnet, avoiding wastage of IP addresses. By tailoring the size of CIDR blocks to the subnet’s requirements, subnetting reduces unnecessary consumption of IP space and allows for more granular network management.

Explain the difference between public and private subnets in an AWS VPC and their typical use cases.

Public subnets have a route to the Internet via an Internet Gateway, suitable for resources that require direct internet access, like web servers. Private subnets do not have a direct route to the Internet and are used for resources that should not be directly exposed to the Internet, such as databases. Private subnets can access the Internet through a NAT Gateway or NAT instance for outbound traffic.

In AWS, what role does a Virtual Private Gateway (VGW) play in connecting your VPC to an on-premises network?

A VGW serves as the VPN concentrator on the AWS side of a VPN connection to an on-premises network. It provides a secure and private channel for data to travel between the VPC and the on-premises environment, facilitating the extension of on-premises networks into the cloud and supporting hybrid cloud architectures.

How would you implement a mechanism in AWS to prevent subnets in different VPCs from overlapping IP addresses when connecting them?

To prevent overlapping IP addresses, you would ensure unique non-overlapping CIDR blocks are assigned to each VPC before establishing connectivity. When using AWS Transit Gateway, you would also define the routing tables to avoid conflicts and ensure that resources communicate only within their intended routes, maintaining proper network segmentation.