AWS Compute - Peering Connections

VPC peering is non-transitive, means if vpc A advertises it's route to vpc B, it is exclusive. thus if there is a vpc C, and it request the info of vpc A route from vpc B, it is not possible to do so. (cause that's called a hub - all connected with vpc B as middle man).

so in order for all of them to be connected, they can try to do a fully meshed vpc peering like the pic below:

now this looks simple because it only involves 3 vpcs, what if it scales up? let's say 10 vpcs? how many peer networks need to be established?? the answer is using the formula: n x (n -1 /2). so for the case of 10 vpcs: 10 x (10-1/2) = 10 x 4.5 = 45. total of 45 networks need to be established! so if 100 vpcs, it would not be able to scale gracefully.

So there is one more solution called: Hub and Spoke but it has it's limitations such that only the hub can be connected to all spoke but the spokes cannot connect to other spokes. this is useful in business terms. See pic below and see if you can figure it out:

but let's say you're a company, and in your company, there are different departments, and they want to talk to each other, so you use CloudHub or Transit Gateway (or in early days, they call it route reflector that they use in IBGP to break the rules).

Difference between CloudHub and Transit Gateway is that CloudHub uses VPN (vpn is not private) but Transit Gateway uses private lines or combo of private line and VPN. both of these systems can break the rules of non-transitive peering. 

For Peer Connections using 1 account (by right must between 2 different accounts, but for example purpose, we will use 1 account only)

Step 1: Create 2 VPC myvpc-1 (11.0.0.0/16) and myvpc-2 (10.0.0.0/16) and its required components like subnet, Route Tables, IGW etc. (You can create VPC by using VPC with all its components option).

Step 2: Create an EC2 instance in each VPC and provide SG as all traffic and public IP addresses.

Step 3: Connect to any EC2 instance and try to ping the private IP address of other EC2 instances. You will not be able to ping because both instances are in different VPC.

Step 4: Select Peering connection using VPC left panel's options.

Step 5: Click on Create Peering connection

Step 6: Provide below configuration for your peering connection

• Name: myvpc-peer-to-yourvpc
• Requestor: Your VPC
• Acceptor: Other VPC, in real life, you will need their VPC ID and some other IDs

Step 7: Select Action and Click on Accept

Step 8: Update Route tables of each VPC by adding source as other VPC CIDR Range and connection type is peering connection.

Step 9: Now EC2 instances can ping to each other

AWS Networking & Content Delivery - VPC creating public and private subnet

VPC is region-wise, by default you can create max 5 VPC. Range of IP Address are defined for each VPC.

CIDR Range: Range of IP address in a network.
Example
CIDR:- 192.168.0.0/16
Because we are using /16 so 192.168 will be constant whereas other octates can be changed from 0-255 which means it has 256x256 = 65536 IP Addresses.

Valid IP Address in this Range
192.168.10.20, 192.168.200.10,192.168.2.0/24, 192.168.3.10/21

Invalid IP in the above CIDR
192.168.10.278, 192.169.0.0/24

Reserved IP Addresses in a network
These reserve IP addresses can not be used for EC2 instances:
1. Network IP
2. Broadcast IP
3. Future use IP


Lab

Create a VPC

1. Search for VPC service
2. Click on Your VPC Link
3. Click Create VPC button
4. On this Page define properties related to VPC

Select VPC only option
Name: irfan-vpc
IPV4 CIDR: 10.10.0.0/16
Tenancy : Default

5. Click on Create VPC button

Create Subnets (By Default no subnet get created in the VPC)

1. Click on Subnets link
2. Click on Create subnet

--------------------------------------------------------------------------
3. Set following properties for Public Subnet

• VPC ID: irfan-vpc
• Subnet Name: irfan-public-subnet-2a
• Availability Zone: 2a
• CIDR: 10.10.1.0/24

4. Click on Create Subnet
----------------------------------------------------------------------------------------
5. Set following properties for Private subnet

• VPC ID: irfan-vpc
• Subnet Name: irfan-private-subnet-2b
• Availability Zone: 2b
• CIDR: 10.10.2.0/24

6. Click on Create Subnet

Create an Internet Gateway to provide Internet connectivity to Public subnet

1. Click on Internet Gateways

2. Name: IGW1

• Click on Create Internet Gateway

3. Select Internet Gateway IGW1 and Action--->Attach to VPC and select myvpc-1

Now Internet connectivity is available to myvpc-1 VPC.


Create Route Tables (A default Route table get created for VPC)

1. Click on Route Tables link

2. Click on Create Route table button

--------------------------------------------------------------------------------------------
3. Set the properties

• Name: Public Route
• VPC: irfan-vpc

4. Click on Create Route table button

-----------------------------------------------------------------------------------------------
5. Set the properties

• Name: Private Route
• VPC: irfan-vpc

6. Click on Create Route Table

Attach subnets to Route tables

1. Select Public Route

2. Select Subnet Associations

3. Click on Edit subnet associations and select Public Subnet 1-a

4. Click on Routes --> Edit Routes--> Add Route

5. Destination: 0.0.0.0/0

6. Target: IGW1

7. click on Save Changes button.

---------------------------------------------------------------------------------------------

1. Select Private Route

2. Select Subnet Associations

3. Click on Edit subnet associations and select Private subnet 1-b




Create EC2 instance in irfan-vpc

1. Create a Public EC2 instance Amazon Linux Image

2. Select VPC as irfan-vpc

3. Select subnet as Public Subnet 1-a

4. Auto assign Public IP: Enable

5. Create new Security Groups for SSH let's call it sshSG.

--------------------------------------------------------------------------------------------

1. Create a Private EC2 instance Amazon Linux Image

2. Select VPC as myvpc-1

3. Select subnet as Private Subnet 1-b

4. Auto assign Public IP: Disable

5. Select sshSG security group

Experiment

1. Private IP addresses are in the defined range of subnets or not.

Ans: yes

2. Both instances can ping to each other with private ip address.

Ans: no UNLESS you add the security group - ICMP:IPV4 !!!

Now if you want to connect to the private subnet,

you need to connect to it via the public subnet:

1. copy the key-pair info (.pem)

2. create the key-pair info into your public subnet:

    vi IrfanSydney.pem

    copy the content over

    save :wq!

3. go to the private instance and click connect, choose via ssh, then it will tell you the steps:

    chmod 400 IrfanSydney.pem

    ssh -i "IrfanSydney.pem" ec2-user@10.10.2.184