Hi all, welcome to this lecture.
This is essentially the last lecture of this section,
so we are going to summarize what we saw
and we will also talk about the important thing
you need to remember for your exam.
So we started with,
how to map your physical network to virtual network,
how the lands and the routers
relate to the network inside VPC.
Then we saw the VPC and its components,
the placement of VPC in region
and how VPC spans across multiple Availability Zones.
Then we started with how to address the VPC
using the CIDR notation.
And then we saw the significance of a prefix,
how does it resolve the bits
for your network addressing and rest of the bits
are used for the host addressing inside the VPC.
Then we saw how the VPC can be subdivided
into a smaller networks in the form of subnets.
And then VPC has a default main route table,
but you can create a custom route table
and then attach those route tables to subnet
so that you can take a better control over which traffic
and how the traffic should be routed inside your subnets.
We also saw that we need to have Internet Gateway attached
to our VPC so that it can communicate with the internet.
So Internet Gateway has to be created
and then attached to your VPC.
Then we saw different type of IP addresses,
we started with IPv4 and IPv6 addresses,
and then we also saw private, public
and elastic IP addresses
and what are the differences between those.
We also saw how EC2 instance get IP address,
that is using the elastic network interface,
and then we saw a couple of features
of elastic network Interface,
as in, it depends on your EC2 instance type,
how many network interfaces you can attach.
And also every network interface
comes with one or more secondary private IP addresses
as well as elastic IP addresses,
so that's what we saw in this section.
Later then we moved to firewalls,
and inside VPC, we saw two kinds of firewalls,
security groups and network ACLs.
And we saw the placement of these two firewalls,
and the differences between
the two importantly security group works
at instance-level and network ACLs works at subnet level.
security groups are stateful, network ACLs are stateless.
Security group can only have the allowed rules
and the network ACL can have both allow and deny rules.
And then we also saw how the traffic
can be restricted using the network ACL.
That means you can block certain IP addresses,
which cannot be done using the security group.
Then we actually set up the labs where we created VPC
and public subnet and then private subnet,
and we saw how to reach to the instance in a public subnet,
and from there you can reach
to the instance in private subnet.
Also, we saw that private EC2 instances
cannot access the internet,
and the solution to that was NAT,
so we understood how the NAT functionality works
and then AWS provides a managed NAT service
in the form of NAT Gateway.
And then we created a NAT Gateway
and modified the route tables,
for your private subnets to direct the traffic
from those subnets to the internet via NAT Gateways.
In certain cases, you might need NAT
as a your own EC2 instance.
And we saw you need to take care of certain things,
like for example,
you have to disable the source destination check.
Otherwise EC2 instance only accepts the traffic
where the destination address is its own IP address,
so we have to disable that setting.
So in short, these are the very basic things about the VPC
and you should be very well aware of all this concept
so that you can choose a right answer during your exam.
With respect to the exam essentials,
quick recap again, for VPC and the subnet,
the maximum size of CIDR could be /16,
and which allows you to create two raised 16,
that is 65536 IP addresses inside the VPC.
Similarly for subnets and VPC, the minimum size is /28,
which means two raised to four,
that is 16 IP addresses can be allocated,
but those 16s are not usable of course,
five IP addresses are unused in any given range,
first four IP addresses
and the last IP addresses is reserved
and you cannot allocate that to EC2 instance.
Now subnet is associated with Availability Zone,
that means one subnet
cannot span across multiple Availability Zone,
however, one AZ can have multiple subnet.
And we saw that in logical diagram as well.
Now, all subnets by default follow
the VPCs main route table.
That's what we saw, we started with,
but good idea is to have
the dedicated route table for your subnets
and then you modify the routes there
rather than modifying the main route table.
All the route tables have a default local routes,
which is for which the destination address
again the VPC CIDR, which allows the communication
between all the subnets within the same VPC.
And whether you have the main route table
or custom route table, this local route will always be there
and you cannot remove that.
That means by default at a network layer,
at least all EC2 instances within a VPC
can communicate with each other
irrespective of, in which subnets they are created.
So additionally, you need to know few more things,
for example, if you want to block the IP address,
you can't do that with security group,
you have to do that with network ACL deny rule.
Security groups are stateful,
you'd no need to have explicitly outbound rule
for incoming return traffic, right.
And in case of network ACL, they are stateless.
That means for return traffic as well,
you need to open the outbound rule
and typically it will be open for if few middle port range,
and that's what we had seen.
Now NAT Gateways or NAT Instance,
must be created in public subnet,
and they are highly available within the same AZ.
That means if you need to have NAT Gateways
to be resilient to AZ failure,
you need to have multiple NAT Gateways across those Azs.
NAT Gateways does not have security groups,
and hence that traffic can only be controlled
using the network ACL, which works at subnet level.
You don't get access to underline NAT Gateway machine,
it's completely managed by AWS.
So NAT Instance is a kind of replacement
and it may be a cost effective solution,
but it is not as performant and as resilient as NAT Gateway
because NAT Gateway is completely managed service.
And remember for NAT Instance,
you have to disable the source destination check
at that EC2 instance-level.
So essentially these are the important thing you need
to remember for the exam from this section,
and with that, we will end this section
and now we'll get into the advanced VPC concept.
So thanks for staying during this lecture,
and I hope you understood what we covered in this lecture.
So thank you for watching.