Upload
softnas-inc
View
457
Download
0
Embed Size (px)
Citation preview
Lessons Learned from 2,000 Amazon VPC Configurations
Eric OlsonVP EngineeringSoftNASFebruary 22, 2017
2
Agenda
© 2017 SoftNAS, Inc.
• What is a Virtual Private Cloud (VPC)?• 10 Lessons Learned• How SoftNAS Uses VPCs• SoftNAS Cloud Overview• Q&A
We’ve Configured Over 2,000 Amazon VPCs
4© 2017 SoftNAS, Inc.
What is SoftNAS Cloud?
• Powerful enterprise-class storage products for public, private and hybrid clouds
• Easy to use – rapid time to value• Freedom from platform lock-in
– Works with most popular cloud computing platforms• Amazon EC2®, VMware vSphere®,
Microsoft® Azure™, CenturyLink Cloud®
We believe in powerful, hassle-free storage
Amazon VPCs
© 2017 SoftNAS, Inc.
6
What is a Virtual Private Cloud (VPC)?
• A virtual network dedicated to your AWS environment• Logically isolated from other virtual networks in the AWS
cloud • A location for launching AWS resources, such as Amazon
EC2 instances,• Highly configurable virtual private network infrastructure
– Set IP address range– Create subnets– Configure route tables– Define network gateways (VPN) (IGW)– Configure security settings/ACL© 2017 SoftNAS, Inc.
© 2017 SoftNAS, Inc. 7
What is a Virtual Private Cloud?• Control
– IP address ranges, how routing works. VPN access, subnet architecture • Security
– Security Groups and ACL’s as well as routing rules • Features
– Multiple NIC interfaces, static private IP’s, T2/M4/C4 and other instances only in VPC
• Hybrid Cloud – Direct Connect can be leveraged to extend premise into AWS cloud
• Networking Advantages – VPC peering – within your organization or to others– Endpoint flow logs help with troubleshooting
© 2017 SoftNAS, Inc. 8
VPC Topology
• A VPC is used in a single region but can be multi-AZ• Each subnet lives in a single AZ • All subnets can route to each other by default • Network size can be set between a /16- /28 for VPC CIDR • Choose your IP prefix
© 2017 SoftNAS, Inc. 9
Accessing the VPC• Gateways
– Internet Gateway (IGW): ingress and egress Internet access – Virtual Private Gateway (VPG): AWS side of VPN connection – Customer Gateway (CG): customer side of a VPN connection
• VPNs– Direct Connect
• Dedicated bandwidth to VPC – Hardware based VPN
• On-premises to AWS over Internet • Major VPN vendors supported
© 2017 SoftNAS, Inc. 10
AWS VPC Packet Flow
VPC
Router
Subnet 1
10.0.0.0/24
Subnet 2
10.0.1.0/24
Subnet 3
10.0.2.0/24
Elastic network interface
InstanceB
InstanceA
InstanceC
10.0.0.197
10.0.0.211
10.0.1.99
10.0.2.176
© 2017 SoftNAS, Inc. 11
AWS VPC Packet Flow
Subnet 1 – 10.0.0.0/24
Instance A10.0.0.197
Instance B10.0.0.211
Routing TableARP Table
Firewall Outbound Firewall Outbound
Source / Dest CheckSecurity Group
Outbound
Source / Dest CheckSecurity Group
Inbound
© 2017 SoftNAS, Inc. 12
AWS VPC Packet FlowInstance B – 10.0.0.211 / 10.0.1.99
Subnet 1
Instance C – 10.0.2.176
Subnet 3Subnet 2
IP Routing Policy DBRte Tbl 1 Rte Tbl 2
Firewall Outbound
Src/Dst CheckSec Group Out
Route TableNet ACL Out
Src/Dst CheckSec Group Out
Route TableNet ACL Out
Firewall Inbound
Src/Dst CheckSec Group InNet ACL In
10 Lessons Learned
© 2017 SoftNAS, Inc.
© 2017 SoftNAS, Inc. 14
Organize Your AWS Environment1. Use tagging (you will thank me later) 2. Plan your CIDR block carefully!!
– Go bigger – not smaller– AWS reserves 5 IP addresses per subnet – Avoid overlapping CIDR – Save space for future expansion – You can never Add more IP’s to
© 2017 SoftNAS, Inc. 15
Subnet Your Way to Success3. Control network properly 4. Define your subnet strategy5. If your subnets are not associated to a specific route table then
they are associated to the main route 6. Align subnets to tiers, if possible
– DMZ/Proxy, ELB, App, DB7. Set subnet permissions to private by default for everything
– ELB filtering/monitoring in public – Use NAT to gain access to public networks– VPC peering for access to other VPCs– Endpoints for access to services like S3
© 2017 SoftNAS, Inc. 16
Control Your Access8. Do not set default route to Internet Gateway9. Use redundant NAT instances (size properly)
– Some Cloud Formation Templates exist to make this easier10. Use IAM for access control
– IAM can now be installed on a running instance – Attach IAM role to existing EC2 instance
How SoftNAS Uses VPCs
© 2017 SoftNAS, Inc.
© 2017 SoftNAS, Inc. 18
High-Availability Architecture• SNAP™ HA
– Provides high availability seamless failover across zones– Leverages secure block replication with SoftNAS SnapReplicate
• Recommended: SNAP HA in high-availability mode = 99.999% uptime
© 2017 SoftNAS, Inc. 19
Cross-Zone HA: AWS Elastic IP
© 2017 SoftNAS, Inc. 20
Cross-Zone HA: Private Virtual IP Addresses
© 2017 SoftNAS, Inc. 21
Common Mistakes• Need to deploy 2 ENI on each SoftNAS instance• Both NIC’s need to be in the same subnet• Security groups not open to allow ICMP health check• No access to S3 either via NAT or endpoint• For Private HA a VIP IP must not be in the CIDR of the VPC
SoftNAS Cloud Overview
© 2017 SoftNAS, Inc.
Flexible, Adaptable Architecture
Linux Virtual Appliance
ARCHITECTURE INTEGRATION DATA SERVICES
• API and CLI• Cross data center• Cross-zone VPC• Easy
administration• File gateway• HTML5 Admin UI• Software filer• ZFS on Linux
• AWS• Azure• CenturyLink cloud• CIFS w/ Active
directory• FC SAN• iSCSI LUN• iSCSI SAN• NFS• S3 Objects• SSD• VMware vSphere
• Block replication• Cloud disks• Compression• Inline deduplication• Instant snapshots• Multi-level caching• Storage pools• Thin provisioning• Writable
SnapClones™• Encryption
© 2017 SoftNAS, Inc.
Technology Partners
© 2017 SoftNAS, Inc.
Earn $100 AWS Credit!
First 100 attendees to register
ter.li/gky7u1
© 2017 SoftNAS, Inc.
Try SoftNAS Cloud® Free for 30 Days on AWS
26
Learn More softnas.com/aws
Free Trial (30 Days)softnas.com/tryaws
Contact Us softnas.com/contact
Supportsoftnas.com/helpdesk
softnas.com/tryaws© 2017 SoftNAS, Inc.