Comprehending Cloud Networking
7
Comprehending Cloud Networking
Same routers, switches, and firewalls you already know — virtualized, layered with SDN, and stretched across on-premises and cloud. Second half of the module: what breaks, and how you find it.
$ ping web-server3
# hostname resolves, reply received
✓ connectivity · ✓ name resolution
$ traceroute www.comptia.org
# tracing route through 8 hops...
$
Cloud Networking Concepts
Traffic still flows along predetermined paths — the cloud just virtualizes the devices that manage it.
Network flow diagrams document
- Wired and wireless segments · Network boundaries (internal, external, DMZ) · Mitigation devices · Trusted/untrusted networks · Public/private cloud connections · Connected nodes
Used for compliance, security, troubleshooting, scaling, design, risk mitigation, and updates. A related data flow diagram tracks information through its lifecycle instead — creation, use, storage, destruction.
Securing the Connection
IP traffic is unencrypted by default and easy to intercept. VPN tunneling protocols fix that.
| Protocol | Notes |
|---|---|
| IPsec | Encrypts any application-layer protocol; common with VPNs |
| SSH | Protected remote administration, standard on Linux/macOS |
| L2TP/IPsec | Common VPN protocol, relies on IPsec for encryption |
| PPTP | Legacy — avoid, known vulnerabilities |
| OpenVPN | Open source, very strong security, slower |
SSH key-based authentication
ssh-keygen— generate a key pair on the clientssh-copy-id {vm}— send the public key to the remote VMssh {vm}— connect, no password prompt
Load Balancers & Firewalls
Two virtual devices that decide where traffic goes, and whether it's allowed to go there at all.
Distribution methods
- Round robin — sequential, ignores current load
- Static algorithm — evenly split; best for steady workloads
- Dynamic algorithm — least-busy server first; best for variable workloads
Stateful vs. stateless firewalls
| Stateful | Stateless | |
|---|---|---|
| Checks | Full TCP connection, traffic characteristics | Individual packets only |
| Speed | Slower, more thorough | Faster, better for high workloads |
Network Components
Switches connect devices; routers connect segments. Both get virtualized in the cloud.
| Component | OSI Layer | Uses |
|---|---|---|
| Switch | Layer 2 | MAC addresses |
| Router | Layer 3 | IP addresses / network ID |
Network segmentation designs (Azure)
- Single virtual network with subnets
- Multiple virtual networks as peers
- Multiple virtual networks in a hub-and-spoke topology
Static vs. dynamic routing tables
| Static | Dynamic | |
|---|---|---|
| Maintained by | Administrator, manually | Routers, automatically |
| Best for | Small, unchanging networks | Larger, changeable networks |
| Risk | Typos, hard to scale | Communication issues between routers |
Common routing protocols: OSPF, EIGRP, and BGP — which connects Autonomous Systems across the Internet (eBGP) or within large internal networks like a VPC (iBGP).
VLANs, SDN & Virtual Private Clouds
Software takes over the job physical wiring used to do.
| VLAN | VXLAN | |
|---|---|---|
| Segment limit | 4,094 | ~16 million |
| Header | Layer 2 tag | Layer 2 encapsulated in a Layer 3 UDP header |
Azure uses NVGRE, AWS uses VXLAN — incompatible with each other. GENEVE is the standard that bridges all three implementations for multi-cloud stretching.
Software-defined networking (SDN)
- Data plane — forwards and filters traffic (the compute level)
- Control plane — centralized, policy-based management, decoupled from individual devices
VPC design: hub-and-spoke
A central hub hosts shared services (identity, DNS); spoke networks attach to the hub, not to each other. Peering connects hub to each spoke — spokes are never peered directly.
NAT, Transit Gateways & CDNs
Address translation hides internal networks; transit gateways and CDNs move traffic efficiently once it's out.
Transit gateways connect
- VPCs · VPN-connected on-premises networks · Dedicated-connection networks · SD-WAN links
CDN benefits
- Reduced load delay and latency
- Increased scalability and load balancing
- Automatic failover / higher availability
- Better support for latency-intolerant apps
CDN caching locations are called points of presence (PoP). Examples: Azure CDN, GCP Cloud CDN, AWS CloudFront.
Name Resolution, DHCP & Time
Three quiet services that everything else depends on.
| Service | Job |
|---|---|
| DNS | Resolves names to IP addresses |
| DHCP | Dynamically assigns IP address configuration |
| NTP | Synchronizes device clocks |
DHCP lease — four steps
- Client sends
DHCPDiscover - Server sends
DHCPOffer - Client sends
DHCPRequest - Server sends
DHCPAck
The client always initiates the process — not the server.
Troubleshooting the Network
Ping and traceroute are still the first two tools you reach for — cloud or not.
Reading a ping response
| Result | Meaning |
|---|---|
| Reply received | Connection up, both directions working |
| Request timed out | Sent fine — likely a problem on the destination |
| Destination host unreachable | Couldn't even send — likely a problem on the source |
Common troubleshooting commands
| Command | Purpose |
|---|---|
ping / traceroute | Test connectivity and path |
nslookup / dig / host | Test name resolution |
ipconfig / ip addr | View IP address configuration |
route / ip route | View or edit the routing table |
ss / netstat | View current connections |
Wireshark / tcpdump | Capture and inspect packets |
| Nmap | Scan a network for devices and services |
HTTP status codes worth memorizing
Exam Keyword Flashcards
Tap a card to flip it.
Quick Self-Check
Four questions pulled straight from the module.