Cloud Networking Concepts
Cloud Networking Concepts
🎯 Exam Objectives
Track your learning progress! Click each objective as you master it:
- Understand network flow and data flow diagrams
- Differentiate Site-to-Site and Point-to-Site VPN designs
- Configure SSH key-based authentication for cloud VMs
- Compare IPsec Transport and Tunnel modes
- Evaluate dedicated connections vs. public Internet
🗺️ 7.1 & 7.2 Networking Concepts & Diagrams
Cloud networking shares many similarities with traditional physical networking. Traffic flows along predetermined paths, and virtualized versions of standard components (load balancers, routers, firewalls, VLANs) enable administrators to maintain control.
Network Flow Diagrams
These diagrams visualize how data moves through network infrastructure, including internal/external nodes, devices, and cloud services. They are critical for:
🔒 7.3, 7.4 & 7.5 VPN Concepts & Designs
Connecting on-premises networks to the cloud requires high-capacity, highly available, and secure connections. Unencrypted IP-based traffic is vulnerable to packet sniffing. VPN tunneling protocols encrypt traffic before it leaves the source and decrypt it at the destination.
Common Tunneling Protocols
Encapsulation protocol that encrypts any type of application layer protocol. Commonly used with VPN solutions and operates at the Network layer.
Protected remote administration protocol, common to Linux and macOS, but also available for Windows. Provides encrypted command-line access.
A common VPN protocol that relies on IPsec for the actual encryption of the tunneled data.
Open source with very strong security, though it can be slightly slower than hardware-accelerated alternatives.
A legacy protocol that should be avoided due to known, critical security vulnerabilities.
VPN Architectures
Tunneled connections between two sites
- Headquarters to branch office (intranet)
- Private data center to private data center (private cloud)
- Private data center to one or more public cloud service providers (hybrid cloud)
Remote access VPN (Point-to-Point)
Connects a single end-user workstation to an on-premises business network or the cloud.
- At-home workstation to private data center
- At-home workstation to public cloud services
- Work-from-the-road laptop to private data center or CSP
🔑 7.6 & 7.7 Secure Shell (SSH)
SSH provides an encrypted tunnel offering command-line access to remote servers. It provides end-to-end protection for administrator passwords, confidential business information, and file transfers as traffic traverses the public Internet to the cloud VPC.
Key-Based Authentication Process
Modern SSH relies on asymmetric key pairs (public/private) rather than passwords, mitigating brute-force and guessing attacks.
🛡️ 7.8 IPsec Security
Unlike Application-layer encryption (which requires both ends to support the same app-level encryption), IPsec operates at the Network layer of the TCP/IP stack. All data must pass through this layer, meaning applications never know encryption is happening, eliminating compatibility problems.
📦 Transport Mode
- Original header is not encrypted
- Only the payload is encrypted
- Offers small bandwidth savings
- Typically used for host-to-host connections
🚇 Tunnel Mode
- The entire packet is encrypted (header + payload)
- Consumes more bandwidth
- Typically used for router-to-router or gateway-to-gateway connections
🚄 7.9 Dedicated Connections
Relying on the public Internet for commercial cloud connectivity introduces concerns regarding speed, reliability, security, and lack of direct support. Dedicated connections resolve these by establishing a private, direct link between the business's internal network and the CSP's environment.
⚠️ Public Internet Concerns
- Variable speed and high latency
- Unpredictable reliability
- Exposure to public security threats
- Lack of direct, SLA-backed support
✅ Dedicated Connection Benefits
- Low latency and improved performance
- SLA-based support from the CSP
- Increased security and control
- Layer 2 or Layer 3 integration
- Higher, guaranteed capacity