Network Components

🎯 Exam Objectives

🎯

Exam Objective 1.3: Explain cloud networking concepts.

Track your learning progress! Click each objective as you master it:

Understand virtual switches and VLAN tagging
Compare network segmentation topologies (Single, Peered, Hub-and-Spoke)
Explain microsegmentation and its three critical aspects
Differentiate static and dynamic routing tables
Understand BGP (eBGP vs. iBGP) and vNIC configurations

🔀 7.13 Virtual Switches

Switches function at Layer 2 of the OSI model, managing connectivity and forwarding traffic based on MAC addresses. In cloud environments, virtual switches are implemented in software within hypervisors.

💡 Key Capabilities: Virtual switches allow VMs on the same or different hosts to communicate as if they were on the same physical network. They integrate with physical switches using features like VLAN tagging (IEEE 802.1Q), port mirroring, and Quality of Service (QoS).

✂️ 7.14 Network Segmentation & Subnetting

Network segmentation isolates traffic to specific sections (e.g., development vs. production, or Finance vs. Engineering) to enhance security and performance. In TCP/IP networks, segments are identified by network IDs (e.g., 192.168.1.0/24).

Microsoft Fundamental Segmentation Designs

Single Virtual Network with Subnets

The basic design. Administrators manage a single virtual network with one or more subnets. Traffic is isolated to those networks unless otherwise configured. Ideal for simple departmental separation (e.g., "Finance" and "Engineering" subnets).

Multiple Virtual Networks Configured as Peers

A more complex, realistic scenario. Multiple virtual networks transparently pass information between each other. A vital use case is placing each virtual network in a different cloud region while maintaining seamless communication.

Hub-and-Spoke Topology

Multiple virtual networks exist across different regions. "Spoke" networks link to a central "Hub" network. Peering is enabled between hubs across regions. This offers massive scale in each region and structured cross-region communications.

🔬 7.15 Microsegmentation

While traditional segmentation isolates traffic at the network perimeter, microsegmentation applies segmentation at the workload/application level. Driven by Software-Defined Networking (SDN), it is policy-driven, flexible, and scalable.

Click on each critical aspect to learn more:

👁️

Visibility

🔍

Granularity

🔄

Dynamic

Visibility: The entire workflow of the application must be mapped and available for configuration, ensuring no blind spots in traffic flow.

Benefits of Microsegmentation

Reduced attack surface Increased containment of breaches Increased compliance Easier management via policies

Example: AWS Security Groups act as virtual firewalls controlling traffic in and out of individual instances based on membership.

🗺️ 7.16 Routing Tables

Routers operate at Layer 3, directing traffic to specific subnets based on the IP address network ID. While switches connect devices in the same segment, routers connect different segments.

📝 Static Routing Tables

Manually populated by administrators
Acceptable for small, basic, unchanging networks
Error-prone (typos, network changes)
Difficult to scale in dynamic cloud environments

⚡ Dynamic Routing Tables

Automatically generated and updated by routers
Easier to maintain and highly scalable
Necessary for large networks with changing segments
Susceptible to issues if inter-router communication is unreliable

🌐 7.17 Border Gateway Protocol (BGP)

BGP dynamically configures routers to exchange advertisements about supported routes. It selects the "best route" based on network policies, weight, path, and customizable values. It supports both IPv4 and IPv6.

🌍

External BGP (eBGP)

Routes traffic between different Autonomous Systems (AS), such as between an enterprise ISP and a cloud provider.

⟷

🏢

Internal BGP (iBGP)

Routes traffic within a single Autonomous System, large enterprise network, or cloud VPC.

☁️ Cloud Examples: Google Cloud Platform Cloud Router utilizes BGP to connect on-premises networks to VPCs, or to connect two VPCs within GCP. AWS and Azure offer similar dynamic routing capabilities.

🔌 7.18 Virtual Network Interface Cards (vNICs)

Virtual machines gain network access using vNICs. A vNIC connects the instance to the network and determines how it communicates with other resources.

vNIC Configuration Attributes

MAC Address Private IP & Subnet Mask IPv4 / IPv6 Support Optional Public IP Network Security Group (NSG) VPC Connectivity

Instance Type Limits (Example)

each other.

Instance Type	Max Network Interfaces	Private IPv4 per Interface	IPv6 per Interface
c3.2xlarge	4	15	15
c3.4xlarge	8	30	30
c3.8xlarge	8	30	30

* IPv6 limits are separate from IPv4 limits. Not all instance types support IPv6.

💡 Portability Use Case: In AWS, an Elastic Network Interface (ENI) can be detached from one instance and reattached to another, maintaining its configuration. A common use case is assigning a primary vNIC for public user traffic (e.g., website) and a secondary vNIC on a different network ID for secure administrator/developer management traffic.