Ok.
Ok, let me switch the screen.
Ok.
Ok, so today,
Hello everyone. It’s Mark again.
So today I want to talk about
some networking technologies,
to let you understand some
of the tips when you are preparing for the
technical skills.
As I’m specialized in networking,
my focus will be on networking.
But I think the same principles
apply to other services as well.
Ok.
As for my agenda,
first I will quickly talk about the basic pre-requisites for people
applying for networking jobs
Next we will
discuss some of our Amazon VPC technical concepts.
At the top-right corner of each
topic, there is a QR Code
for you to scan. If you are interested in the topic
and want to find out more about it,
you can scan the QR Code on the top-right corner to
access more information.
When you see this slide,
do you feel overwhelmed?
If you want to interview for a networking job,
do you need to understand every protocol?
Actually not.
Just like what we said earlier,
what we need is… of course if
you know everything, it’s a plus.
But if you have in-depth knowledge
in a certain technical domain or
if you have solved many issues in this domain,
we also like
this kind of interviewees.
Some might ask whether
Amazon services actually use
so many protocols.
I can actually give some examples.
Take Layer 1 for example,
there is a service called Direct Connect.
This service is used to interconnect
the clients’ data centers.
There is an actual physical fiber
line linking to the Amazon cloud.
You can think of it like the clients’ data center is
directly linked to the cloud
and you can visit it directly.
When dealing this kind of issue,
we actually need to know how to
measure and interpret the fiber optic signal.
For the fiber optic configuration,
do they match on both ends?
If it is not correct, we may
not be able to establish a link.
Let’s take it to the next level,
to VLAN.
After establishing the fiber optic,
you need to verify whether the
VLANs on both ends match.
After verifying VLAN,
we may need to check BGP, because
after the line is established,
you need to use the BGP protocol to communicate the routing.
And for routing, we also
need to cover routing priority.
So you need to know how to
set up and determine
the routing priority, and how to decide on the
packets and routing configuration.
Let’s proceed with the cloud.
Many cloud clients use NAT Gateway, and it is similar
to the conventional channel NAT.
So if a client has an issue with the NAT today,
due to NAT’s inherent restrictions
related to TCP/IP,
you will need to have knowledge
in TCP/IP when you
want to solve the issue.
Finally on the highest level, when
you want to host a website,
you may need an ELB
for load balancing.
Load balancing supports both HTTP and HTTPS, so when
you are solving issues for clients,
you will need to understand the differences between HTTP and HTTPS,
and their technical details.
The first tip is that
if you are to apply for any
of the profiles under our
Cloud Support Engineers,
I’d suggest that you take a look
at the services provided by AWS for this profile, and what
protocols are used, so that you can
prepare for these protocols.
If you happen to have relevant knowledge in them,
it is excellent.
If not, you can prepare yourself.
As our interviews actually
focus on the protocols
that our Amazon services use.
For example,
if you are interviewing for a profile under DB,
as we provide an RDS service such as MySQL,
you probably need to understand how MySQL works, or maybe
how to operate it.
Ok.
Let’s start with VPC.
VPC is a virtual network.
Simply put, it means that you can create your own
private network on Amazon.
You can put Amazon EC2 in it.
EC2 is actually an
instance of a virtual machine.
On the virtual machine,
you can add your own OS.
This virtual network is similar to
the ones established in an actual
physical network or the kind in a data center.
So we must also ensure that
you can set up an IP Address,
and set up a subnet, and
then you can set up routing rules,
and even firewall rules.
Take one of our client cases
for example.
Our client probably has a service on the ground that they
want to migrate to the cloud.
As a result, they would
come talk to our Support Engineers.
And we will provide them with the best practice for network planning,
or we can provide them with timely
assistance if they have any
issue during the migration.
Ok, then
when you create a VPC,
in addition to the EC2 we mentioned,
you can also add various services in it.
These services will be located in the VPC,
in the isolated subnet.
They can talk to each other.
Nobody else can access them.
Ok.
Next let’s look at
Region.
Region is like a geographical region.
In AWS Cloud,
you can set your machine, such as
a website service, to be located in
several locations around the world.
Each location is like a Region.
We name each Region after
where it is located.
For example, we have a Region called London,
and another Region called North California.
One is in the US, and the other is in Europe.
A code is used for each Region.
For example, London is eu-west-2.
And
North California is us-west-1.
When a client is deciding
on which Region to choose,
the main considerations are that,
first of all, you need to think about the access delay.
Secondly, it’s the regulations.
Some European clients may need to comply with certain regulations,
so they need to put the data centers in Europe.
Ok, here you can see the Console.
How do we choose Region on Amazon’s Console?
It’s very easy.
You can see there is a drop-down menu on the right.
Here you can see a variety of Regions on Amazon.
Just with one click,
you can create the resources you want in that Region, such as
creating an EC2.
You can set up a website there.
Ok, in every Availability Region,
oh sorry, in every Region, there are also the
Availability Zones, and they are
mainly used for high availability.
It is what we call “HA”.
Because if you
put your service in only
one Availability Zone, and if this
Availability Zone is affected by
an accident, such as tornados,
lightning, flood, earthquakes, or
an irregularity in the data center,
and you don’t have another data center you can switch to.
So we actually want to let them
know about the Availability Zones. We suggest that the clients put
their data in 2 Availability Zones.
As for the Availability Zones,
every Region has its own independent Availability Zones.
They are marked with 1a or 1b
after the Region Code.
How do you divide networks within a VPC?
In a VPC…
In a VPC, you can see on the right side,
we give each subnet in a
VPC an IP CIDR.
With this IP CIDR, you can divide the
network blocks for each subnet.
Later on when you are making a Route Table
or creating firewall rules,
you can make quick
designations, such as for 10.0.0.0/24, where
you want to route the traffic.
This is our VPC Console.
It’s easy to launch a subnet.
You can see
on the right hand side. You only need to enter your CIDR,
and on the right side,
it’ll tell you the available IP
addresses for this CIDR.
No need for binary calculations.
Ok, then how to direct the traffic out?
or how to communicate with a route table?
Actually we can create a route table for
each of the VPC subnet.
You can designate an IP CIDR
for this route table to direct it
to one of our networked appliances
You can see from here that it is
the Console for setting up our route table.
For example,
I can direct my 10.0.0.0/16 to
the Internet Gateway.
What is an Internet Gateway?
The Internet Gateway means that,
if the client wants to create a VPC, and you want the
VPC to connect to the Internet,
and to access the, for example,
your Web Server via BMI
on the Internet, or
you want to retrieve some webpages or to download
some new software,
you will need to create a Internet Gateway.
An Internet Gateway is hosted by our Amazon.
It can be enabled with one click.
So our client can enable the
Internet Gateway with one click.
It is a horizontally scaled and
highly available VPC component.
As part of its purpose, when you
enable the Internet Gateway,
if your EC2 traffic flows out of the Internet Gateway,
we will automatically add the
external IP for this EC2 for you.
So people on the Internet
will actually see your
Public IP moving outbound to access your,
for example, remote server.
They will not see your private IP.
Because other people can’t login back to your private IP.
If I want to restrict, like
if I want my EC2 to only
have outbound connections, but
I don’t want others to access me.
Why is there a such demand?
It’s because we know that
if there is an EC2, an instance, or
a virtual machine on the Internet,
then it would have a Public IP.
If you allow people to access it,
first of all, you will be faced with a lot of web crawlers.
Secondly, many malicious attackers
will try to scan for any open ports
and find out about your services,
so that they can infiltrate or attack them.
So if your demand today is
simply that you want to connect
to Internet and download some webpages, we’d
suggest that you use NAT.
For NAT, Amazon provides
something called NAT Gateway.
Just as what we said,
it has exactly the same functions as the conventional NAT.
It is also managed by us.
So with this NAT creation process and
the network scheme on the right,
I’d like to conclude on what
we’ve just mentioned.
In a VPC, there is a subnet,
and there is NAT. On the left,
it’s the NAT creation screen.
You can see that it’s actually
very simple.
You only need to decide the subnet,
and the IP you want to allocate.
On the right,
you can see it is actually the planning of
a typical NAT and a subnet for a web server.
Below
you have a private subnet,
and you have a public subnet.
In the private subnet below,
you usually put something with a Private IP,
such as Database Servers.
These servers don’t need to be accessed by external parties,
but they may need to download some webpages,
so they will use the Route Table, such as the
Main Route Table on the bottom-right corner,
and based on the Route Table, it will allocate
0.0.0.0/0 to the
Internet.
So basically, except for 10.0.0.0/16, you need to go through
NAT Gateway for other addresses.
And the NAT Gateway will be on the public subnet.
Its outbound connections will go through the NAT Gateway.
You can see on the left there are some web servers.
They are the web servers that are facing the real users.
They have their own elastic IPs,
namely external IPs.
Other people can access
these external IPs via the Internet Gateway.
Ok then
I don’t know if you are still following me. So I’m
going to have a simple Q&A.
So in the below section,
if you’ve already signed up,
you should be able to enter your
messages in the chat window.
I want everyone to participate.
First, if you want to create an
application for users in Europe,
in which Region should you establish it?
Alright, let me take a look.
London.
That’s correct, eu-west-2.
Excellent.
Next one.
What do a and b mean in
eu-west-2a and eu-west-2b?
OK, AZ backup. That’s right.
Last one.
If I want to let the instance
of EC2 in my private subnet to
connect to the Internet, but
I don’t want other people on the
Internet to access this EC2, which
network appliance should I use?
A, B, C, or D?
C? Correct. Good.
Great. Lastly I want to talk about
ELB and Route 53.
Allow me to explain. Actually,
in addition to AZ that can be used as a backup,
if you want to create a web server
or any services in a VPC,
we would also suggest that
our client can use
Elastic Load Balancing, which can
be the only port to the outside.
When traffic comes in, it can be distributed to
several machines on the back end.
For the management of machines,
you can also use Auto Scaling Group.
Auto Scaling Group means that
it can automatically scale up and
down the machines based on workload
to increase or decrease capacity.
Why increase or decrease capacity?
Let’s use a general service for example,
the time for its peak and
lowest traffic every day is
actually almost the same.
For example, if it’s a game service,
its peak traffic hours are usually
after 6pm every day, and then
decrease after 12am.
So during these hours, you can do a predictive scale,
and after midnight, you can
scale down the instance.
You don’t need to waste the idle instances, and
reduce your costs.
I want to talk about another
interview tip here.
Take load balancing for example.
For load balancing, if you scan the QR Code
on the top-right corner, you’ll see that
there are currently four types of load balancing.
The QR Code will take you to a table,
which will explain each type
of load balancing in details.
For example,
We have network load balancing,
application load balancing,
and gateway load balancing, etc.
It explains each type of load balancing,
their individual functions, and
their characteristics.
I actually suggest that when
you are preparing for an interview,
and you actually
don’t know what to prepare for the protocols,
such as what
we just mentioned earlier,
we actually listed something like TCP or HTTP,
but you think they are too broad,
you want something more in-depth,
you want a specific direction,
I’d suggest that you take a look.
Let’s take ELB for example.
In the table I just mentioned,
you can see that, for example,
ALB supports SNI,
or supports WebSocket,
or supports HTTP2.
NLB might support ALPN in TLS.
You can expect this to be the interview question that we may ask.
Because when we are solving,
for example, ELB issues for the clients,
you are expected to know the relevant knowledge.
Like you need to know what SNI is, and how does it work?
You need to know how WebSocket works, as well as the
common issues for troubleshooting.
You need to know that, if you
are interviewing for network ELB,
the most common failure may be
HTTP 500 or 400 errors.
What are the possible reasons for
each 500 or 400 error code?
I actually suggest that you need to prepare
for the interview based on the
service you are applying for, and
take a look at its official page,
to find out about the protocols
that it uses, and the functions or
more in-depth technical skills.
And then you can figure out
whether you need to improve yourself in these skills.
Ok, lastly, as for Route 53,
Route 53 is a DNS web service
hosted by AWS.
It offers Domain Name Registration,
as well as DNS routing.
It’s also used for health checks.
Two common routing examples:
The first one is called
failover.
For example, you have two resources:
primary and backup ones, and you
maintain health checks on them.
When there is failure in resource A,
or failure in the primary resource,
Route 53 will automatically switch to resource B,
namely the backup resource, and
switch back upon health recovery.
This is one type. And another type of routing
is based on geolocation.
We can automatically detect
the geolocation of the clients, and
provide them with your setting.
For example, for users from Taiwan accessing
an EC2 in Singapore or Tokyo, you
show the Traditional Chinese page.
For users from Europe or the US,
you provide the English page.
This is the function.
Ok.
So this is my
brief introduction.
I hope everyone can have some basic
understanding about the VPC.