The SoftNAS engineering and support teams have configured over 2,000 Amazon Virtual Private Cloud (VPC) configurations for SMBs to Fortune 500 companies. In this webinar, we share the lessons learned in configuring VPCs, including undocumented tips and tricks. Amazon’s Virtual Private Cloud enables you to launch Amazon Web Services (AWS) resources, like EC2 instances, into a virtual network that you’ve defined. They are flexible, secure and a core building block of AWS deployments. In this webinar, we covered: -How do packets really flow in a VPC? -Common security group mis-configurations -Why end-points are good things -To NAT or not? -VPNs and VPCs: a good thing? -Best practices for VPC management Learn more at https://www.softnas.com/aws

1. Lessons Learned from 2,000 Amazon
VPC Configurations
EricOlson
VP Engineering
SoftNAS
February 22, 2017

2. Agenda
© 2017 SoftNAS, Inc. 2
• What is aVirtual Private Cloud (VPC)?
• 10 Lessons Learned
• How SoftNAS UsesVPCs
• SoftNASCloud Overview
• Q&A

3. We’ve Configured Over 2,000 AmazonVPCs

4. © 2017 SoftNAS, Inc. 4
What is SoftNAS Cloud?
• Powerful enterprise-class storage products
for public, private and hybrid clouds
• Easy to use – rapid time to value
• Freedom from platform lock-in
– Works with most popular cloud
computing platforms
• Amazon EC2®,VMware vSphere®, Microsoft®
Azure™, CenturyLink Cloud®
We believe in powerful, hassle-free storage

5. AmazonVPCs
© 2017 SoftNAS, Inc.

6. 6
What is aVirtual Private Cloud (VPC)?
• A virtual network dedicated to your AWS environment
• Logically isolated from other virtual networks in the AWS cloud
• A location for launchingAWS resources, such as Amazon EC2 instances,
• Highly configurable virtual private network infrastructure
– Set IP address range
– Create subnets
– Configure route tables
– Define network gateways (VPN) (IGW)
– Configure security settings/ACL
© 2017 SoftNAS, Inc.

7. © 2017 SoftNAS, Inc. 7
What is aVirtual Private Cloud?
• Control
– IP address ranges, how routing works.VPN access, subnet architecture
• Security
– Security Groups and ACL’s as well as routing rules
• Features
– Multiple NIC interfaces, static private IP’s,T2/M4/C4 and other instances only in
VPC
• Hybrid Cloud
– Direct Connect can be leveraged to extend premise into AWS cloud
• Networking Advantages
– VPC peering – within your organization or to others
– Endpoint flow logs help with troubleshooting

8. © 2017 SoftNAS, Inc. 8
VPCTopology
• AVPC is used in a single region but can be multi-AZ
• Each subnet lives in a singleAZ
• All subnets can route to each other by default
• Network size can be set between a /16- /28 forVPC CIDR
• Choose your IP prefix

9. Accessing theVPC
© 2017 SoftNAS, Inc. 9
• Gateways
– Internet Gateway (IGW): ingress and egress Internet access
– Virtual Private Gateway (VPG):AWS side ofVPN connection
– Customer Gateway (CG): customer side of aVPN connection
• VPNs
– Direct Connect
• Dedicated bandwidth toVPC
– Hardware basedVPN
• On-premises toAWS over Internet
• MajorVPN vendors supported

10. © 2017 SoftNAS, Inc. 10
AWSVPC Packet Flow
VPC
Router
Subnet 1
10.0.0.0/24
Subnet 2
10.0.1.0/24
Subnet 3
10.0.2.0/24
Elastic
network
interface
Instance
B
Instance
A Instance
C
10.0.0.197
10.0.0.211 10.0.1.99
10.0.2.176

11. © 2017 SoftNAS, Inc. 11
AWSVPC Packet Flow
Subnet 1 – 10.0.0.0/24
Instance A
10.0.0.197
Instance B
10.0.0.211
RoutingTable
ARPTable
Firewall Outbound Firewall Outbound
Source / Dest Check
Security Group Outbound
Source / Dest Check
Security Group Inbound

12. © 2017 SoftNAS, Inc. 12
AWSVPC Packet Flow
Instance B – 10.0.0.211 / 10.0.1.99
Subnet 1
Instance C – 10.0.2.176
Subnet 3Subnet 2
IP Routing Policy DB
RteTbl 1 RteTbl 2
Firewall Outbound
Src/Dst Check
Sec Group Out
RouteTable
Net ACL Out
Src/Dst Check
Sec Group Out
RouteTable
Net ACL Out
Firewall Inbound
Src/Dst Check
Sec Group In
Net ACL In

13. 10 Lessons Learned
© 2017 SoftNAS, Inc.

14. OrganizeYour AWS Environment
© 2017 SoftNAS, Inc. 14
1. Use tagging (you will thank me later)
2. Plan your CIDR block carefully!!
– Go bigger – not smaller
– AWS reserves 5 IP addresses per subnet
– Avoid overlappingCIDR
– Save space for future expansion
– You can never Add more IP’s to

15. SubnetYourWay to Success
© 2017 SoftNAS, Inc. 15
3. Control network properly
4. Define your subnet strategy
5. If your subnets are not associated to a specific route table then they are
associated to the main route
6. Align subnets to tiers, if possible
– DMZ/Proxy, ELB, App, DB
7. Set subnet permissions to private by default for everything
– ELB filtering/monitoring in public
– Use NAT to gain access to public networks
– VPC peering for access to otherVPCs
– Endpoints for access to services like S3

16. ControlYour Access
© 2017 SoftNAS, Inc. 16
8. Do not set default route to Internet Gateway
9. Use redundant NAT instances (size properly)
– Some Cloud FormationTemplates exist to make this easier
10. Use IAM for access control
– IAM can now be installed on a running instance 
– Attach IAM role to existing EC2 instance

17. How SoftNAS UsesVPCs
© 2017 SoftNAS, Inc.

18. High-AvailabilityArchitecture
© 2017 SoftNAS, Inc. 18
• SNAP™ HA
– Provides high availability seamless failover across zones
– Leverages secure block replication with SoftNAS SnapReplicate
• Recommended: SNAP HA in high-availability mode = 99.999% uptime

19. Cross-Zone HA: AWS Elastic IP
© 2017 SoftNAS, Inc. 19

20. Cross-Zone HA: PrivateVirtual IP Addresses
© 2017 SoftNAS, Inc. 20

21. Common Mistakes
© 2017 SoftNAS, Inc. 21
• Need to deploy 2 ENI on each SoftNAS instance
• Both NIC’s need to be in the same subnet
• Security groups not open to allow ICMP health check
• No access to S3 either via NAT or endpoint
• For Private HA aVIP IP must not be in the CIDR of theVPC

22. SoftNAS Cloud Overview
© 2017 SoftNAS, Inc.

23. Flexible,AdaptableArchitecture
LinuxVirtual
Appliance
ARCHITECTURE INTEGRATION DATA SERVICES
• API and CLI
• Cross data center
• Cross-zone VPC
• Easy administration
• File gateway
• HTML5Admin UI
• Software filer
• ZFS on Linux
• AWS
• Azure
• CenturyLink cloud
• CIFS w/ Active directory
• FC SAN
• iSCSI LUN
• iSCSI SAN
• NFS
• S3 Objects
• SSD
• VMware vSphere
• Block replication
• Cloud disks
• Compression
• Inline deduplication
• Instant snapshots
• Multi-level caching
• Storage pools
• Thin provisioning
• Writable SnapClones™
• Encryption
© 2017 SoftNAS, Inc.

24. Technology Partners
© 2017 SoftNAS, Inc.

25. Earn $100 AWS Credit!
First 100 attendees to register
ter.li/gky7u1
© 2017 SoftNAS, Inc.

26. Try SoftNAS Cloud® Free for 30 Days onAWS
26
Learn More
softnas.com/aws
FreeTrial (30 Days)
softnas.com/tryaws
Contact Us
softnas.com/contact
Support
softnas.com/helpdesk
softnas.com/tryaws© 2017 SoftNAS, Inc.