Amazon Virtual Private Cloud (VPC) enables you to launch Amazon Web Services (AWS) resources, like EC2 instances, into a virtual network that you’ve defined. They are flexible, secure and a core building block of AWS deployments. Eric has configured over 1,000 Amazon VPC configurations, ranging from simple to complex implementations for Fortune 100 companies. In this webinar, he shares his hard-won lessons: - How do packets really flow in a VPC? - Common security group mis-configurations - Why end-points are good things - To NAT or not? - VPNs and VPCs: a good thing? - Best practices You won’t find these lessons anywhere else! The video recording associated with these slides is located here: https://www.youtube.com/watch?v=62QidMP816I Try a 30-day free trial of SoftNAS Cloud on AWS - http://www.softnas.com/tryaws Visit http://www.softnas.com for more information

1. WhatWe Learned From 1,000 AmazonWeb
Services (AWS)VPC Configurations
EricOlson
Sr. Director Engineering
SoftNAS

2. Introducing
2
Eric Olson
Sr. Director Engineering
SoftNAS

3. Housekeeping
3
Post your questions here
This session IS being recorded
Links to the recording and presentations will be provided later
To listen using your telephone select the
‘Telephone’ option. For local numbers
click the ‘additional numbers’ link.
You will need to use the Access Code
and Audio PIN.
The audio for this webinar
is available over VoIP. Just
select the use ‘Mic &
Speakers’ option to listen
to the webinar through
your computers speakers.
If you CAN NOT hear us,
please check your volume
settings.
Webinar Audio

4. Get My $100 AWS Credit!
4
First 100 attendees to register
(URL announced later)

5. Agenda
© 2015 SoftNAS LLC 5
• SoftNAS Overview
• What is aVirtual Private Cloud (VPC)?
• Lessons Learned
• How SoftNAS Fits intoVPC’s
• SoftNAS HA in aVPC (Demo)
• Q&A

6. SoftNAS Overview
© 2015 SoftNAS LLC

7. © 2015 SoftNAS LLC 7
Who is SoftNAS?
• Powerful enterprise-class storage products
for public, private and hybrid clouds
• Easy to try, buy, learn and use –
rapid time to value
• Freedom from platform lock-in
– Works with most popular cloud
computing platforms
• Amazon EC2®,VMware vSphere®, Microsoft®
Azure™, CenturyLink Cloud®
We believe in powerful, hassle-free storage

8. © 2015 SoftNAS LLC 8
The SoftNAS Mission
• Public
• Private
• Hybrid
To be the fabric for business data across all clouds

9. SoftNAS Products
© 2015 SoftNAS LLC 9
SoftNAS Cloud
• Amazon Web Services (AWS)
• Microsoft Azure
• VMware vCloud Air
• CenturyLink Cloud
Public cloud NAS filer
SoftNAS Cloud File Gateway
• VMware vSphere
On-premise cloud NAS filer
SoftNAS Object Filer
• VMware vSphere
Software-defined NAS for object storage
SoftNAS for Service Providers
• VMware vSphere
Multi-tenant NAS replacement for use
with iSCSI and object storage

10. BrandsYou KnowTrust SoftNAS

11. AmazonVPCs
© 2015 SoftNAS LLC

12. © 2015 SoftNAS LLC 12
What is aVirtual Private Cloud (VPC)?
• A virtual network dedicated to your AWS environment
• Logically isolated from other virtual networks in the AWS cloud
• A location for launchingAWS resources, such as Amazon EC2 instances,
• Highly configurable virtual private server
– Set IP address range
– Create subnets
– Configure route tables
– Define network gateways
– Configure security settings

13. © 2015 SoftNAS LLC 13
What is aVirtual Private Cloud?
• Control
– IP address ranges, how routing works.VPN access, subnet architecture
• Security
– Security Groups and ACL’s as well as routing rules
• Features
– Multiple NIC interfaces, static private IP’s,T2 instances only inVPC
• Hybrid Cloud
– Direct Connect can be leveraged to extend premise into AWS cloud
• Networking Advantages
– VPC peering – within your organization or to others
– Endpoint flow logs help with troubleshooting

14. © 2015 SoftNAS LLC 14
VPCTopology
• AVPC is used in a single region but is multi-AZ
• Each subnet lives in a singleAZ
• All subnets can route to each other by default
• Network size can be set between a /16- /28 forVPC CIDR
• Choose your IP prefix

15. Accessing theVPC
© 2015 SoftNAS LLC 15
• Gateways
– Internet Gateway (IGW): ingress and egress Internet access
– Virtual Private Gateway (VPG): AWS side ofVPN connection
– Customer Gateway (CG): customer side of aVPN connection
• VPNs
– Direct Connect
• Dedicated bandwidth toVPC
– Hardware basedVPN
• On-premise to AWS over Internet
• MajorVPN vendors supported

16. © 2015 SoftNAS LLC 16
AWSVPC Packet Flow
VPC
Router
Subnet 1
10.0.0.0/24
Subnet 2
10.0.1.0/24
Subnet 3
10.0.2.0/24
Elastic
network
interface
Instance
B
Instance
A Instance
C
10.0.0.197
10.0.0.211 10.0.1.99
10.0.2.176

17. © 2015 SoftNAS LLC 17
AWSVPC Packet Flow
Subnet 1 – 10.0.0.0/24
Instance A
10.0.0.197
Instance B
10.0.0.211
RoutingTable
ARPTable
Firewall Outbound Firewall Outbound
Source / Dest Check
Security Group Outbound
Source / Dest Check
Security Group Inbound

18. © 2015 SoftNAS LLC 18
AWSVPC Packet Flow
Instance B – 10.0.0.211 / 10.0.1.99
Subnet 1
Instance C – 10.0.2.176
Subnet 3Subnet 2
IP Routing Policy DB
RteTbl 1 RteTbl 2
Firewall Outbound
Src/Dst Check
Sec Group Out
RouteTable
Net ACL Out
Src/Dst Check
Sec Group Out
RouteTable
Net ACL Out
Firewall Inbound
Src/Dst Check
Sec Group In
Net ACL In

19. Lessons Learned
© 2015 SoftNAS LLC

20. 1) OrganizeYour AWS Environment
© 2015 SoftNAS LLC 20
• Use tagging (you will thank me later)
• Plan your CIDR block carefully!!
– Go bigger – not smaller
– AWS reserves 5 IP addresses per subnet
– Avoid overlappingCIDR
– Save space for future expansion

21. 2) SubnetYourWay to Success
© 2015 SoftNAS LLC 21
• Control network properly
• What is going to be your subnet strategy?
• If your subnets are not associated to a specific route table then they are
associated to the main route
• Align subnets to tiers, if possible
– DMZ/Proxy, ELB, App, DB
• Everything in private subnet by default
– ELB filtering/monitoring in public
– Use NAT to gain access to public Networks
– VPC peering for access to otherVPC’s
– Endpoints for Access to services like S3

22. 3) ControlYour Access
© 2015 SoftNAS LLC 22
• Do not get lazy and point default route to Internet Gateway
• Use Redundant NAT instances- (size Properly)
– Some Cloud Formation templates exist to make this easier
• Use IAM for Access Control

23. How SoftNAS Fits intoVPC’s
© 2015 SoftNAS LLC

24. High-AvailabilityArchitecture
© 2015 SoftNAS LLC 24
• SNAP™ HA
– Provides high availability seamless failover across zones
– Leverages secure block replication with SoftNAS SnapReplicate
• Recommended: SNAP HA in high-availability mode = 99.999% uptime

25. Cross-Zone HA: AWS Elastic IP
© 2015 SoftNAS LLC 25

26. Cross-Zone HA: PrivateVirtual IP Addresses
© 2015 SoftNAS LLC 26

27. Common Mistakes
© 2015 SoftNAS LLC 27
• Both NIC’s need to be in the same subnet
• Security groups not open to allow ICMP health check
• No access to S3 either via NAT or endpoint
• For Private HA aVIP IP must not be in the CIDR of theVPC

28. Demo
SoftNAS HA in aVPC
© 2015 SoftNAS LLC

29. Earn $100 AWS Credit!
© 2015 SoftNAS LLC 29
First 100 attendees to register
bit.ly/softnas-amazon-credit

30. Next Steps
© 2015 SoftNAS LLC 30
• Learn More – bit.ly/softnas_aws
• SoftNASArchitecture on AWS
White Paper – bit.ly/softnas-aws-wp
• Contact Us – softnas.com/contact
• Follow Us – @SoftNAS
Try It!
softnas.com/tryaws

31. Questions?
© 2015 SoftNAS LLC

32. Thank you
© 2015 SoftNAS LLC