Cloud networking: VPCs, gateways and NFV

Why this matters

Cloud networking is not a different subject. It is the same subnets, routing tables and firewalls you have already met, renamed and presented as an API instead of a rack.

That is the useful frame for this objective: every cloud construct maps onto something you know. A VPC is your address space. A subnet is a subnet. A security group is a stateful firewall attached to an instance. An internet gateway is the default route out. Learn the mapping and the vocabulary follows.

The lesson

Network functions virtualization (NFV)

NFV means running network functions — routers, firewalls, load balancers, WAN optimisers — as software on general-purpose hardware, instead of as dedicated appliances.

The consequences are what get examined. A virtual firewall can be deployed in minutes rather than procured in weeks, scaled by adding instances, templated so every site gets an identical build, and destroyed when a project ends. In the cloud it is the only option, because you own no hardware to rack.

The costs are real too: throughput now depends on the host's CPU and on whatever else is running there, and you have added a dependency on the hypervisor's own networking being correct.

NFV is frequently mentioned alongside SDN and they are not the same thing. NFV virtualises the function; SDN separates the control plane from the forwarding plane. They are complementary and often deployed together, but a question asking which one turns a hardware firewall into software wants NFV.

Virtual private cloud (VPC)

A VPC is your own logically isolated network inside a provider's shared infrastructure. You define the address range — usually an RFC 1918 block such as 10.0.0.0/16 — and carve subnets out of it exactly as you would on premises.

What you control inside a VPC:

• Subnets, typically one or more per availability zone.
• Route tables, which decide where traffic from each subnet goes.
• Gateways, which connect the VPC to anything outside it.
• Security controls, at both the subnet and the instance level.

The distinction that matters: a subnet is called public if its route table has a route to an internet gateway, and private if it does not. Nothing about the subnet itself differs — it is entirely a property of the routing. That catches people out, and it is a good exam question.

Plan the address range carefully, because it is painful to change later and it must not overlap with your on-premises networks if you ever intend to connect them. Overlapping address space is the single most common reason a hybrid connection cannot be made to work.

Network security groups and network security lists

Two layers of filtering, and the exam expects you to distinguish them.

A network security group (NSG) attaches to an instance or its network interface. It is stateful: allow traffic in, and the reply is automatically permitted without a matching outbound rule. Rules are normally allow-only, with an implicit deny for anything not listed. Because it sits at the instance, it protects a workload wherever that workload runs.

A network security list — also called a network ACL — attaches to a subnet. It is stateless: it evaluates every packet independently, so return traffic needs its own explicit rule. It supports both allow and deny rules and processes them in numbered order. Because it sits at the subnet boundary, it is a coarse perimeter around a group of instances.

The practical pattern is defence in depth: a broad ACL at the subnet and precise groups at the instances. And the practical bug, seen constantly, is a stateless ACL that permits inbound traffic and forgets the outbound reply, producing a connection that appears to hang rather than be refused.

Cloud gateways

A gateway connects the VPC to something outside it, and which one you need depends on the direction traffic must flow.

Internet gateway. Provides two-way connectivity between the VPC and the internet. Attaching one, plus a default route pointing at it, is what makes a subnet public. Instances also need a public address to be reachable inbound.

NAT gateway. Lets instances in a private subnet reach out to the internet — for patches, package repositories, API calls — while remaining unreachable from it. It performs source NAT, so outbound connections work and inbound ones have nothing to connect to.

That contrast is the examinable point, and the scenario is always the same shape. Database servers must download operating system updates but must never be reachable from the internet. The answer is a NAT gateway, not an internet gateway.

Cloud connectivity options

Three ways to join a cloud network to your own, in increasing order of cost and quality.

Site-to-site VPN. An IPsec tunnel from your firewall to the provider's VPN gateway, over the ordinary internet. Cheap, quick to establish, encrypted. The limitation is that the underlying path is the public internet, so bandwidth and latency are best-effort and can vary hour to hour.

Direct Connect (the generic term; each provider brands it differently) is a dedicated private circuit between your premises or colocation and the provider's network. It does not traverse the public internet at all.

Its advantages are the ones a question will describe: consistent, predictable latency, committed bandwidth, and often lower data-transfer charges at volume. Its costs are a lead time measured in weeks and a monthly circuit charge.

A subtlety worth carrying: a dedicated circuit is private, not encrypted. It is not shared with other customers, but if your compliance regime requires encryption in transit you still run IPsec over it. A question offering Direct Connect as an encryption control is testing that.

The common production pattern is both: Direct Connect as the primary path for predictable performance, with a site-to-site VPN as an automatic backup if the circuit fails.

Deployment models, in outline

The next lesson covers public, private and hybrid in full. The networking point to carry into it is that the hybrid model is the one that creates work: joining a private environment to a public one means reconciling two address plans, two sets of firewall policy, two identity systems and two monitoring stacks — and it is why non-overlapping address space, decided on day one, matters so much.