Modern networks: cloud and automation

Two ways into the same idea

Before You Start

The Core Idea

1The network in the cloud: a VPC

A VPC is your own private network inside the cloud. You split it into a public subnet holding what the internet must see (the load balancer), and a private subnet holding the app and the database. The internet comes into the public one only; the private one goes out through NAT for its updates, and nobody comes in.

AWS reserves 5 addresses per subnet, not 2, so subtract 5.

import ipaddress

vpc = ipaddress.ip_network("10.0.0.0/16")
zones = ["a", "b"]
tiers = ["public", "app", "db"]

subnets = vpc.subnets(new_prefix=24)          # 256 slices of /24
plan = {f"{tier}-{zone}": next(subnets) for tier in tiers for zone in zones}
for name, net in plan.items():
    print(f"{name:<9} {net}  ({net.num_addresses - 5} usable in AWS)")

2Software-defined networking (SDN)

In a classic network each device thinks on its own: it works out its routes and keeps its settings. In SDN the devices keep the fast forwarding (the data plane), and the thinking (the control plane) moves to a central controller. You write the policy once in the controller and it translates it for every device.

3Automation: the network as code

Instead of typing the same commands on twenty switches, you put the data in a file (which VLAN goes on which port), keep one template for the commands, and generate all the configs. The file lives in Git and is reviewed like any code, so you know who changed what and when.

Add a switch to the JSON and run: its config is ready without typing a single command line.

import json

inventory = json.loads("""
{
  "vlans": {"10": "STAFF", "20": "GUEST", "30": "CAMERAS"},
  "switches": {
    "SW1": {"gi0/1": 10, "gi0/2": 20},
    "SW2": {"gi0/1": 30, "gi0/2": 10}
  }
}
""")

def config_for(name, ports):
    lines = [f"hostname {name}"]
    for vid, vname in inventory["vlans"].items():
        lines += [f"vlan {vid}", f" name {vname}"]
    for port, vid in ports.items():
        lines += [f"interface {port}", " switchport mode access", f" switchport access vlan {vid}"]
    return "\n".join(lines)

for name, ports in inventory["switches"].items():
    print(f"--- {name} ---")
    print(config_for(name, ports))

4Monitoring: know before anyone calls

A good network is watched all the time: SNMP reads counters (load, errors, temperature), Syslog gathers device messages in one place, and NetFlow records who talked to whom and how much. IPv6 now runs side by side with IPv4 (dual stack) and carries most of the traffic on many large networks, so watch both.

The number after the source name is the severity: the smaller it is, the worse.

import re

SEVERITY = ["emergency", "alert", "critical", "error", "warning", "notice", "info", "debug"]
logs = [
    "%LINK-3-UPDOWN: Interface Gi0/1, changed state to down",
    "%SYS-5-CONFIG_I: Configured from console by admin",
    "%OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 on Gi0/0 from FULL to DOWN",
    "%SYS-2-MALLOCFAIL: Memory allocation failed",
]

for line in logs:
    facility, level, text = re.match(r"%(\w+)-(\d)-\w+: (.*)", line).groups()
    level = int(level)
    flag = "PAGE ON-CALL" if level <= 3 else "log only"
    print(f"{level} {SEVERITY[level]:<9} {facility:<5} {flag:<12} {text}")

Worked example

The task: your app in a private cloud subnet cannot download updates from the internet, though the site works from outside. The answer: traffic comes in through the load balancer in the public subnet, but the private subnet needs a NAT Gateway to get out. Check the private subnet's route table: it must have 0.0.0.0/0 → nat-gateway. If the route is there, check the outbound rules in the Security Group and the Network ACL, and remember a Network ACL is stateless, so the reply needs a rule too.

Myth vs Reality

Where you meet it at work

Test your understanding

Quick review cards

Check Your Understanding