Cloud and Data Center Concepts and Connectivity

Cloud and the Datacenter
Objectives:
● 1.3 - Summarize cloud concepts and connectivity options
● 1.8 - Summarize evolving use cases for modern network environments
● Cloud Computing
○ Cloud Computing Characteristics
■ High Availability
● Refers to services experiencing minimal downtime in the cloud
● Services are highly reliable and fault-tolerant
● Measured in uptime percentage (e.g., five nines means 99.999%
uptime)
■ Scalability
● Ability to increase system capacity at a linear rate or less than a
linear rate
● Can accommodate increasing numbers of users or things in the
system
● Vertical Scaling
○ Scale up
○ Increasing the power of the existing resources in the
working environment
201
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Horizontal scaling
○ Scale out
○ Adding additional resources, like additional servers, to help
handle the extra load being experienced
■ Rapid Elasticity
● Ability to rapidly scale up or down based on demand
● Achieved through automation and orchestration of virtual
machines
● Enables handling changes in demand in real time
■ Metered Utilization
● Pay-per-use model for cloud services
● Charges based on actual usage of services
● Offers cost efficiency and flexibility in resource allocation
● Metered Service
○ Consumption basis – exact amount used
● Measured Service
○ Based on a certain amount of quantity upfront
■ Shared Resources
● Ability to use virtual machines on shared physical servers
● Minimizes costs by efficiently utilizing hardware resources
● Pooling of resources across the cloud provider's data center
202
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ File Synchronization
● Ability to synchronize files across multiple locations
● Facilitates collaboration and remote work
● Ensures consistent access to files across devices and locations
● Cloud Service Models
○ Cloud Deployment Options
■ On-premise Solution
● Offers security but are costly and require a dedicated support
team
● Confidentiality is better ensured, where physical and logical access
can be controlled
■ Hosted Solution
● Third-party service providers provide hardware and facilities,
often in a multi-tenancy environment, reducing costs and
resource requirements
● Multi-tenancy solutions may expose residual data to other tenants
as server capacity expands or contracts
● Understanding the hosting provider's authentication, redundancy,
fault tolerance, and data storage location is crucial
203
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Cloud Service Models
■ Software as a Service (SaaS)
● Provider offers a complete solution, including hardware, software,
and application access
● Examples
○ Office 365
○ Google Workspace
○ TurboTax
○ QuickBooks Online
■ Platform as a Service (PaaS)
● Provider offers hardware and operating system software, allowing
customization of applications
● Useful for developing web applications without managing
underlying infrastructure
● Includes middleware and runtime
■ Infrastructure as a Service (IaaS)
● Provides IT resources like servers, load balancers, and storage area
network components
● Offers dynamic allocation of resources without long-term
hardware commitments
● Focuses mostly on hardwares
204
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Exam Tip
■ If a service includes more than IaaS but less than SaaS, it's likely PaaS
● Cloud Deployment Models
○ Cloud Computing Trends
■ Increased availability
■ Higher resiliency
■ Unlimited elasticity
○ Despite its advantages, cloud computing introduces unique security challenges
○ Types of Cloud Deployment Models
■ Public Cloud
● Resources provided over the internet by a service provider (e.g.,
Google Drive, Microsoft Azure)
● Cost-effective and efficient for quick service acquisition
■ Private Cloud
● Organization creates and manages its own cloud environment
● Offers higher security but can be more costly
■ Hybrid Cloud
● Combines private and public cloud resources
● Requires strict data hosting rules for security
205
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Community Cloud
● Resources and costs shared among multiple organizations with
common service needs
● Challenges include varying security controls among organizations
■ Multi-Tenancy
● Same resources used by multiple organizations for efficiency
● Security concerns include shared vulnerabilities
■ Single-Tenancy
● Single organization assigned to a resource
● Less efficient and more expensive than multi-tenancy
○ Choosing a Cloud Model depends on:
■ Security needs
■ Cost restrictions
■ Risk tolerance
● Using Cloud Computing: Demonstration
● Cloud Connectivity
○ Connectivity Options for Cloud-based Solutions
■ Focusing on connecting enterprise networks to public cloud service
providers (CSPs)
206
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Ensuring network clients can access resources from anywhere,
just as they could on-premise
■ Virtual Private Network (VPN)
● Establishes secure connections between on-premise network,
remote offices, client devices, and cloud provider's network
● Often created as a site-to-site VPN between edge router and cloud
provider's network
● Uses traditional IPsec VPN for encrypted connection over the
public internet
● Provides a managed, highly available, and elastic solution for
extending the network
■ Private Direct Connection
● Allows extending on-premise network into cloud provider's
network
● Bypasses the internet, providing a secure and dedicated
connection
● Uses dedicated lease line or similar WAN connection
● Supports faster speeds and better performance compared to VPNs
○ Trade-offs
■ VPN
● Offers cost-effective connectivity
207
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Private Direct Connections
● Offer better performance and redundancy
● More expensive
○ Choose between VPNs and private direct connections based on performance
needs and cost considerations
● Cloud Security
○ Cloud Security
■ Involves protecting cloud-based resources from unauthorized access and
attacks
○ Virtual Private Cloud (VPC)
■ Used to provision a logically isolated section of a cloud provider’s
infrastructure
■ Allows launching resources inside a defined virtual network
■ Part of the larger concept of Infrastructure as Code (IAC)
● Infrastructure as Code (IAC)
○ Includes the provisioning of architecture where the
deployment of resources is performed by scripted
automation and orchestration
■ Key Components
● Subnet
○ A range within a VPC for allocating instances
208
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Can be public or private
● Route Tables
○ Contain rules (routes) for directing network traffic within a
VPC
○ Associated with each subnet
● Internet Gateway
○ Enables communication between VPC instances and the
public internet
○ Horizontally scalable, redundant, and highly available
● Network Access Translation (NAT) Gateway
○ Enables private subnet instances to connect to the
internet, but prevents the internet from initiating a
connection with those instances in he VPC
● Network Access Control List (ACL)
○ Subnet-level firewalls for controlling inbound and
outbound traffic
○ Operates like stateless firewall
■ Each rule for inbound or outbound traffic is
evaluated independently
○ May be used to supplement Security Groups but not to
replace them
209
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Security Groups
○ Instance-level firewalls for controlling inbound and
outbound traffic
○ Operate like stateful firewall
○ Newly created security group has no inbound rule and has
allow outbound rule by default
● VPC Peering
○ Network connection between two VPCs for private traffic
routing
● VPC Endpoints
○ Allow private connectivity to services within a cloud
provider without using the internet
● VPN Connections
○ Connect VPCs to remote networks or other VPCs
■ Advantages of VPCs
● Allow mixing products from different vendors
● Speed up network development
● Added layers of automation and policy management
● Enables fully automated deployments
○ Critical for high-velocity or high-availability architectures
and disaster recovery
210
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Challenges of VPCs
● Risk of being a single point of failure if connectivity is lost
● Centralized nature can make them a potential target for attackers,
requiring proper security measures
● Network Virtualization
○ Network Function Virtualization (NFV)
■ A concept that transforms traditional, hardware-dependent network
services into software-based virtual functions, enhancing agility and
flexibility in telecommunications
○ Traditional Network Services vs. NFV Solution
● Historically, services like routing, firewalling, load balancing, and
intrusion detection were performed by dedicated hardware
appliances
○ Limit scalability and deployment speed
○ Increase costs
■ NFV Solution
● Extracts network functions from hardware, deploying them as
software applications known as Virtual Network Functions (VNFs)
○ Allows for greater flexibility
○ Faster response
211
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Components of NFV
■ NFV Infrastructure (NFVI)
● Includes hardware and virtual resources for deploying, managing,
and executing VNFs
■ Management and Network Orchestration (MANO)
● Oversees lifecycle management of VNFs
● Orchestrates resources across NFVI for efficient deployment and
scaling
■ Virtual Network Functions (VNFs)
● Software implementations of network functions traditionally
bound to hardware appliances
● Instantiated on NFVI, and can be chained together for full-scale
network services
○ Benefits of NFV
■ Flexibility and rapid deployments
● Enables rapid scaling of network services without physical
hardware installations
■ Cost Efficiency
● Reduces capital expenditures by utilizing commercial off-the-shelf
server technology
○ Eliminates the need for hardware replacements with
software upgrades
212
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Challenges of NFV
■ Security Concerns
● Transitioning to NFV raises security challenges
■ Management Complexity
● Managing and orchestrating virtualized functions can be complex
■ Skills Requirement
● Skilled personnel proficient in virtualization technologies are
needed
● Software-Defined Network (SDN)
○ Software Defined Networking (SDN)
■ An approach to networking that uses software-based controllers or APIs
to communicate with underlying hardware infrastructure and direct
traffic on a network
■ A part of Infrastructure as Code (IaC)
● Infrastructure as Code (IaC)
○ Includes provisioning of architectures in which deployment
of resources is performed by scripted automation and
orchestration
○ Control Plane
■ Responsible for routing signals to and from a router
■ Makes decisions on traffic prioritization and security
213
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Data Plane
■ Carries user traffic on the network
■ Performs actual switching and routing
○ Management Plane
■ Administers routers and switches
■ Monitors traffic conditions
■ Manages network configurations
○ Setting up SDN
■ SDN application is used to define the policy decisions
● Occurs in management plane
● Deployed and operate within control plane
● Traffic is moved by the data plane across the network
○ Advantages of SDN
■ Flexibility
● SDNs allow mixing and matching of products from different
vendors using common API calls
■ Increased Choices
● Provides organizations with increased choices in network
development, adding speed and agility to network establishment
●
■ Automation
● Enables automation of network provisioning
214
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Scalability
● Facilitates fully automated deployment of networks
● Critical for high velocity or high availability architectures
■ Security
● Security data is easier to collect, making detection of different
traffic patterns in the network unchallenging
○ Disadvantages
■ Loss of Connectivity
● Loss of connectivity to the SDN controller can lead to network
downtime
■ Centralized Controller
● Vulnerable to attacks targeting the singular controller
○ Types of SDN
■ Open SDN
● Uses open source technologies like OpenFlow, OpFlex, and
OpenStack
■ Hybrid SDN
● Combines traditional networking protocols with SDN technologies
■ SDN Overlay
● Creates layers of network abstraction for virtualized network
layers on top of physical networks
215
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Security Benefits
■ Logical Isolation
● Provides additional security and logical isolation in the network
■ Zero Trust
● Allows implementing zero-trust security models using SDN overlay
● Software-Defined Wide Area Network (SD-WAN)
○ Software-Defined Wide Area Network (SD-WAN)
■ A virtualized approach to managing and optimizing wide area network
connections
■ Used to efficiently route traffic between remote sites, data centers, and
cloud environments
○ Benefits of SD-WAN
■ Provides agility, security, and efficiency in network infrastructures
■ Allows enterprises to leverage any combination of transport services
■ Enables the creation of virtualized network architectures using various
network transport types
■ Extracts control from underlying hardware, making it a software-based
architecture
○ How SD-WAN Works
■ Uses a centralized control function to securely and intelligently redirect
traffic
216
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Can layer over multiple types of network transport, such as MPLS,
cellular, microwave, or broadband internet services
■ Identifies network applications used by end-users and routes data across
the WAN accordingly
○ Comparison with Traditional WAN
■ Unlike traditional WAN architectures, SD-WAN offers dynamic and
efficient routing
■ Provides improvements in visibility, performance, and manageability from
a centralized point
■ Addresses the inefficiencies of traditional star topologies, improving user
experience and productivity
○ Use Cases
■ Ideal for large enterprises with geographically dispersed branch offices
■ Particularly useful for enterprises moving towards cloud-based
environments (IaaS, PaaS, SaaS)
■ Helps increase performance for end-users and reduce bottlenecks caused
by traditional WAN architectures
○ Future Considerations
■ Important for enterprises to consider SD-WAN as work environments
become more geographically dispersed
■ Not just about keeping pace with digital transformation, but also about
anticipating future challenges and capitalizing on opportunities
217
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Security and Career Advancement
■ Elevates organizational security posture
■ Helps in migrating more heavily into cloud-based environments, aiding in
career advancement
● Virtual Extensible Local Area Network (VXLAN)
○ Virtual Extensible Local Area Networks (VXLAN)
■ A network virtualization technology that addresses limitations of
traditional networks by creating larger, more agile virtual networks
■ A network overlay technology that encapsulates Ethernet frames within
UDP packets
■ Extends layer 2 networks over layer 3 infrastructure, enabling virtualized
networks across physical networks
■ Scalability
● VXLAN uses a 24-bit VXLAN Network Identifier (VNI), supporting
over 16 million virtual networks, compared to the 4,096 limit of
traditional VLANs
○ Components
■ VXLAN Tunnel Endpoints (VTEPs)
● Entities that encapsulate and de-encapsulate Ethernet frames into
VXLAN packets
● Typically implemented in hypervisors or physical network switches
218
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ VXLAN Segments
● Layer 2 networks overlaid onto layer 3 networks, identified by the
unique 24-bit VXLAN Network Identifier (VNI)
○ Benefits
■ Scalability
● Supports up to 16 million virtual networks
■ Flexibility
● Can traverse layer 3 networks without changes to the underlying
network
■ Improved Utilization
● Optimizes network traffic flows within and across data centers
○ Real-World Use
■ Facilitates communication between virtual machines across different
servers in data centers
■ Especially useful when servers are spread across multiple locations
○ Challenges
■ Configuration Complexity
● Requires understanding of layer 2 and layer 3 networking, as well
as network overlays
■ Latency and Packet Size
● Encapsulation and decapsulation processes can introduce latency
and increase packet size
219
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Multicast Support
● Requires multicast support within the underlying network for
broadcasting and unknown unicast traffic
○ Simplification
■ Deployment can be simplified with management and orchestration tools
that automate configuration and management, especially in cloud-based
networks
○ Conclusion
■ VXLAN is a significant advancement in network virtualization, providing
extensible, scalable, and efficient virtual networks over existing
architectures, essential for designing and managing advanced network
solutions in modern distributed networks
● SASE and SSE
○ SASE and SSE Overview
■ SASE and SSE are network security architectures blending traditional
network services with comprehensive security functions
■ They represent an evolution from a decentralized security model to a
unified cloud-centric approach
220
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Secure Access Service Edge (SASE)
■ Consolidates wide area networking (WANs) and security functions into a
single cloud-native service for secure, seamless user access regardless of
physical location
■ Key Feature
● Utilizes Software-Defined Networking (SDN) for security and
networking services from the cloud, offering flexibility, scalability,
and cost efficiency
■ SASE Security Services
● Firewalls
● VPNs
● Zero-trust network access
● Cloud Access Security Brokers (CASBs)
● Delivered through common policy and management platforms for
networking goals
■ SASE Benefits
● Addresses challenges of securing and connecting distributed users
and data across branch offices, remote workers, and cloud
environments
● Provides secure, fast, and reliable access to cloud-based resources
for users and devices
221
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
■ Cloud Provider Solutions
● AWS
○ Offers Virtual Private Cloud (VPC) for secure network
infrastructure
■ Enables creation of virtual networks in the cloud
and connected to on-premise data centers or other
AWS services
● Azure
○ Azure Virtual WAN
■ Provides secure global and efficient connectivity
between branch offices, data centers, and Azure
resources
○ Azure ExpressRoute
■ Enables creation of a dedicated, private connection
between an Azure data center and an on-premise
network infrastructure
● Google Cloud Platform
○ Google Cloud Interconnect
■ Allows connection of an on-premise infrastructure
to the Google cloud platform (GCP) over a
dedicated private connection
222
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
○ Google Cloud VPN
■ Allows secure connection of an on-premise
infrastructure to a virtual private cloud network
through an IP sec VPN tunnel
○ Security Service Edge (SSE)
■ A key subset of SASE that focuses exclusively on security services for
protecting access between users, devices, and the cloud
■ Key Technologies
● Secure Web Gateways
○ Inspect and filter unwanted software and malware from
web and internet traffic
● Cloud Access Security Brokers (CASBs)
○ Monitor and control data shared with cloud applications
for visibility, compliance, and threat protection
● Zero-Trust Network Access (ZTNA)
○ Treats every access attempt as untrusted, granting access
based on user/device identity and context
■ SSE Benefits
● Provides comprehensive and adaptable security measures for a
cloud-centric world
223
https://www.DionTraining.com
CompTIA Network+
(N10-009) (Study Notes)
● Reduces attack surface and mitigates internal threats through
strict access controls