Network

A union of correlated hosts

DNS

Configuration information for your DNS server is stored as a file within a zone on your DNS server. Each file is called a record. The following record types are the most commonly created and used:

A is the host record, and is the most common type of DNS record. It maps the domain or host name to the IP address. CNAME is a Canonical Name record that’s used to create an alias from one domain name to another domain name. If you had different domain names that all accessed the same website, you’d use CNAME. MX is the mail exchange record. It maps mail requests to your mail server, whether hosted on-premises or in the cloud. TXT is the text record. It’s used to associate text strings with a domain name. Azure and Microsoft 365 use TXT records to verify domain ownership. Additionally, there are the following record types:

Wildcards CAA (certificate authority) NS (name server) SOA (start of authority) SPF (sender policy framework) SRV (server locations) The SOA and NS records are created automatically when you create a DNS zone by using Azure DNS.

Static IP addresses useful for

Private IP

There are three ranges of nonroutable IP addresses that are designed for internal networks that won’t be sent over internet routers:

Subnets vs VLANs

5-tuple

A 5-tuple refers to a set of five different values that comprise a Transmission Control Protocol/Internet Protocol (TCP/IP) connection. It includes

Next Hop

The Next hop shows the network path taken by traffic sent to each address prefix. The path can be one of the following hop types:

Perimeter network (DMZ)

A perimeter network, also known as a demilitarized zone (DMZ), is a physical or logical subnetwork that contains and exposes an organization’s external-facing services to an untrusted network, usually the internet. The purpose of a perimeter network is to add an additional layer of security to an organization’s local area network (LAN); an external attacker only has access to equipment in the DMZ, rather than any other part of the network.

Key characteristics of a perimeter network include:

In summary, a perimeter network serves as a buffer zone between the untrusted external network and the trusted internal network, enhancing security by limiting the exposure of internal systems.

VPN

Default route

The default route, often represented as 0.0.0.0, is typically provided by a router or a gateway. When a device connects to a network, the router or gateway usually provides the device with an IP address and other network information, including the default route, through a protocol called DHCP (Dynamic Host Configuration Protocol).

In some cases, the default route can be manually set on a device. This is common in server environments or in specific network configurations where automatic configuration through DHCP is not desired.

In the context of a VPN, the default route can be set by the VPN server. This is useful when you want all network traffic from a device to go through the VPN, effectively hiding the device’s original IP address.

If it is 0.0.0.0 – there is no specific route defined

Route advertisement

Advertising custom routes in a VPN Gateway refers to the process of manually configuring the routes that a VPN Gateway advertises to connected devices. This is particularly useful in scenarios where you want to control the traffic flow in your network or when you need to connect to specific resources that are not part of the default route advertisement.

For example

Forced tunneling

You can direct all traffic to the VPN tunnel by advertising 0.0.0.0/1 and 128.0.0.0/1 as custom routes to the clients. The reason for breaking 0.0.0.0/0 into two smaller subnets is that these smaller prefixes are more specific than the default route that may already be configured on the local network adapter and, as such, will be preferred when routing traffic.

IP ranges

BGP

Border Gateway Protocol, is a protocol used to exchange routing information across autonomous systems on the internet. In the context of cloud engineering, BGP is often used in conjunction with VPNs or Direct Connect (in AWS) / ExpressRoute (in Azure) / Cloud Interconnect (in Google Cloud) for routing traffic between your on-premises network and your VPCs in the cloud.

BGP can be used to advertise the routes of your on-premises network to the cloud, and vice versa.

BGP advertisement

Advertisement is a process in which BGP routers communicate with each other to share information about the reachability of different network paths. This is done to establish and maintain routing tables, which are used to determine the most efficient path for data to travel from one network to another.

  1. A BGP router starts by advertising its directly connected networks to its BGP neighbors. This advertisement includes the IP prefix (network address and subnet mask) of the connected networks.

  2. The BGP neighbors receive this advertisement and add the advertised routes to their BGP routing tables. They then advertise these routes to their own BGP neighbors.

  3. This process continues, with each BGP router advertising the routes it learns to its neighbors. This allows all BGP routers in the network to learn about all available routes.

  4. If a route changes (for example, if a link goes down), the BGP router that detects the change will update its routing table and advertise the change to its neighbors. This ensures that all routers have up-to-date information about the network.

  5. BGP uses a set of policies and attributes (like AS-PATH, NEXT-HOP, etc.) to determine the best path for data to travel. When multiple paths are available, BGP will choose the one with the highest preference.

Connestivity directions

Hub and spoke topology

is a system where a central node (the hub) is connected to peripheral nodes (the spokes). All data that is transmitted between the peripheral nodes must pass through the central hub. This topology is commonly used in systems where control and coordination of the nodes is important.

    Spoke1
      |
      |
Hub --+-- Spoke2
      |
      |
    Spoke3

Network devices

Host

Any device in the network that can serve requests. Essentially, it’s a server. Each host must have:

Repeater

An amplifier of the signal, which dies out in the cable of the network

Hub

A multi-port repeater, as it translates the signal from one machine to the rest

Bridge

Facilitates communication between networks, cross-hub

Switch

Operates within a network. Switching - process of moving data within a network.

VLAN

Router

Communication between networks, also creates a hierarchy in networks. Creates internet. Routing - moving data between networks.

Protocols

IPV6

OSI model

  1. Physical - transports bits
  2. Data Link - hop-to-hop
    1. Network card (NIC)
    2. Addressed with MAC scheme
    3. Switches - switch wires to physically connect NIC
  3. Network - end-to-end
    1. Addressing with IP
  4. Transport - service-to-service
    1. Data streams for different services
    2. Addressing with ports
    3. TCP for reliability
    4. UDP for efficiency
    5. Based on the new source connection port, we know that this is a new session, a new client
  5. Session
  6. Presentation
  7. Application

Broadcast domain

A broadcast domain is a logical division of a computer network, in which all nodes can reach each other by broadcast at the data link layer. In other words, in a broadcast domain, when one device sends a broadcast message, all other devices in the same domain receive and process that message. Broadcast messages are typically used for tasks such as address resolution (like ARP in IPv4) or service discovery.

  1. Ethernet Segments:
    • In traditional Ethernet networks, all devices on the same physical network segment are part of the same broadcast domain.
    • For example, if you have a hub-based Ethernet network (although hubs are less common today), all devices connected to that hub are in the same broadcast domain.
  2. Switched Networks:
    • In modern networks with switches, each port on a switch is usually its own broadcast domain. This is because switches are more intelligent than hubs and only forward broadcasts to the necessary ports.
    • If you have a switch with multiple devices connected to it, each device is in its own broadcast domain. However, devices in different VLANs (Virtual LANs) are in separate broadcast domains.
  3. VLANs (Virtual LANs):
    • VLANs are a way to create multiple broadcast domains within a switch or a set of interconnected switches.
    • Devices in the same VLAN can communicate with each other as if they were on the same physical network, even if they are connected to different switches. However, devices in different VLANs cannot communicate through broadcasts.
  4. Routers:
    • Routers operate at the network layer and separate broadcast domains by default. When a router receives a broadcast packet on one interface, it does not forward that broadcast to other interfaces.
    • Each interface on a router can be considered a separate broadcast domain. For example, if you have a router with three interfaces, each interface is in its own broadcast domain.

VNet Peering

VNet Peering is a networking feature provided by Azure. It allows for seamless connections between Azure Virtual Networks (VNets). By peering two VNets, all resources in the two networks are able to communicate with each other as if they are in the same network, using their private IP addresses.

VNet Peering has several benefits:

It’s important to note that the peered VNets must be in the same region and cannot overlap in IP address space.

Subnetting

  1. Understanding IP Addresses:
    • IP addresses consist of two parts: the network portion and the host portion. For example, in the IP address 192.168.1.1, “192.168.1” is the network portion, and “.1” is the host portion.
  2. Choosing a Subnet Mask:
    • The subnet mask is used to divide an IP address into network and host portions. It consists of a series of contiguous ‘1’ bits followed by ‘0’ bits. For example, in the subnet mask 255.255.255.0, the first 24 bits are ‘1’s, representing the network portion, and the last 8 bits are ‘0’s, representing the host portion.
  3. Determine the Number of Subnets:
    • Decide how many subnets you need within the given network. This depends on factors like the number of departments, physical locations, or other organizational requirements.
  4. Determine the Number of Hosts per Subnet:
    • Decide how many hosts each subnet needs to support. This will influence the size of the subnet and the subnet mask used.
  5. Subnetting Calculation:
    • Use the subnet mask to calculate the size of each subnet. The subnet size is determined by the number of host addresses needed.
    • For example, if you need 30 hosts per subnet, you would need a subnet size that accommodates at least 32 hosts (2^5 = 32). So, a subnet mask of 255.255.255.224 (or /27 in CIDR notation) would be appropriate because it provides 32 host addresses per subnet.
  6. Allocate Subnets:
    • Allocate the calculated subnets within the original network space. Each subnet will have its own network address, and the host addresses within each subnet will be used to assign individual devices.

DNS

TCP (Transmission Control Protocol) and UDP (User Datagram Protocol):

Relationship between DNS and TCP/UDP:

SSL

Secure Sockets Layer (SSL) is a cryptographic protocol that provides secure communication over a computer network, most commonly used for securing web browsing but also applicable to other applications.

The SSL protocol operates on the application layer of the OSI model

SSL has been succeeded by newer versions of the protocol called Transport Layer Security (TLS)

Goals

  1. Data Encryption: SSL uses cryptographic algorithms to encrypt data exchanged between the client and server. This ensures that even if the communication is intercepted, the intercepted data is unintelligible without the appropriate decryption key.
  2. Data Integrity: SSL provides mechanisms for verifying the integrity of the data exchanged between the client and server. This prevents tampering with the data during transit.
  3. Authentication: SSL facilitates the authentication of the server to the client and, optionally, the client to the server. This is typically done through the use of digital certificates, which are issued by trusted Certificate Authorities (CAs).

SSL handshake

  1. ClientHello:
    • The process begins when a client (e.g., a web browser) sends a “ClientHello” message to the server.
    • This message includes information like supported SSL/TLS versions, cipher suites, and random data.
  2. ServerHello:
    • The server responds with a “ServerHello” message, selecting the highest SSL/TLS version that both the client and server support.
    • The server also selects a cipher suite from the list provided by the client and generates its random data.
  3. Server Certificate:
    • The server sends its digital certificate to the client. The certificate contains the server’s public key and information about the certificate issuer.
    • The client checks the certificate’s validity and authenticity by verifying its digital signature and checking that it is signed by a trusted certificate authority (CA).
  4. Key Exchange:
    • The client generates a pre-master secret and encrypts it with the server’s public key obtained from the server’s certificate.
    • The server decrypts the pre-master secret using its private key.
  5. Pre-Master Secret:
    • Both the client and server independently generate the master secret using the pre-master secret and the random data exchanged in previous steps.
    • The master secret is then used to derive encryption keys for securing the communication.
  6. Finished:
    • Both the client and server send a “Finished” message, indicating that the handshake is complete.
    • From this point on, the client and server can communicate securely using the established encryption keys.

TLS

  1. Handshake Protocol:
    • Like SSL, TLS begins with a handshake protocol where the client and server negotiate and establish a secure connection.
    • The TLS handshake involves a series of steps, including the exchange of supported cryptographic algorithms, key exchange methods, and authentication information.
  2. Key Exchange:
    • TLS supports various key exchange methods, including RSA (Rivest-Shamir-Adleman) for public key encryption, Diffie-Hellman for secure key exchange, and Elliptic Curve Cryptography (ECC) for efficient key exchange with shorter key lengths.
  3. Data Encryption:
    • TLS uses symmetric-key cryptography for efficient data encryption. The shared secret established during the handshake is used to derive encryption keys for securing the data exchange.
    • Common symmetric encryption algorithms used in TLS include Advanced Encryption Standard (AES) and Triple DES.
  4. Data Integrity:
    • TLS ensures data integrity through the use of cryptographic hash functions, such as SHA-256. Hash functions generate a fixed-size digest (hash) of the data, and this hash is used to verify the integrity of the transmitted data.
  5. Authentication:
    • TLS provides a means of authenticating the parties involved in the communication. This is typically done using digital certificates.
    • The server presents its digital certificate during the handshake, and the client can verify the certificate’s authenticity by checking its digital signature and the issuing Certificate Authority (CA).
  6. Perfect Forward Secrecy (PFS):
    • TLS supports Perfect Forward Secrecy, which ensures that even if an attacker compromises a server’s private key, past communications remain secure. PFS achieves this by generating unique session keys for each session, derived from the long-term keys exchanged during the handshake.
  7. TLS Versions:
    • TLS has seen multiple versions, with each version addressing security vulnerabilities and introducing improvements. Common TLS versions include TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.
    • TLS 1.3, the latest version as of my knowledge cutoff in January 2022, brings significant security enhancements and performance improvements.

Firewall

  1. Packet Filtering:
    • Firewalls inspect individual packets of data as they travel through the network.
    • Packet filtering is based on predefined rules that specify conditions for allowing or blocking packets.
    • Criteria for filtering can include source and destination IP addresses, port numbers, and the protocol used.
  2. Stateful Inspection (Dynamic Packet Filtering):
    • Stateful inspection keeps track of the state of active connections and makes decisions based on the context of the traffic.
    • It allows or denies traffic based on the state of the connection, ensuring that only legitimate and established connections are allowed.
  3. Proxy Firewalls:
    • Proxy firewalls act as intermediaries between internal and external systems.
    • Instead of allowing direct connections between systems, a proxy firewall forwards requests on behalf of clients and returns the responses.
    • This helps hide the internal network structure and provides an additional layer of security.
  4. Network Address Translation (NAT):
    • Firewalls often use NAT to hide the internal IP addresses of devices from external networks.
    • NAT translates private IP addresses used within a network to a single public IP address, masking the internal network structure.
  5. Application Layer Filtering:
    • Some firewalls operate at the application layer and can inspect the content of data packets.
    • This allows for more granular control based on specific applications or services.
  6. Intrusion Detection and Prevention Systems (IDPS):
    • Some firewalls incorporate intrusion detection and prevention capabilities to identify and respond to suspicious or malicious activities.
  7. Logging and Reporting:
    • Firewalls often log information about allowed and blocked traffic, which can be useful for monitoring and analysis.
    • Reporting features provide administrators with insights into network activity and potential security threats.
  8. Hardware and Software Firewalls:
    • Firewalls can be implemented as both hardware devices and software applications.
    • Hardware firewalls are standalone devices that are often deployed at the network perimeter, while software firewalls can be installed on individual computers or servers.

System automation

  1. Shell scripts – automating daily tasks
  2. Cron Jobs – runs jobs at specific intervals
  3. Configuration Management Tools - like Ansible, to automate identical setups
  4. Version Control Systems – to rollback and track changes
  5. System monitoring and logging – Prometheus
  6. Task scheduling with at and batch – echo “/path/to/script.sh” at 2:00 AM
  7. Automating User Account Management
  8. Log rotation
  9. Remote execution with ssh and rsync ans scp.This would requre appropriate permissions on the target system