Cloud Networking
Cloud networking provides the virtual network infrastructure — VPCs, subnets, gateways, load balancers, peering, and DNS — that connects workloads within a cloud provider and to external networks, replacing physical cables and appliances with software-defined constructs.
itCloud computing | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic: Cloud Networking
A virtual network is the cloud version of the cables, routers, and appliances that once occupied a room with a suspicious number of blinking lights. It connects workloads, users, offices, managed services, and the internet through software-defined addresses, routes, gateways, filters, DNS, and load balancers. The hardware did not vanish. It became somebody else's carefully guarded concern, while the decisions about who talks to whom became yours.
The useful mental model is the packet path. Start with the name: DNS must return an address the source can use. Then inspect the route: it chooses a next hop, not permission. Inspect policy next: a firewall or security group can allow a route to remain an exquisitely documented failure. Then check a translation gateway or load balancer. Finally, prove the return path. A connection has two directions because networking, like bureaucracy, has a form for the trip home too.
Address planning matters because CIDR prefixes become future promises. A private IPv4 range can be reused until two networks connect and discover they chose the same numbers. A subnet organizes an address block; it does not become a security boundary by optimism. IPv6 gives more addresses, but it also gives a second path to route, filter, name, observe, and test. A private endpoint and a NAT gateway solve different path problems. Neither grants trust to an application caller.
Read the Intro for the complete architecture and its five checks. The Slides compress the decisions shaping ingress, egress, segmentation, DNS, resilience, and cost. Keep the Cheatsheet nearby when reviewing a route, policy, health check, or failure signal. Use the Practice Reference and Exercise to turn one proposed connection into evidence. The Field Notes cover the operational traps that diagrams omit. The durable habit is pleasingly unglamorous: trace the packet, explain the policy, and prove that the answer can get back.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/145/final
Supports
- Cloud computing as configurable network access to a shared resource pool
- Cloud service models, deployment models, and essential characteristics
- https://datatracker.ietf.org/doc/html/rfc1918
Supports
- Private IPv4 address ranges and their enterprise scope
- Address reuse, overlap, renumbering, filtering, and private DNS constraints
- https://datatracker.ietf.org/doc/html/rfc4632
Supports
- CIDR prefix notation and route aggregation
- Longest-prefix route selection and the IPv4 default route
- https://docs.aws.amazon.com/vpc/latest/userguide/vpc-subnet-basics.html
Supports
- AWS VPC and subnet scope
- IPv4 and dual-stack VPC addressing
- Main route tables, security groups, network ACLs, and internet gateways
- https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html
Supports
- Route tables as destination and target rules
- Public, private, isolated, peered, and hybrid routing paths
- https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat.html
Supports
- Outbound connections from private IPv4 subnets through address translation
- Return traffic without unsolicited inbound connection initiation
- https://docs.aws.amazon.com/vpc/latest/userguide/infrastructure-security.html
Supports
- Stateful security groups and stateless network ACLs
- Private subnets, minimum routes, private service access, and VPC Flow Logs
- https://learn.microsoft.com/en-us/azure/networking/design-guide/overview
Supports
- Virtual networks, subnets, IP planning, and traffic filters
- Hybrid connectivity, internet ingress, private access, DNS, load balancing, and monitoring
- https://learn.microsoft.com/en-us/azure/networking/networking-overview
Supports
- Azure connectivity, load balancing, content delivery, security, DNS, and hybrid services
- Private Link, VPN Gateway, and ExpressRoute roles
- https://learn.microsoft.com/en-us/azure/networking/design-guide/hub-spoke
Supports
- Hub-and-spoke shared services and workload isolation
- Routing variants, hybrid connectivity, scaling, cost, and failure tradeoffs
- https://docs.cloud.google.com/vpc/docs/vpc
Supports
- Google Cloud VPC and subnet scope
- System-generated routes, firewall rules, and internet-access requirements
- https://docs.cloud.google.com/architecture/network-architecture
Supports
- Enterprise network connectivity and service networking blocks
- Public and private DNS, load balancing, private service connectivity, and flow logs
- https://docs.cloud.google.com/architecture/framework/reliability/observability
Supports
- Metrics, logs, and traces for reliability
- VPC Flow Logs, proactive troubleshooting, alerting, and logging cost controls
- https://csrc.nist.gov/pubs/sp/800/207/final
Supports
- No implicit trust based only on physical or network location
- Resource-focused protection with authentication and authorization
- https://www.rfc-editor.org/rfc/rfc791
Supports
- IPv4 datagram addressing and routing foundation published in 1981
- https://www.rfc-editor.org/rfc/rfc1519
Supports
- CIDR allocation and route aggregation published in 1993
- https://aws.amazon.com/blogs/aws/introducing-amazon-virtual-private-cloud-vpc/
Supports
- Amazon VPC limited beta announcement in August 2009
- https://aws.amazon.com/blogs/aws/new-approach-amazon-ec2-networking/
Supports
- Amazon EC2 VPC networking release in March 2011
- https://aws.amazon.com/blogs/aws/new-vpc-peering-for-the-amazon-virtual-private-cloud/
Supports
- Amazon VPC Peering launch in March 2014
- https://aws.amazon.com/blogs/aws/new-ipv6-support-for-ec2-instances-in-virtual-private-clouds/
Supports
- Amazon VPC and EC2 IPv6 launch in December 2016
- https://cloud.google.com/blog/products/gcp/reimagining-virtual-private-clouds
Supports
- Google Cloud global VPC architecture announcement in July 2017
- https://aws.amazon.com/about-aws/whats-new/2018/11/introducing-aws-transit-gateway/
Supports
- AWS Transit Gateway launch in November 2018
- https://aws.amazon.com/vpc/
Supports
- Amazon VPC product role for isolated virtual networks and hybrid connectivity
- https://azure.microsoft.com/en-us/products/virtual-network/
Supports
- Azure Virtual Network role for private cloud infrastructure and hybrid connectivity
- https://cloud.google.com/vpc
Supports
- Google Cloud VPC global scope, regional subnets, flow logs, peering, and pricing
- https://docs.aviatrix.com/docs/enterprise/8.2/concepts-architectures/platform-overview
Supports
- Aviatrix multi-cloud hub-and-spoke connectivity and visibility
- https://developers.cloudflare.com/cloudflare-wan/
Supports
- Cloudflare WAN hybrid and multi-cloud connectivity with inline policy
