Cloud Networking and Next Steps

Cloud computing has transformed how networks are designed and managed. Instead of buying physical hardware, you provision virtual network infrastructure using software-defined networking (SDN). This lesson explores cloud networking concepts, compares major providers, and outlines your next steps for advancing in computer networking.

---

What is Cloud Networking?

Cloud networking is the practice of building and managing network infrastructure in a cloud environment. All the networking concepts you have learned — IP addressing, subnetting, routing, firewalls, load balancing — still apply, but they are implemented as virtual resources managed through APIs and web consoles.

Key Differences from Traditional Networking

Aspect	Traditional	Cloud
Provisioning	Buy and rack hardware (weeks)	Create via API or console (seconds)
Scaling	Buy more hardware	Click a button or auto-scale
Cost	Capital expenditure (CapEx)	Operational expenditure (OpEx), pay-as-you-go
Management	Physical access, CLI, SNMP	Web console, CLI, Infrastructure as Code
Redundancy	Design and build yourself	Built into the platform (multi-AZ, multi-region)

---

Virtual Private Cloud (VPC)

A VPC (or VNet in Azure) is your own isolated section of the cloud provider's network:

VPC: 10.0.0.0/16

  ┌─────────────────────────────────────────────┐
  │                                             │
  │   Public Subnet: 10.0.1.0/24               │
  │   ┌──────────┐  ┌──────────┐               │
  │   │ Web      │  │ Web      │               │
  │   │ Server 1 │  │ Server 2 │               │
  │   └──────────┘  └──────────┘               │
  │         │              │                    │
  │   ┌──────────────────────┐                  │
  │   │    Load Balancer     │ ← Internet       │
  │   └──────────────────────┘   Gateway        │
  │                                             │
  │   Private Subnet: 10.0.2.0/24              │
  │   ┌──────────┐  ┌──────────┐               │
  │   │ App      │  │ App      │               │
  │   │ Server 1 │  │ Server 2 │               │
  │   └──────────┘  └──────────┘               │
  │                                             │
  │   Database Subnet: 10.0.3.0/24             │
  │   ┌──────────┐  ┌──────────┐               │
  │   │ DB       │  │ DB       │               │
  │   │ Primary  │  │ Replica  │               │
  │   └──────────┘  └──────────┘               │
  │                                             │
  └─────────────────────────────────────────────┘

VPC Components

Component	Description
Subnets	Segments of the VPC CIDR range, placed in specific availability zones
Internet Gateway	Allows public subnets to communicate with the internet
NAT Gateway	Allows private subnets to access the internet (outbound only)
Route Tables	Control traffic routing within the VPC and to the internet
Security Groups	Stateful firewalls attached to instances (allow rules only)
Network ACLs	Stateless firewalls at the subnet level (allow and deny rules)
VPC Peering	Connects two VPCs for private communication
VPN Gateway	Encrypted connection between VPC and on-premises network
Transit Gateway	Central hub connecting multiple VPCs and on-premises networks

---

Cloud Provider Comparison

Concept	AWS	Azure	GCP
Virtual network	VPC	VNet	VPC
Subnet	Subnet	Subnet	Subnet
Firewall (instance)	Security Group	NSG	Firewall rules
Firewall (subnet)	NACL	NSG	VPC Firewall
Internet gateway	IGW	Public IP + LB	Default Internet GW
NAT	NAT Gateway	NAT Gateway	Cloud NAT
Load balancer	ALB/NLB/GLB	Azure LB / App GW	Cloud Load Balancing
DNS	Route 53	Azure DNS	Cloud DNS
CDN	CloudFront	Azure CDN / Front Door	Cloud CDN
VPN	Site-to-Site VPN	VPN Gateway	Cloud VPN
Private link	PrivateLink	Private Link	Private Service Connect

---

Security Groups vs NACLs

Feature	Security Group	Network ACL
Level	Instance (ENI)	Subnet
Statefulness	Stateful (return traffic auto-allowed)	Stateless (must explicitly allow return traffic)
Rules	Allow only	Allow and deny
Evaluation	All rules evaluated	Rules evaluated in order (lowest number first)
Default	Deny all inbound, allow all outbound	Allow all inbound and outbound

---

Content Delivery Networks (CDN)

A CDN caches content at edge locations around the world, reducing latency for users:

User in Tokyo ──> Edge (Tokyo) ──> Cache Hit? ──> Serve content
                                       │
                                       No
                                       │
                                       ▼
                              Origin Server (US)
                              Fetch, cache, serve

CDN Benefits