IT Fundamentals Course – Hardware, Cloud, DevOps, Networking, Security, Databases, DNS, Git, Linux

[00:00] This course will provide you the [00:01] essential high-level foundation needed [00:03] to navigate the modern IT landscape. You [00:06] will explore a broad range of important [00:08] topics including networking, IP [00:10] addressing, DevOps, and site reliability [00:13] engineering. Asa teaches this course. He [00:16] is a certified Cisco and AWS instructor. [00:19] After you learn about basic hardware [00:21] components, you'll gain hands-on [00:23] practice within the AWS cloud [00:25] environment. You'll learn to design, [00:27] build, and secure virtual data centers [00:30] while gaining real-world experience with [00:32] tools like Docker and Kubernetes. Are [00:34] you aspiring a career in IT? Or maybe [00:38] you are in IT, a developer for example, [00:40] but would like to get into cloud and [00:42] other specialties within the IT, but you [00:45] are unable to because you lack some [00:47] fundamentals that are essential. Whether [00:50] this or that, this course is for you. [00:52] The course will help you navigate a [00:54] plethora of different areas in IT at a [00:59] high level, but will make you understand [01:01] what are these four and how to work with [01:03] them. [01:04] This includes networking, IP addressing, [01:07] TCP IP, what is DevOps, what is site [01:10] reliability engineering, what's platform [01:11] engineering, network and network [01:13] security, and other stuff as well. My [01:16] name is Asa Abu Sheriff and I have been [01:17] in the IT industry for close to three [01:20] decades right now. I am a certified [01:23] Cisco instructor and I'm certified AWS [01:25] instructor as well. And I have been [01:27] developing career programs to help [01:29] people like yourself start or upskill [01:33] into the modern IT roles. [01:39] While coaching and mentoring a lot of [01:42] our students, I have noticed that [01:44] there's always a weakness in the [01:45] fundamentals. [01:47] And the first advice anyone would give [01:49] you for the fundamentals would be take [01:51] A+, take Network+, take CCNA, and then [01:54] take MCSA, the Microsoft server [01:57] administration, and that would be an [01:58] absolute must. And you spend 6 to 12 [02:02] months doing that, and you spend a lot [02:05] of money as well for the certifications, [02:07] but that is all unnecessary in the [02:09] modern IT. [02:12] If you are starting your journey, in my [02:13] opinion, there has to be three main [02:16] things that need to be there in any [02:19] content that you are going to use. [02:21] Number one, it's going to take you from [02:23] point A to point B very quickly without [02:26] fluff. [02:27] Number two, it should minimize the [02:29] effort and should minimize the cost as [02:31] well for you to get into that area or [02:35] that specific topic. [02:37] Number three, it should not overwhelm [02:39] you because that is your first step, and [02:41] this should be easy to navigate. With a [02:44] little bit of effort and sweat, and with [02:46] a fresh mind, you should be able to [02:48] navigate and break through that and be [02:50] ready to the next steps. [02:56] The unique thing about this course is [02:58] that it blends a lot of things together [03:01] in one course. [03:02] It starts from where what is a computer, [03:05] what is a hardware device, what is a [03:07] memory, what's a CPU, what's a GPU, what [03:09] is a network interface card, and then it [03:11] explains to you what's a PC, what's a [03:13] server. [03:14] >> [snorts] [03:14] >> And then it takes you from there, okay, [03:16] so why do we use the server? What's the [03:17] difference between server and the PC? [03:20] And then takes you into virtualization. [03:22] Why do we need to use virtualization? [03:24] Why do we need to have a physical server [03:26] and then we start splitting or splicing [03:28] and dicing that in a virtual manner. [03:31] Then it talks about data centers, and [03:33] data centers from there it takes you to [03:35] the cloud, cloud computing. It explains [03:38] to you the networking devices, routers [03:40] and switches, cables, types of cables, [03:43] and speeds. And then it shows you how [03:46] you can build a network in your home, or [03:49] what are the components of a network in [03:51] an office, or maybe in a campus, [03:53] university, or or school. [03:56] Takes you from there to explain to you [03:58] what is IP addressing, why do we need [04:00] it. And then how do we actually design a [04:03] network if we are given a block of IP [04:06] addresses? What are the differences [04:08] between public and private IP addresses? [04:10] And then takes you from there in a [04:12] scaffolding approach and explains to you [04:15] what can you do with that in a cloud [04:18] era? How can you build a network in the [04:20] cloud, virtual data center, VPC? How can [04:23] you secure it using security groups and [04:25] network ACLs? So it takes you through [04:27] network security as well. And from there [04:30] we delve into practicing on the AWS [04:33] cloud. So you're not going to build any [04:34] Cisco routers or any emulation [04:37] softwares. This is going to be logging [04:39] into the cloud yourself, creating an [04:42] account, getting a hundred dollars free [04:44] credit that you can use to learn [04:47] throughout the course without paying any [04:48] penny, [04:49] and then we'll teach you how to use the [04:51] cloud. So you're not only learning [04:53] fundamentals, you're actually learning [04:55] and touching the cloud as well in the [04:57] meantime. Then it will give you a feel [04:59] of the networking in the cloud and also [05:01] the network security in the cloud. [05:04] And it doesn't leave you there, but it [05:06] then explains to you what is DevOps, the [05:09] development and operation practice that [05:11] is used for automating software [05:13] development, and how did that evolve [05:15] into site reliability engineering and [05:17] from there on to platform engineering. [05:19] So you will understand what a network [05:21] engineer would do, what a cloud engineer [05:22] would do, and what a DevOps engineer [05:25] would do, what a site reliability [05:26] engineer would do, what a DevSecOps [05:28] specialist would do, what a cloud [05:31] security specialist would do, all of [05:33] that. You will understand it as you go. [05:36] The beautiful thing is you don't have to [05:37] commit to any career before taking the [05:40] course. So you're not going to end up a [05:42] technical support specialist or a [05:44] network associate or network junior [05:47] engineer. You're not going to do that. [05:49] You will go through the course, you will [05:51] understand and touch and feel a lot of [05:53] things, and then you can decide if you [05:55] would like to take it further or if you [05:57] would like to do something else. [06:00] If you are a developer struggling with [06:01] IP addressing and network concepts and [06:03] network security and cloud and stuff [06:06] like that, this course is also for you. [06:12] This course wouldn't be possible without [06:14] people like you watching it. And if you [06:16] would like to support more free content [06:18] like this at the same quality or maybe [06:20] better, the best way to do that is to [06:22] consider buying the supplemental [06:25] material for this course, and you can [06:26] get that at [06:28] www.dolphinet.com/courses/itf-course, [06:34] the IT fundamentals course. [06:36] You will get free lifetime access to any [06:40] updates of the course. So any modules [06:42] that are added, AI, machine learning, ML [06:44] ops, and so on, are going to be [06:46] included. [06:47] You will get also quizzes for the [06:49] course, and you will get assignments [06:51] with recorded video answers. So you will [06:54] pause the video, look at the assignment, [06:56] understand the requirements, do it, and [06:58] then come back to watch the video and [07:00] verify whether you have done it right or [07:02] not. [07:03] Also PDF student guide, the entire [07:05] slides of the course. [07:07] You will be getting getting also a [07:09] support channel for question and answers [07:11] when you get stuck. And you are going to [07:14] have a career coaching session recorded [07:16] as well that will guide you at the end [07:18] of the course [07:19] as to which career path you should take [07:22] and what exactly you should learn as [07:24] next steps. [07:26] Also you will get an IT primer for a lot [07:28] of the tools that are used in modern IT [07:32] like Git, GitHub, Linux, Docker, [07:35] Kubernetes, Terraform, bash scripting, [07:37] and more, [07:38] which will help you understand what are [07:41] these tools as you cruise through a road [07:43] map in order to study these, and the [07:45] road maps are going to be explained in [07:47] the career coaching as well. So thank [07:49] you very much for watching, and now it's [07:51] time to get into the course. [07:58] All right, let's go ahead and start with [08:01] module one, which is the important IT [08:03] concepts. [08:04] In this module, we are going to [08:05] introduce terms that you are going to [08:08] face or you are going to come across [08:10] frequently when you are working with IT. [08:13] And these terms are hardware and [08:16] software. What's the difference? What is [08:18] hardware? What is software? [08:20] And do we have different types of [08:22] software or is it just one software? [08:25] And for the hardware, does it apply to [08:27] our phones or tablets or servers or [08:31] iPads? [08:32] What does it apply to? [08:34] So in this module, we are going to look [08:36] at multiple lectures, and they are going [08:39] to cover the computing device hardware [08:41] components, the common components in [08:43] computing devices that we come across. [08:46] Then we are going to look at what is [08:48] software. If we have discussed hardware, [08:50] let's go ahead and discuss software and [08:52] what are the types of software that [08:53] we'll come across. [08:55] And that will take us to talking about [08:57] operating systems and applications as [08:59] well. So let's go ahead and start with [09:01] our first lecture. [09:04] So let's discuss now the computing [09:05] devices hardware components. [09:09] Before we jump into that, let's define [09:11] what are computing devices. Computing [09:13] devices are devices that we use in our [09:16] daily life including [09:18] mobile phones, including laptops, [09:21] whether they are Windows or Mac or [09:22] Linux, including iPads, and it includes [09:25] as well tablets, desktop PCs, [09:29] digital cameras, IP TV set-top boxes, [09:32] smart TVs, servers, and more. [09:36] So what are the common components, [09:38] hardware components to be more specific [09:41] for these computing devices? [09:42] We are going to discuss five important [09:45] components that relate to IT in general, [09:48] and it's important to understand them at [09:51] the beginning of IT. [09:54] So let's start with what is a CPU, the [09:57] central processing unit. [10:00] Your phone, your tablet, my laptop, [10:04] your smart TV, all of them they have a [10:06] CPU. Even the smart fridges and all that [10:09] they have a CPU. [10:12] So, the CPU is the central processing [10:14] unit. Basically, this is the mediator [10:17] between the applications and software [10:20] and programs [10:21] that run on that computing device and [10:24] the hardware components of the computing [10:26] device. [10:27] Now, we are going to discuss the CPU as [10:30] the first one in the hardware [10:32] components. And basically, it is [10:34] involved in all the operation that [10:37] happen on that computing device. [10:39] All right. [10:40] Let's say you are holding your iPhone [10:42] and now you are going to open Chrome, [10:44] the browser, or Firefox, or Safari. [10:47] Where would that program run? And that [10:50] will be the random access memory. So, [10:52] the second component or hardware [10:54] component it is called the RAM. [10:56] And the RAM is used to run all software [11:00] that runs in your computing device. [11:05] The third one we look at is okay, fine. [11:08] Once upon a time, I was filming some [11:10] videos and I took some photos while we [11:13] were on a trip in a cruise [11:15] and then my phone died. The battery ran [11:18] out [11:19] and when I went home and I charged or [11:22] recharged my phone, I found that I still [11:24] have all the videos and all the pictures [11:28] that I have taken. [11:30] Was that because of RAM, the memory? And [11:33] the answer is no. [11:35] When you run the camera program in order [11:37] to take the videos and the pictures, [11:40] this program ran into the RAM. [11:43] But when you take pictures and all that, [11:45] they are saved on a persistent or a [11:49] permanent storage location in your [11:51] device. [11:52] And that is called the disk drives or [11:54] the storage drives available on your [11:56] phone or on your tablet or on your [11:58] laptop. [11:59] And they could be of two types. The [12:01] older ones are called HDD, hard disk [12:03] drives, and these are older storage [12:06] types, slower storage types as well. [12:08] Or they could be solid state drives, [12:11] SSDs, and these ones are more modern and [12:15] they are faster, but they are more [12:16] expensive as well. [12:19] So, this is used, the storage, to [12:21] provide persistent storage. Basically, a [12:23] storage that is not related to whether [12:25] your device is turned on or off and [12:28] whether it has power or it doesn't have [12:30] power. This is what persistent storage [12:33] means. That means as long as the device [12:35] is not defective, you will be able to [12:37] retrieve the data that you store on [12:40] these drives. [12:41] Then we come into the fourth component, [12:43] the hardware component. And why do we [12:45] call it hardware? Because we can touch [12:47] it, we can feel it. If we open the [12:48] device, we can see it. If you open your [12:51] laptop, you can identify where is the [12:52] CPU, where is the memory, where is the [12:55] storage and and so on. That's why it's [12:57] called hardware. Hard, something you can [13:00] touch or see or feel. [13:03] Then we talk about network interface [13:05] cards and this is how your devices [13:07] interact with the surrounding, [13:09] basically, with the outside world. [13:10] That's how your iPhone connects to the [13:14] Wi-Fi and then to the internet. That's [13:16] how my laptop connects to the Wi-Fi at [13:19] home and then I can print on my printer [13:21] or I can connect to the internet or [13:23] maybe log in to the corporate network. [13:26] So, these are called network interface [13:28] cards and they could be wired interface [13:30] cards or they could be wireless [13:31] interface cards. Of course, this image [13:34] is kind of old because it used to be [13:36] like that, but now it has been [13:38] integrated within the phone [13:40] electronics and within the laptop [13:42] electronics that you don't see it. [13:45] But it does exist because you can turn [13:46] on and off the Wi-Fi and you can connect [13:48] to Wi-Fi networks. [13:50] So, that connects the computing device [13:51] to the outside world and it can be [13:54] wireless, WLAN or Wi-Fi, and it can be [13:57] wired as well. [13:59] Then we talk about monitors. [14:01] In your phone, when you look at the [14:03] display, that's your monitor. On your [14:05] laptop, when you look at the screen, [14:07] that's your monitor. [14:08] And so on and so forth. TV, when you run [14:11] your TV, you look at the TV itself, [14:13] which is the big display or the big [14:15] monitor. [14:16] So, this is to read or view the desired [14:18] data from the device. And monitors can [14:20] be built into the device like phones or [14:22] they could be external to it. We still [14:24] see desktops in offices and all that [14:26] where they have the compute device [14:29] itself, but then you have it's connected [14:30] by cables into a an external monitor. [14:34] Last but not least is what accelerates [14:37] graphics. When you are playing games, [14:39] whether it is FIFA or Call of Duty or [14:42] whatever the game that you are playing, [14:44] then the graphics needs to be fast [14:46] because the game is all about graphics, [14:49] right? When you are playing movies or [14:50] when you are rendering videos, you you [14:52] need to have acceleration for the [14:55] graphics as well and for the video and [14:57] so on. [14:58] And this is where the GPUs or the the [15:00] graphic processing unit or the G CPUs [15:04] come into play and they could be built [15:05] into the device or they could be cards [15:08] that connect to the device. [15:12] So, there are other components, hardware [15:15] components, like the power supply, the [15:17] the USB ports and so on, the fans and so [15:20] on. But these are not of relevance now [15:22] to our career in IT. [15:25] We can read about this later on if [15:27] required, but for now and for our [15:29] discussion and getting into the cloud [15:31] and DevOps and programming and all that, [15:33] you don't need to talk about power [15:34] supplies and fans and USB ports and all [15:36] that stuff. So, this we are going to [15:39] exclude from our discussion for now. [15:43] Okay, great. Now, how can I measure the [15:45] CPU? Is it by kilograms or pounds or [15:48] centimeters or meters or yards? How can [15:51] I identify the strength or the power in [15:56] the CPU or in the memory or in the [15:58] storage and so on? And these components, [16:00] they have units. So, for example, the [16:02] CPU is measured by speed [16:05] and the speed is measured in gigahertz. [16:08] So, the more the number next to [16:09] gigahertz, 2 gig, 3 gig, 4 gig, the the [16:13] faster and the more modern the CPU would [16:16] be. [16:17] So, if you talk about 1.6 gigahertz, 2.3 [16:20] gigahertz as examples. Then, when it [16:22] comes to the memory and the storage, [16:24] they are measured in what we call [16:26] gigabytes or gibibytes. [16:29] And if it is large, 1,000 gigabytes is [16:31] terabytes [16:33] or tebibytes. [16:35] So, for example, if you talk about an [16:36] SSD drive, the size is 10 terabytes, [16:39] this is a good size storage device. [16:43] Network interface card, it's all about [16:45] the speed. How fast it can transfer [16:48] data to the outside world and receive [16:50] data from the outside world. And that's [16:52] why it's measured by how many bits or [16:54] bytes per second I can transfer. [16:57] And the higher the number, the the [16:59] faster the network interface card is. [17:01] So, for example, 100 gigabits [17:04] per second card or NIC card. [17:09] All right. So, now we understand the [17:11] hardware. How can we use it? So, if I [17:14] get the phone, do I just need the [17:16] hardware? Do I When I get the iPad, do I [17:18] just need the hardware? When I push the [17:22] on or the power on button, [17:24] then I start to see stuff and, you know, [17:27] like there's there there could be [17:28] graphics, there could be text, there [17:30] could be paragraphs, there could be [17:32] licensing information. It all starts to [17:34] show up. Where is this coming from? And [17:37] to use the hardware, we need software. [17:39] And that will lead us into the next [17:41] discussion, which is software, software [17:44] types, and so on. [17:49] Let's talk about software in general and [17:52] about operating systems. [17:56] So, what is software? Anything that is [17:58] not hardware. We said the hardware is [18:00] something you can touch, you can feel, [18:02] or you can see at least. [18:04] So, software is something the [18:06] programmers or the developers are going [18:08] to write in a specific computer language [18:12] in order to provide instructions that [18:14] will tell the computer, the CPU, and so [18:17] on, what to do exactly. For example, [18:20] I have a software that I installed. [18:24] It's about Uber. [18:26] And for Uber, I need to reserve or book [18:30] a ride, right? [18:31] There has to be software commands, [18:34] programming that has been done [18:36] in that Uber application in order [18:40] when I try to define where my location [18:43] is and where I'm I'm going to and what [18:45] type of a ride I'm looking for. And it [18:47] is the invisible part that you don't see [18:50] and you can't feel, but you can use it. [18:54] If we talk about applications, Uber or [18:57] else, [18:58] games, operating systems, [19:01] websites, all are software and these are [19:03] all examples. So, now it is the time to [19:06] dive deeper and find what are the types [19:08] of software that you are going to [19:09] interface or act [19:12] upon when we are in IT. And that will [19:15] take us to the first type, the system [19:17] software or the operating systems. [19:20] So, the operating system on a computing [19:22] device is the system software. For [19:25] example, you have a laptop that has [19:27] Windows on it. So, what is your [19:29] operating system? It is Microsoft [19:30] Windows. [19:31] I have a laptop that is Mac OS. What is [19:34] my operating system on my laptop, on my [19:35] computing device? It is Mac OS. You have [19:38] an iPhone. What's the operating system [19:40] on the iPhone? It's iOS. I have an I [19:43] Android phone, a Samsung phone. Then [19:45] what is the operating system? Android. [19:47] So, that is what the system software is. [19:50] So, the system software will manage the [19:53] hardware resources or the hardware [19:55] components of the computing device it is [19:58] installed on. [20:02] So, the operating system is responsible [20:04] for running the installed applications [20:06] and coordinating that with the hardware. [20:09] So, whatever the application is supposed [20:11] to do, it needs to run some [20:13] instructions, it needs to output [20:15] something through the Wi-Fi to go to the [20:18] internet, to Uber, to Uber the right, so [20:20] it will [20:22] facilitate that to happen and it will [20:24] handle the files and permissions. Let's [20:27] say I have saved a video on my laptop, [20:30] but I don't want you to see it. [20:32] So, I'm going to put access permissions [20:35] on that file where only my username on [20:38] the laptop will be able to use it. [20:40] So, even if my wife or one of my friends [20:42] tries to use my laptop, they will not be [20:44] able to get to that. [20:46] The operating system is the part on your [20:48] phone where you can add your face [20:50] recognition [20:51] and then if someone else puts the camera [20:53] in front of their face, it will say that [20:55] there's no match or the fingerprint or [20:58] the password. [20:59] And the operating system will provide [21:01] you a user interface and that could be a [21:04] graphical user interface. [21:07] Like for example, as you can see on the [21:09] screen, I have the launchpad where I can [21:12] click on a lot of programs that I have [21:14] on my Mac MacBook and then it can start. [21:18] So, for example, I can [21:19] click on FaceTime and then FaceTime will [21:22] start. [21:23] I have multiple screens, so it started [21:25] on a different screen, but here you go. [21:27] All right, so this is called a graphical [21:29] user interface, something you can [21:30] interact with using your mouse and maybe [21:34] some clicks or maybe if it is a touch [21:36] screen, you can touch on the screen on [21:37] your iPhone and that's it. So, that is a [21:40] graphical user interface. So, what about [21:41] the CLI? [21:43] Here's an example of a CLI. So, this is [21:45] a terminal program [21:47] that we have in macOS and you have [21:50] something similar on your Windows device [21:52] if you are using Windows called CMD. [21:55] So, if you go to the search bar and you [21:56] type CMD [21:59] then a black window is going to open and [22:01] then you will be faced also with a [22:03] cursor [22:04] like that [22:05] that is flickering or flashing and you [22:07] can type commands. So, for example, here [22:08] I can type make directory [22:12] IT foundation. [22:14] And if I do CD IT foundation [22:17] I have created a folder [22:20] somewhere to store files [22:23] into my operating system [22:25] and that is called ITF and it exists [22:27] under the path downloads on my user, [22:31] which is Dolphin net. [22:34] So, this is dealing with computers using [22:37] or with computer computing devices using [22:39] CLI command line interface. So, here if [22:42] I type date [22:44] it will tell me that we are on September [22:45] on this date in this year, for example. [22:48] So, it How did it understand this? The [22:50] operating system understands this [22:52] command and that's how it understood [22:55] that it needs to show me the date, day [22:57] and time and hour and so on. [22:59] Make directory [23:01] or make dir this it understood the [23:03] operating system understood that I need [23:06] to create a folder where I'm going to [23:08] create some files and this is called [23:10] ITF. So, reserved a place, a location [23:13] where I can start to create files. [23:16] So, for example, I can do touch and then [23:18] I create file ITF. text [23:21] and if I do LS, you'll find that LS [23:23] means list the files that exist in this [23:25] folder. [23:27] And you'll find that I have a file [23:29] called ITF. text. [23:31] So, as you can see, we can deal with the [23:34] operating systems using CLI graphical [23:36] user interface like the screen in front [23:38] of you or using GUI graphical user [23:42] interface, which is more common when it [23:44] comes to Windows and so on. [23:47] So, the operating system will keep [23:49] everything working together, the [23:51] hardware and the applications and [23:53] everything, they work in harmony because [23:55] of it. And examples as we mentioned, [23:56] Windows, Linux and macOS and these are [23:58] common icons you could be familiar with [24:01] at least one of them if not all of them. [24:04] GUI or CLI, which one should I use and [24:07] which operating systems will give me [24:09] this one or that one as an option? So, [24:11] the graphical user interface, you are [24:13] using icons, windows and mouse. [24:15] And if you are doing CLI, then it's [24:18] going to be commands basically as we [24:20] have seen. [24:23] So, if we need to compare Windows versus [24:25] Linux, a lot of people ask that at the [24:28] beginning of their career and you get [24:30] the two advices. No, study Microsoft [24:32] server administrator and others will [24:34] tell you keep away from Windows, go for [24:37] Linux. I am an advocate of the second [24:39] one because the modern IT [24:41] we whether you're talking about cloud, [24:42] whether you're talking about machine [24:44] learning, AI, data analytics and so on, [24:47] the modern IT, even if you'd like to [24:50] learn a lot of tools that we're going to [24:51] discuss later on, containerization, [24:53] Docker, Kubernetes and so on, it needs a [24:56] high level of comprehension [24:59] understanding and familiarity [25:02] and experience with Linux, not Windows. [25:05] One would jump and say, "Okay, but [25:06] Windows also can run this and that." I'm [25:08] saying what is common, what is more in [25:10] demand in the industry and that's why I [25:12] would say go for Linux. But if we [25:14] compare the two [25:16] if you compare Windows and Linux from a [25:18] features perspective and usability [25:20] perspective Windows will be mostly [25:22] graphical user interface. People like to [25:25] use graphical user interface on Windows [25:27] more than the command line. [25:29] Linux, although you can run applications [25:32] like browsers and so on, but it's mostly [25:34] CLI and that's the power of Linux, [25:36] although people don't like to memorize [25:39] commands and all that. It comes with [25:41] experience. We're going to cover Linux [25:43] later on in the course. [25:46] The cost usually is paid on Windows and [25:49] it's free or open source primarily in [25:52] Linux. We're going to come to what open [25:54] source means. [25:55] Popular use, desktops and laptop, [25:58] personal use more, even the corporates [26:01] and all that, they prefer to use [26:03] on the user side Windows mostly. [26:07] But on Linux, a lot of people now are [26:09] shifting into Linux because it doesn't [26:11] have any licensing and they don't like [26:13] to use macOS or Windows or maybe because [26:15] it of affordability but it's very common [26:18] on servers where we run the [26:20] applications. We're going to come to [26:21] what servers are in details. [26:23] Flexibility, you have limited control on [26:25] Windows, but it's highly customizable [26:28] when it comes to Linux. [26:32] So, what is open source software? That [26:34] means I build a software and then I [26:36] allowed for the public where they can [26:38] download the source code, the code [26:40] itself, the program that I have written [26:42] and they can update, they can change and [26:45] it is all for free. [26:47] That's what an open source is. [26:50] Linux is a perfect example of the [26:52] operating system that is running as an [26:55] open source. [27:00] All right, so we have discussed the fact [27:02] that one type of software is the system [27:04] software, the operating system. [27:06] Now, what about the applications that [27:09] that run on top of it? The Gmail or [27:12] maybe the Outlook or could be Uber or it [27:15] could be Uber Eats, DoorDash and so on. [27:18] There's plenty of applications that we [27:20] use on our phones or maybe [27:24] applications we can access through our [27:26] browsers, banking and so on. [27:29] Amazon and others. So, what is the other [27:32] type of software and we mentioned it [27:34] already, which is the application. [27:37] So, the other type of software is [27:39] applications and an application built by [27:41] a developer [27:43] is built for a specific purpose, right? [27:46] Maybe I'm doing an application, personal [27:48] one because I'm going to track my [27:50] calories or the steps I'm going to walk [27:52] or the meals I'm eating. [27:54] Maybe an accountant is going to build an [27:56] application to provide it to its [27:58] customers so they can upload documents [28:00] about their expenses or so it's easier [28:01] for them to do the bookkeeping. [28:04] >> [snorts] [28:04] >> So, an application is a software program [28:06] that is built to do a specific task. The [28:09] task could be online banking. The bank [28:11] will build the application so customers [28:13] can download them and they can manage [28:15] their accounts, they can upload checks [28:17] and so on from their phones. [28:19] Examples for applications, we have [28:22] Chrome, the browser, we have Excel, [28:24] Microsoft Excel spreadsheets, we have [28:26] Zoom and we have WhatsApp. These are [28:28] examples of applications that we are all [28:30] familiar with and use. [28:33] So, applications run on top of system [28:35] software. So, the applications will [28:37] require the system software and the [28:40] system software gets the instructions [28:42] from the application and coordinates [28:44] that with the hardware. So, that's how [28:46] it works within a computing device. [28:49] Are there different types of [28:50] applications? Yes. [28:53] So, desktop applications, they run on [28:55] your laptops, macOS, Linux, Windows. [28:58] So, they run on PC or Mac and examples [29:01] are PowerPoint, Word and Excel. [29:03] Mobile applications run on mobiles and [29:06] tablets and examples are Google Maps and [29:08] Uber. [29:10] One might say, "Okay, but I can run my [29:11] Google Maps [29:13] on my laptop." I would say, "Yes, there [29:15] are web applications that you can access [29:17] them through their app or through the [29:20] web, through [29:22] Firefox or through Safari, for example. [29:25] So, they are running a browser and [29:27] examples are Gmail, Canva, your banking [29:29] online banking, all of that, your school [29:32] or university account, all of that can [29:34] be [29:35] accessed through a web application, [29:37] through a browser basically. [29:40] And these applications can be built to [29:43] run in the cloud. [29:44] So, cloud applications, that means an [29:47] application built to run in the cloud. [29:49] So, Google Docs for example and Zoom, [29:51] they all run in the cloud. Okay, so [29:53] let's do a quick recap. We have learned [29:55] that computing devices have hardware [29:58] components. Hardware components are [29:59] things that we can see, we can feel, we [30:03] can touch maybe. [30:05] So, this is hardware. Anything that I [30:07] can hold on to or see or touch, that is [30:10] a hardware. [30:11] We agreed that there are plenty of [30:13] components, but we only looked at five [30:16] of them. We looked at monitors, we [30:17] looked at CPU, RAM, storage devices, [30:20] network interface cards, 605, and we [30:24] looked also at GPUs. [30:25] GPUs may or may not exist in devices [30:28] depending on how complicated and [30:30] advanced the device is. [30:32] Then we looked at software. We said that [30:34] the hardware cannot be used by itself. [30:36] We have to have programs that will use [30:38] the hardware and we take advantage of [30:41] using these programs. [30:43] And we looked at two types of software. [30:45] Software that is built by developers as [30:48] an operating system, so to make that [30:51] device operate, to make the hardware [30:53] usable. [30:54] So, the operating system in itself is [30:57] not what you are going to use, but it is [30:59] required and mandatory in order to be [31:01] able to use the hardware. [31:03] And the second level or the second type [31:06] of software that we have looked at is [31:07] the applications. That's the actual [31:10] programs used to do a specific task. The [31:12] developers, when they built the [31:14] application, they did not think about [31:17] controlling the hardware. They thought [31:19] about, "Okay, this application will be [31:21] for a medical clinic or for a hospital [31:23] or for a sporting club or maybe for a [31:27] ship in the sea or maybe for a port that [31:30] will upload and unload and track what [31:32] has been shipped, exported and [31:33] imported." So, the applications can be [31:36] used on desktops, on mobile applications [31:39] or through the browser and they're [31:40] called web applications, all right? So, [31:42] this is what we have learned so far. We [31:44] didn't yet do a deep dive into any type [31:47] of hardware or software, so let's go [31:49] ahead and look into that in the [31:51] subsequent sections. [31:57] So, let's now talk about module number [31:59] two. And module number two will be about [32:02] servers and virtualization. So, we [32:04] learned about hardware and software and [32:06] applications in the previous section. [32:08] Now, let's talk about a computing device [32:11] that is commonly used when we talk about [32:13] IT in general to deploy applications and [32:16] software. [32:18] And this is the servers. [32:20] And servers, as we will explain, they [32:24] posed some limitations for scaling, for [32:27] cost and all that, which had led to the [32:30] emergence of what we call virtualization [32:33] or dividing a server into virtual [32:36] servers. So, let's go ahead and look at [32:38] these two topics in this section. We'll [32:41] cover what a server is, physical [32:43] servers, and then we'll talk about what [32:45] were the limitations and how did we get [32:47] into virtualization and what [32:49] virtualization is. [32:51] So, let's talk about physical servers. [32:53] You will come across the concept bare [32:55] metal servers. Physical or bare metal, [32:58] they refer to the same thing. [33:00] So, we knew about hardware components [33:03] for a laptop as a computing device. Is a [33:05] server a computing device? And the [33:06] answer is absolutely. [33:08] The physical server is nothing more than [33:11] a muscle computing device. A computing [33:13] device that has high specifications, [33:16] basically. [33:18] And this is an image of how [33:21] a rack mountable server that can be [33:24] installed inside a cabinet. Cabinet, we [33:26] call it a rack. [33:28] So, the physical server is basically a [33:30] powerful computer, powerful computing [33:32] device that has [33:34] a good size of memory, the RAM, where [33:37] you can run big applications or many [33:40] applications, one or more CPUs. [33:42] Sometimes they have 16 CPUs, 32, 64 and [33:46] so on. [33:47] And it has one or more disk drives for [33:50] persistent storage and that could be in [33:52] the terabyte [33:54] size. [33:56] And one or more network interfaces to [33:58] connect to the outside world, one or [34:01] more GPUs. So, the more expensive the [34:03] server is, the higher the specs or the [34:06] sizes and specifications of these [34:09] hardware components would be. [34:13] So, a physical server is hardware. [34:16] What do we need to use the hardware? We [34:19] need to run an operating system. [34:21] So, an operating system, whether it is [34:23] Linux, Windows or any sort of an [34:26] operating system that can be installed [34:28] on server machines to be able to use the [34:31] server. [34:32] So, we have to have one. Of course, the [34:34] most common one in the cloud is Linux, [34:36] but also Windows servers are common in [34:38] the traditional IT more than in the [34:42] modern IT or the cloud. [34:44] We can install one or more applications [34:48] on top of that operating system in order [34:51] to fix them or install them or use them [34:54] into that server. [34:56] And this is how it would look like. So, [34:57] we have the physical server. [35:00] It will have one or more CPUs, a good [35:03] amount of disks size and memory, and it [35:07] will have one or more network cards, one [35:09] or more GPUs. [35:11] Then we install the operating system [35:14] of choice and then we can run one or [35:17] more applications on the server. [35:21] And depending on the specs of the [35:22] servers, the muscles and the size of the [35:24] muscles and how hard it can process, how [35:27] fast it can process, it can support on [35:30] these applications, they can support [35:32] tens of users, maybe hundreds of users, [35:35] maybe thousands of users. All depends on [35:37] the specification [35:39] of the servers, how many CPUs, how fast, [35:41] how much memory and so on. [35:43] So, the high specifications in a server [35:45] as a computing device allows it to serve [35:48] a lot of users concurrently. [35:51] All right, so here is an example of how [35:53] we can benefit from using servers with [35:56] the operating system installed and the [35:59] application on top of that to build a [36:02] Dolphin Aid Academy website on the [36:05] internet. So, this is an e-learning and [36:08] edtech company on the internet. And we [36:11] are going to install the website [36:14] software on the server. [36:17] And the server will be connected to the [36:19] internet and then clients are going to [36:21] be using mobile applications or maybe [36:23] their desktops and laptops in order to [36:26] get to it through the browser. [36:28] In either case, any web application is [36:32] an application like websites, e-commerce [36:34] websites or any application accessible [36:36] over the public internet. [36:39] So, how would that interaction happen? [36:41] The user is going to start the [36:42] application, the mobile application or [36:45] the browser, and they will send in a [36:47] request to the server and the request [36:51] will be for example to open the page and [36:53] then to log in. [36:54] And then the server is going to the [36:56] application on the server, to be more [36:58] specific, is going to send the the [36:59] response through the operating system, [37:02] through the peripheral or the network [37:04] interface card or cards available on the [37:06] server back to the internet to the [37:09] client. So, this is an example of how we [37:12] can use the hardware and software in the [37:16] form of operating system and application [37:19] on a server connected to the internet to [37:21] provide services through the web to [37:24] clients, be that client a mobile app or [37:28] a desktop client through a browser. So, [37:30] this is all good stuff. Now, is servers [37:33] the magic solution to everything? And [37:35] that is what we'll explain next. [37:41] All right, so now it's time to talk [37:42] about virtualization. And definitely, if [37:46] we moved or move from a physical server [37:49] on top of which we install an operating [37:50] system and an application [37:53] to a different solution, a different way [37:55] of hosting the operating system and [37:57] applications, that means there should [37:59] have been some limitations in using [38:01] physical servers as is. So, let's go [38:04] ahead and find out about these [38:05] limitations. [38:07] So, physical servers, as they are bare [38:09] metal with an operating system and [38:11] applications on top, posed or showed [38:15] limitations when scaling and when [38:17] installing multiple applications on a [38:19] server. These include underutilization. [38:22] If we have only one application on a [38:23] physical server, a muscle computing [38:26] device that costs a lot of money, then [38:29] the average utilization, if it is in the [38:31] form of 10, 20, 30%, that means [38:33] underutilization. We have a lot of [38:35] muscles, but you are only requesting [38:37] that server to use maybe one muscle of [38:40] this bunch of muscles. [38:43] When we install multiple applications, [38:45] we would we would need to see isolation [38:48] between them. So, the files will not [38:50] intermix in the file system such that [38:53] when someone for application A is trying [38:56] to troubleshoot, maybe they will remove [38:58] some files, delete some files or update [39:00] them, maybe they will impact another [39:02] application. So, we need isolation. And [39:05] also, some applications are going to [39:06] deal with critical data. Others will not [39:09] deal with critical data. So, we want [39:11] isolation between them or among these [39:13] applications on the same server for [39:15] security reasons as well. [39:18] So, in order to do that, the only way [39:20] with physical servers is to have [39:22] multiple servers, separate servers, and [39:25] that will be 100% isolation. Also, if we [39:28] need to build environments for testing [39:30] and development and production, then we [39:32] have to multiply or duplicate the [39:35] environments again and again, which is [39:37] extra cost. [39:39] And if we would like to maintain [39:41] isolation and security and scale, scale [39:43] means that these applications becoming [39:46] so popular, a lot of users are coming [39:48] into Uber Eats for example. So, one [39:50] server is not enough. We have to add [39:52] more servers. Adding more servers means [39:55] it's now going to go through the [39:57] procurement cycle and lead times for [40:00] delivery, installation, deployment, and [40:03] it's going to be more expensive because [40:05] now we are talking about multiple [40:06] physical muscle computing devices. [40:10] So, that will raise the cost if we would [40:11] like to scale an application that [40:14] becomes popular. And of course, the lead [40:17] times for delivery and shipping and [40:20] procurement and all that is going to [40:21] make that slow. So, to scale an [40:24] application, to scale an infrastructure, [40:26] it will take long time. [40:29] And also backups, backing up, so taking [40:32] copies of the application software and [40:34] the data on the servers in order to [40:36] retain it in case if we have a hardware [40:38] problem, then we can restore that [40:41] application again to a workable [40:44] situation or status, then that is also [40:47] hardware dependent depending on what is [40:49] the hardware configuration, what's the [40:51] server configuration, how many CPUs, how [40:53] many this, how many that, and it is then [40:55] difficult to restore in case if we have [40:57] a failure. [40:58] All of these limitations, [41:00] underutilization, isolation, security, [41:02] scalability, and the rising costs led to [41:05] the concept or the emergence of what we [41:07] call virtualization. [41:10] So, what is virtualization? [41:13] Virtualization is a means that would [41:15] allow us to divide a physical server [41:19] into virtual servers. [41:21] So, now we don't have to use the [41:23] physical server as is, we can split it [41:26] virtually. So, we're not going to to [41:28] bring a saw and cut into the server. [41:30] It's a software that will [41:33] divide the resources virtually in [41:35] software only [41:37] across different virtual servers. That's [41:40] exactly what it is. So, when we have the [41:42] physical server, the bare metal, [41:45] where we have the hardware and then the [41:46] operating system and the application or [41:48] applications depending on how many we [41:50] have, [41:51] here's how we are going to virtualize [41:53] it. So, we are going to add a layer [41:55] called the hypervisor [41:58] or the virtualization engine. [42:01] Once you have the hypervisor, [42:03] multiple virtual machines, virtual [42:06] servers, will be possible to create and [42:09] they are going to share the physical [42:11] hardware resources on the server. [42:14] So, this is as if we have this server [42:17] split into three actual servers, but [42:20] they are not physical, they are virtual. [42:23] And the good thing about virtualization [42:25] is it allows you to have a different [42:28] operating system on each one of the [42:30] virtual machines. [42:32] Here, we have to choose either it is [42:34] Microsoft Windows or Mac or Linux. So, [42:37] you have an operating system of choice [42:39] and it's one operating system. On [42:41] virtual machines, the same physical [42:43] server will have different virtual [42:45] servers, each of them you have the [42:47] option to install a different operating [42:50] system onto. [42:54] So, virtualization will enable us to run [42:56] more than one virtual system, virtual [42:58] machine, virtual server, and multiple [43:00] operating systems on a single physical [43:03] server. And that is magical if you think [43:05] about it. [43:07] And of course, when we come to the low [43:08] utilization or underutilization, now we [43:11] will have multiple servers with multiple [43:13] applications isolated, which means we [43:16] have better utilization of the physical [43:19] server that we had before that was [43:21] underutilized, where isolation was [43:24] difficult to do as well and backups were [43:26] a challenge. [43:27] So, each virtual machine is isolated, [43:29] they are isolated from one another, and [43:31] the hypervisor, this magical layer that [43:34] we add here, [43:36] will use virtual instances of the [43:38] hardware components on the physical [43:40] server. So, the memory is going to be [43:42] split virtually into multiple virtual [43:44] memories. [43:46] The CPU or CPUs are going to be split [43:48] into multiple VCPUs. The disk is going [43:52] to be distributed or split also into [43:54] multiple virtual instances of the disk, [43:57] and then we'll start to assign the [43:59] hypervisor will start to assign these [44:01] into the different virtual machines. [44:05] The backups, we can take a snapshot, a [44:08] backup, a copy of the entire virtual [44:10] machine, and then we can move it, upload [44:12] it into somewhere else, and then we can [44:14] fix it on another hypervisor, compatible [44:17] one, and then it will run as if it [44:19] existed on that hypervisor. So, let's [44:22] take a closer look at how it would look [44:25] like when we have multiple virtual [44:27] machines on a physical server. [44:29] So, this is our physical server, and [44:31] these are the physical hardware [44:33] components on the server. [44:36] Now, we install the hypervisor. [44:39] So, that is a software component that [44:41] will be installed, will be fixed on the [44:44] physical server, [44:46] and that's an emulation layer. [44:48] And then, we can through the hypervisor [44:51] start to create multiple virtual [44:53] machines. How many virtual machines? If [44:56] you are going to split the VCPUs and the [44:58] memory and the disk [45:00] among them, then the limitation would be [45:02] how much CPU, how much memory, how much [45:04] disk, and how much GCPU and interface [45:07] cards you have. [45:08] So, if you have, let's say, 10 TB of [45:10] disk space, and then you give each one 2 [45:12] TB, that means you can do five virtual [45:14] machines. [45:16] Of course, there are ways called over [45:17] subscription to do more than five, and [45:20] then assuming that they are not going to [45:22] use that allocation all of them at the [45:23] same time, but that is out of our scope [45:25] for now. Let's [45:27] keep in mind now that the physical [45:29] resources on the physical server [45:31] is the limitation on how many virtual [45:34] machines you can create on a physical [45:35] server. So, you cannot do 1,000 [45:38] machines each of them with 2 TB if you [45:40] are talking about a 10 TB disk space [45:43] available on the physical server. [45:46] So, the hypervisor is going to allow you [45:49] to create virtual machines. When you are [45:50] creating the virtual machine through the [45:52] hypervisor, you can decide how many [45:55] virtual CPUs you are going to allocate. [45:58] How many virtual memory you are going to [45:59] allocate, how many virtual disks or how [46:02] much disk space on a virtual disk you [46:04] are going to allocate, and also on the [46:06] network cards. Similarly for the second, [46:08] third, and so on. [46:09] Once the VM is created, then you will [46:12] have access to it as if it is a physical [46:14] server, and you have to have an [46:17] operating system installed on it, and [46:19] then you can decide is it one [46:20] application per VM or multiple [46:22] applications per VM. [46:25] So, this is a virtual machine, and then [46:27] the process is repeated for the second, [46:29] third, and so on until n virtual [46:31] machines on the same physical server. [46:33] Okay? So, a virtual machine must have a [46:35] full operating system, a full one, and [46:38] it gets an allocation of the CPU, [46:40] memory, disk, and GPU, and memory card [46:43] in the form of virtual instances of [46:46] these resources. [46:48] Okay? So, the hypervisor is how we can [46:50] share the physical server across or [46:52] among the VMs, and each one of them will [46:54] get virtual network interface card, [46:56] virtual disk, virtual memory, and [46:58] virtual CPU. [47:02] What are the common vendors or the [47:03] popular vendors when it comes to [47:05] virtualization? We have VMware, [47:08] vSphere as a solution or an engine for [47:11] as a hypervisor. We have Zen, and then [47:13] we have Microsoft Hyper-V, [47:15] and we have Linux KVM, and then we have [47:18] Oracle VM VirtualBox. So, these are [47:20] different hypervisors that we can use [47:23] from different companies as we can see [47:25] here. [47:26] And of course, we have the VMware [47:28] Workstation as well. So, we have a [47:30] VMware vSphere, which is [47:32] um industry scale basically, and VMware [47:35] Workstation is something you can do on [47:38] your laptop or on your machine. [47:41] The hypervisors are in two different [47:44] types. Are you installing that [47:46] hypervisor on a physical server or are [47:49] you installing that on your laptop? So, [47:51] that will define whether it is type one [47:54] or type two hypervisor. [47:56] So, a bare-metal hypervisor, this is [47:58] type one, it's installed directly on the [48:01] bare-metal hardware without needing a [48:04] full host operating system. So, [48:06] basically, the hypervisor will have a [48:08] mini OS within, so it can deal with the [48:10] hardware of the physical server, and it [48:12] doesn't need a full operating system. [48:15] And this is how it would look like. So, [48:17] we have the hardware, the physical [48:18] server, and we are going to install the [48:20] hypervisor right on the hardware, and as [48:23] we said, it has a mini OS with it, and [48:25] then we can start through the hypervisor [48:28] create different VMs, and then have the [48:30] operating system on each of them, and [48:32] they can be up and running. [48:34] Examples are Microsoft [48:37] Hyper-V and VMware vSphere and Zen. [48:41] Type two, when we talk about a full [48:44] operating system [48:45] on the physical hardware, and this is [48:47] common more on the laptop side. So, if [48:49] you want on your Mac OS or on your [48:51] Windows laptop to install a virtual [48:54] machine or a hypervisor, and then you [48:55] start to create, for example, a VM to [48:58] practice for a Linux lab or for [49:00] networking or so on, then you can do [49:03] multiple VMs, small specifications, and [49:05] you can run with that if your laptop has [49:07] enough resources. [49:10] So, in that case, your laptop will have [49:12] an operating system. It could be [49:13] Windows, could be Mac, could be Linux, [49:15] and then you are going to mount the [49:17] hypervisor on top. An example is [49:19] VirtualBox from Oracle, for example, and [49:22] then you start to create VMs, and you [49:24] start to install operating system on [49:26] them, and then it will they will be [49:28] functional. But of course, this is when [49:30] we are talking about production grade, [49:32] this is when we are talking about [49:33] personal use. [49:34] So, Oracle VirtualBox and VMware [49:36] Workstation are examples of what you can [49:39] do with this. [49:42] Now the question, we have talked about [49:44] physical servers, bare metal, and we [49:46] talked about virtualization and all [49:48] that. But where is the physical location [49:51] a company would put these physical [49:54] servers? [49:56] So where would that be placed? Would it [49:58] be placed under a desk in an office or [50:01] maybe in a storage room in an office or [50:03] are there locations which are equipped [50:07] and purposely built and the fit out is [50:11] to become a place where you can host [50:13] those physical servers and the [50:15] application on them? [50:17] And that is data centers. So our next [50:20] discussion is going to go around data [50:22] centers. What are they and how do they [50:24] look like and so on. [50:31] All right. Now since we are going to do [50:33] most of our hands-on lab and practice in [50:36] AWS, in the cloud, we are going to work [50:38] extensively in the cloud in this course. [50:41] And that will be a great opportunity for [50:42] you to learn the cloud as well while you [50:44] are learning the IT fundamentals. So [50:46] what we'll do is we are going to create [50:48] an AWS account. Free, don't worry, you [50:50] will not have to pay anything. [50:52] And that will make it easier [50:53] if you have an old laptop, if your [50:55] laptop is busy or not performing, it's [50:58] full, the disk is full, you don't have [51:00] to upgrade to another laptop, just [51:02] continue to use it in the cloud. That's [51:04] it. So what do we need to do? We need to [51:06] go to aws.amazon.com, [51:09] aws.amazon.com. [51:12] And you will get a page like this one [51:14] where you click on create account. So we [51:17] need to open an account. We have to have [51:18] an account in order to use AWS services. [51:22] So I'm going to click on create. [51:26] And this is a free account from here. [51:28] Get started for free. [51:30] And this will tell you about the the [51:33] options you have. You have a free plan, [51:35] you have a paid plan. What's the [51:37] difference between the two? [51:38] The free plan is an account, it doesn't [51:41] give you access to all AWS services. So [51:43] there will be some services that you [51:45] will not be able to use. [51:47] And scaling of services [51:50] is going to be capped. So when you are [51:52] working and you are trying to scale and [51:55] do like advanced stuff, [51:58] it will not scale accordingly because [52:01] there are some thresholds based on the [52:02] credits. [52:04] So these are the disadvantages and the [52:05] account is going to be closed after 6 [52:07] months from creation. [52:10] You will receive [52:12] $100 credits [52:15] as soon as you open the account. So you [52:17] can use AWS services worth $100. [52:21] If you use them in 1 month, that's it. [52:24] The account is unusable, you cannot add [52:26] credits unless you change it, upgrade it [52:29] into a paid plan. [52:32] And there are some activities that if [52:34] you do, exploring some AWS services, and [52:37] if you do them within the 6 months, you [52:39] will get another $100 credit. So you [52:42] will have $200 credit and that's a lot [52:44] of money for someone who's learning AWS. [52:46] I mean that could easily help you do a [52:49] lot of AWS stuff that would take a year [52:53] to to work on. [52:55] And you you will have free usage of [52:57] select services and there's no charges [53:00] whatsoever. So if you are worried about [53:02] incurring any charges, that will be the [53:04] account. [53:05] But of course, you have limitations. [53:07] You can always upgrade within the 6 [53:09] months to the paid plan. [53:12] And in the paid plan, the same thing. [53:13] You get 100 credits and another 100 if [53:16] you do the AWS services exploration, [53:19] includes free usage. You can scale and [53:22] all that, but you are going to be [53:23] charged if you go beyond the thresholds. [53:28] Workloads can scale beyond credit [53:30] thresholds because it's paid, you will [53:31] pay for it. And you have access to all [53:33] AWS services. [53:35] If you need to know more about the [53:36] differences, there is a an FAQ. [53:39] So these are services that are available [53:41] in both. [53:42] And you can keep exploring which [53:44] services and you can always click on [53:46] show more and it will tell you if this [53:47] is available in both or not. [53:51] And [53:54] you will get an [53:56] Yeah, this is the FAQs. [53:59] And in the FAQs, they will tell you [54:01] about [54:03] So here the free plan accounts, paid [54:04] plan accounts, earning additional [54:06] credits, what you need to do exactly, [54:08] and what are the activities [54:10] that you need to do in order to explore [54:11] that. [54:15] How do I earn additional free credits? [54:17] And you go through this. Console home [54:19] walk-through and dashboard and you can [54:21] find out what needs to be done. So you [54:23] have everything you need and you can [54:26] find it by yourself without having to [54:28] ask me for any questions regarding these [54:30] accounts. [54:31] All right. Let's go back to creating the [54:33] account. [54:35] You need to write an email [54:37] that is going to be the communication [54:39] between AWS and you for bills and for [54:41] updates and so on. And a nickname of [54:43] your choice for the account. [54:46] So once you have entered the email and [54:47] the nickname, click on verify email. So [54:50] what they will do is they will send you [54:51] a verification email to ensure that this [54:54] email is an active email and you have [54:55] access to it. [54:57] And once you verify, you will be taken [54:58] to the next step. [55:02] So once you enter the email and the [55:04] name, you will get into this CAPTCHA [55:06] where you have to do the security [55:08] verification. [55:10] So go ahead and do it and then click on [55:12] submit. [55:14] Once you do the CAPTCHA, enter a code [55:16] that was sent to the email that you have [55:18] specified. So you need to get that code [55:21] from the email and [55:22] enter it here and then click verify. And [55:26] as you can see, [55:27] the email has been verified now. [55:29] Now now you need to configure the root [55:32] user password. Basically, the username [55:35] will be the email that you entered and [55:36] this will be the password and this is [55:38] the most [55:39] powerful user in your account. So you [55:41] have to be very careful and it's better [55:43] to use a password phrase, not an easy to [55:46] guess password. [55:47] And the conditions are available here. [55:51] It has to be at least eight [55:52] eight letters [55:54] long. At least three of And it includes [55:57] three of the following. [55:58] Upper case, lower case, numbers, and [56:00] non-alphanumeric characters. So go [56:03] ahead, create your password and confirm [56:05] it, and click on continue. [56:10] You have the two options that we talked [56:12] about. [56:13] The free and paid. [56:15] It's up to you. If you don't want to be [56:16] charged under no circumstances, but [56:18] you're okay that you you will bump [56:21] across some services that you are not [56:23] going to be able to use. And of course, [56:25] for this course, the free plan is more [56:27] than enough. I would go with the free [56:29] plan [56:30] for now. [56:35] Now you need to select what will be the [56:37] use of this account. So I'm going to [56:39] click on personal. [56:42] Put all the details. [56:44] Your personal details. It has to be [56:46] accurate. The phone number has to be [56:47] accurate. [56:48] The country and all that has to be [56:50] accurate because they are going to send [56:51] you a code to your phone [56:53] and you will need to verify it. So now [56:55] they have verified the email, they will [56:57] need to verify the phone number as well. [56:59] So fill this and [57:02] after you do, then [57:04] tick this box and click on agree and [57:06] continue. [57:10] Now you will need to enter credit card [57:13] information. You might be wondering why [57:16] is AWS asking me for a credit card if [57:19] this is a free plan? Simply, they need [57:21] to verify your identity in three [57:23] different ways. Email was one, [57:25] phone was another, and now credit card [57:27] information that means they know you, [57:29] they can verify, and there is no way you [57:32] can have wrong information entered here [57:34] because [57:35] they will check [57:36] and probably they will hold like a [57:38] dollar, 1 euro, or a small amount, only [57:42] hold, they are not going to charge it, [57:44] and it will be released in a few days. [57:45] But this makes them sure that there is a [57:48] payment method just in case in the [57:50] account. [57:51] And if you upgrade to a paid plan, then [57:54] any extra charges are going to be [57:56] charged to this credit card. [57:58] If you are on the free plan, they will [58:00] not charge you. So don't worry about [58:02] that, but you have to enter this [58:03] information. There is no way out of [58:05] that. [58:07] So fill this information and click on [58:09] continue and I will see you in the next [58:12] page. [58:14] Now is the sign up for AWS. You need to [58:17] confirm your identity and now they have [58:20] given you an option. They can either [58:23] call you [58:24] and give you a code or you can receive a [58:26] text message. [58:28] So both of them are used to verify that [58:31] this phone is yours. [58:33] So go ahead, fill in the information, [58:35] and click on [58:37] send SMS or you can have a voice call if [58:39] they want to call you and give you the [58:40] code. Either way, [58:42] fill in the number, click on send, and [58:44] then they will text you or they are [58:46] going to [58:48] call you depending on your choice. [58:50] Go ahead, do this step, and I'll see you [58:51] in the next page. [58:54] Now you are faced with another CAPTCHA. [58:57] And then they will send you the [59:00] verification. [59:01] Or the verification code or the text [59:02] message. So you have to fill this [59:04] CAPTCHA and then you will get the code. [59:08] All right. So this is the page and you [59:10] will get the code, enter it here, and [59:11] click on continue. [59:13] Okay. So I got the code. It is 5320. [59:17] 5320. [59:20] Continue. [59:22] Okay. In my case, because [59:24] my um credit card, my phone number, and [59:28] all that exist already [59:31] on AWS, they are refusing to give me a [59:34] free plan and they will upgrade me to [59:37] a paid plan. [59:38] So, anyone who created an account before [59:41] in the good free tier all times where we [59:44] could create five 10 accounts and use [59:46] free tier in all of them for 12 months, [59:49] this is not the case anymore. You need [59:50] to use a new credit card, a different [59:52] phone number if you would like to get [59:54] around and have another free tier. In [59:56] your case, this shouldn't be a problem [59:58] because if if you are a new user to AWS, [60:01] this page will not appear to you. [60:03] So, in my case, I'm going to say, "Okay, [60:05] I agree." [60:08] I'm not eligible for the free plan [60:09] anymore. Anyways, I'm going to click on [60:11] confirm [60:12] because I want to show you the rest. So, [60:14] that page will not appear in your case. [60:16] Now, we come to the support plan. Leave [60:20] it to the basic and click on complete [60:23] sign up. [60:24] All right, so I'm going to click on [60:26] that. [60:29] And guess what? Congratulations, you [60:32] have an AWS account right now. [60:34] Click on go to AWS management console. [60:37] All right, so once you log in, that [60:39] means you're going to the management [60:40] console. This is the portal. This is the [60:42] orchestration and automation and [60:44] management tool in AWS. [60:46] So, I'm entering my account right now [60:49] and I'm going to take you through a [60:50] walk-through [60:52] quickly, but let's close this video and [60:54] start a new one to do the walk-through [60:56] so we don't keep this one for long. [61:02] All right, so let me take you through a [61:04] walk-through of the AWS management [61:05] consoles to help you get familiarized [61:08] about the AWS management console, how to [61:10] use it and all that. Let's go ahead. [61:14] Okay, so this is these are few messages [61:16] if you'd like to go through them, [61:18] that's okay. For me, I'm not going to go [61:20] through them. Let me [61:22] make this a little bigger. [61:24] So, this is the console home for a brand [61:26] new account. So, this is an account [61:29] which doesn't have any recently visited [61:31] services or anything. [61:33] If you click on this side, you'll find [61:35] the account ID. [61:37] You can go to billing and cost [61:39] management where you can look at your [61:41] bills and find out your consumption and [61:44] so on. [61:46] You can sign out. [61:48] And here, you can see that you have all [61:51] the AWS regions. So, by default, it has [61:53] chosen for me this as the default, the [61:56] one in Stockholm in Sweden, [61:58] but [61:59] you can switch to a one closer to you [62:01] because that will help you with the [62:03] internet latency. [62:04] If you want to play with an AWS service, [62:07] work with an AWS service, then you can [62:09] click on here [62:11] and you can see that you have here a [62:13] list of AWS services. [62:16] Or if you know the service that you're [62:18] going to work with, for example, in this [62:20] course we're going to work a lot with [62:21] EC2. This is the service that allows you [62:24] to create virtual machines in AWS, [62:27] virtual servers in the cloud basically. [62:30] If you would like to launch [62:32] your own presence in AWS, you have to [62:34] create what we call a VPC [62:37] or virtual private cloud. [62:40] There are some services under VPC that [62:41] are created for you by default. You [62:43] don't have to do anything about them and [62:46] they are there for you. AWS assumes that [62:48] this is like um common denominator that [62:51] most of the people who are learning [62:53] might need it and they volunteer and [62:55] they create it for you. We're going to [62:57] learn more about this later on. [62:59] If you go into one of these services, [63:01] I'm just going to show you how it looks [63:03] like. You don't have to know anything [63:04] about it right now. [63:07] So, usually you have the dashboard. So, [63:09] this tells you where exactly are you [63:11] right now. So, I'm in the VPC dashboard, [63:13] virtual private cloud dashboard, and [63:15] these are the settings that I can choose [63:17] or the stuff that are under the VPC. [63:21] When you choose one of them, what you [63:22] see [clears throat] on the right-hand [63:23] side will be the details of what you [63:25] have selected. So, for example, if I [63:26] click on this, [63:28] these are the subnets under subnet. [63:30] VPCs, this is the the existing VPC. [63:33] Route tables, these are the existing [63:34] route tables. Now, let's go to EC2, [63:36] which is the virtual machines in the [63:39] cloud. [63:44] And as you can see, this is the service. [63:47] Here is the EC2 dashboard as it says. [63:50] Instances means virtual machines [63:53] and instance types and launch templates [63:54] and there's a lot of configuration stuff [63:56] that also fall under the EC2 dashboard. [63:59] For example, if I wanted to create a [64:01] virtual machine and you will be amazed [64:03] at how fast you can do that. [64:06] So, I click on instances. I don't have [64:08] any as you can see, but I can choose to [64:10] launch one. [64:14] So, this is the page that at the end [64:16] when you fill in all the information, [64:18] you can just click on launch instance [64:20] and boom, you have a virtual machine in [64:23] the cloud. [64:25] So, what do I need to do? I'm going to [64:27] call it first VM, first virtual machine. [64:32] And here you have the operating system. [64:34] So, you can do Amazon [64:36] Linux, you can do Mac OS, Ubuntu Linux, [64:39] Windows, Red Hat Linux, SUSE Linux and [64:41] so on. So, there are plenty of operating [64:44] systems you can run on the virtual [64:46] machine. Remember that the virtual [64:47] machine needs a full guest OS. [64:51] And after that, I'll leave it to the [64:52] default. So, I'm assuming that I'm going [64:54] to go with an Amazon Linux one. [64:57] Any virtual machine has a V neck, [65:00] virtual memory, virtual disk, [65:02] virtual CPU and so on. [65:04] So, if you look here, you'll find that [65:06] this is T3.micro. [65:08] That's the size of an instance or a [65:10] virtual machine. [65:11] And it comes prepackaged. So, the [65:13] T3.micro will always have two vCPUs, 1 [65:16] gigabyte of memory, [65:18] and here it tells you the price is per [65:20] hour if you use it. So, in my case, I'm [65:23] going to choose, let's see if I can get [65:25] to a smaller one. That's fine. That's [65:27] the least I can do. [65:30] So, T3.nano. [65:33] Key pair, if you would like to access [65:35] the instance remotely, then you have to [65:38] create a key pair. Otherwise, I can do [65:40] proceed without. We're going to explain [65:42] that later on. [65:43] Network settings, which VPC or where [65:46] it's going to land. [65:48] I'm going to leave everything to the [65:49] default now because I'm just explaining [65:51] that to you. [65:52] Security. [65:54] And once you are done with all of this, [65:56] all you can do is launch instance. [65:59] And congratulations, this is your first [66:02] virtual machine in the cloud. [66:04] Successfully initiated launch of this [66:05] instance. And if you click on that ID, [66:10] you get to here [66:11] and you will see that it is running [66:14] and we have created a virtual machine. [66:15] Of course, as you learn the the the [66:18] particulars or the specifics about each [66:20] one of the attributes that we needed to [66:22] configure, then probably it will take [66:24] you another 10 seconds, 15 seconds, but [66:26] you will have a virtual machine in no [66:28] time. [66:29] You don't have to virtualize your [66:30] laptop. You don't have to learn about [66:33] new tools like VirtualBox or VMware [66:35] Workstation and you don't have to do [66:37] nothing. Your laptop is as is. You don't [66:39] need to split or partition it to include [66:42] a a VM. You don't have to do nothing. In [66:45] the cloud, in your case, if you are new [66:47] to AWS, it's going to be free. You have [66:49] $100 credits and you can do some [66:52] exercises and gain another $100 credits [66:55] and it's going to be there for you for 6 [66:56] months. You don't need anything [66:59] All right. And at the end of the 6 [67:01] months, as you advance, you can upgrade [67:02] to the paid plan and then you start [67:05] controlling your expenses based on your [67:07] usage basically. You are investing in [67:09] the environment that would look like the [67:12] actual environments you are going to [67:13] work on as you specialize in your [67:15] career. All right. Hopefully that was [67:17] clear. What I need to do now is I'm [67:19] going to terminate the instance because [67:21] my account is not a free account. [67:25] And once I click on that, guess what is [67:27] happening right now? You'll find that it [67:29] is shutting down [67:30] and it will be terminated in no time. [67:37] Let's now start with module three. In [67:40] module three, we're going to start the [67:43] discussion about data center. [67:45] We talked about servers and applications [67:48] and software and virtualization and we [67:50] said all of that is hosted in data [67:52] center. So, now it's time to talk about [67:54] data centers. [67:56] And after knowing at a high level what a [67:58] data center is, we're going to take it [68:00] one step further and we're going to get [68:02] into what is cloud computing and why did [68:05] we get from data centers to the cloud [68:08] and why cloud is attractive. So, this is [68:11] what we are going to do in this module. [68:14] We're going to cover what data centers [68:16] are, [68:17] cloud computing and cloud services [68:20] models. What are the different services [68:22] that you can hire or rent or lease from [68:25] the cloud. [68:26] We'll talk about cloud deployments [68:27] models and also we're going to talk [68:29] about if you are going to study or [68:33] specialize in the cloud or DevOps or AI [68:36] or ML Ops, any one of the modern IT [68:38] roles would require you to have [68:40] sufficient knowledge of the cloud. [68:43] So, which cloud you should start with? [68:46] Is it AWS? Is it Azure or is it GCP from [68:50] Google? [68:51] This is what we are going to cover in [68:52] this module. So, let's get started. So, [68:54] let's start with an overview of what a [68:56] data center is. [68:59] In traditional IT, in the pre-cloud era [69:02] and still ongoing, [69:04] servers and applications are hosted in [69:07] client specific purpose designed or [69:10] purpose built IT data centers. [69:13] And if we get into a data center, we [69:15] will see aisles like these ones and [69:18] you'll see cabinets as you can see. [69:22] And if you open one of the cabinets and [69:23] look from the front and the back, you'll [69:25] see cables [69:28] on the backside, and you will see the [69:30] details of the servers that are mounted [69:32] on the front side. In general, any data [69:35] center is a considerable space size, [69:38] real estate size, a building, basically, [69:41] or a floor in a building, or could be [69:43] the entire building [69:44] that is air-conditioned, [69:46] physically secured, and manned 24/7 to [69:50] ensure continuous operation. And this is [69:52] where the servers will be placed. Of [69:55] course, there has to be power and [69:56] redundant power and so on, and servers [69:58] are going to be connected to a network, [70:00] and this is how they function, [70:03] basically. We're going to touch on [70:06] data centers again when we get to the [70:08] networking component, because we need to [70:10] talk about what is a data center network [70:12] or DCNs, but that will come later on. [70:15] Let's continue with our overview of what [70:17] a data center is. [70:20] The image that you see in front of you [70:21] right now, this is the AWS data center [70:25] in Mumbai, in India. [70:27] So, this is how big that is. So, if you [70:30] look at the size of the trees, for [70:31] example, compared to the size of the [70:34] buildings [70:35] that are available in data center, and [70:37] the redundant power, and the generators, [70:39] and all the different utilities that get [70:42] into the data center, you will you will [70:44] understand what the size is. So, for [70:46] example, look at this car, this vehicle, [70:49] compared to the size of the building, [70:50] and then you will appreciate how big [70:52] that would be. [70:56] So, we talked before about physical [70:59] servers, and we showed the images of [71:01] some rack-mountable servers, the one [71:03] that [71:04] are flat, basically. They are not high, [71:06] they are flat. [71:08] So, the servers that are flat, they have [71:13] angles or brackets on the side, and [71:15] that's how they get mounted. So, this is [71:17] called a rack or a cabinet, [71:19] and each one of these rows that you see [71:22] here is a rack-mounted server. And the [71:25] rails on the side, the silver [71:27] components here, the rails on the side, [71:29] is where the server gets fixed or bolted [71:32] to the rack. [71:33] So, we can have lots of racks [71:36] in a data center, and they will be side [71:38] by side, and usually, they can be [71:40] physically secured, so they can be [71:42] locked, and only the responsible or the [71:45] authorized personnel will be able to [71:46] open that. [71:48] If you turn around the rack, so the [71:50] racks are fixed in aisles, [71:53] basically, or rows, and the rows will [71:55] have aisles in between. So, if you move [71:58] to the back of a row of racks, you will [72:01] see the cabling part, and this is how [72:04] they connect into the network. So, the [72:05] yellow and green and white that you see [72:08] here, these are cabling that goes from [72:11] the servers to the network, and then [72:14] from the network to the outside world, [72:17] or wherever they need to communicate [72:18] with. [72:25] The term on-premises or on-prem is [72:28] something that you are going to [72:29] encounter a lot when you deal with cloud [72:32] or networking or infrastructure and all [72:34] that. And this is or refers to a [72:36] location that is owned and controlled by [72:39] the customer. [72:41] So, if we are talking about cloud, [72:44] AWS, Azure, or GCP, these are data [72:47] centers controlled by these vendors. [72:50] But if a company, Bank of America, for [72:52] example, they have their own data center [72:54] where they host their servers and [72:55] applications, so that becomes on-prem [72:58] for Bank of America. So, when they refer [73:01] to their own data center, they will talk [73:03] and say on-prem, or they will mention [73:05] on-prem, on-premises. [73:07] That means it's our data center, it's [73:09] our location, it's our space. [73:12] So, what is so special about on-premises [73:14] data centers? This is 100% customer [73:18] controlled, and 100% [73:20] the customer is responsible for the [73:23] design, so they will go out, and they [73:25] will find where is the space. Is it [73:27] going to be in their building, or maybe [73:29] they are going to lease it somewhere [73:31] else. [73:33] The cost of establishing the data [73:34] center, if there are any real estate [73:36] build, or cabling, or [73:39] false ceiling, or raised floors, all of [73:42] that is the customer responsibility as [73:43] well. Who's going to operate that? The [73:45] customer. Who's going to optimize it? [73:47] Who's going to upgrade it? Who's going [73:49] to be responsible for the security, the [73:51] power, the AC, the cooling, and all of [73:53] that stuff? The customer. Of course, the [73:55] customer may hire companies to do that [73:57] on the customer's behalf, but still, it [74:00] is the customer who's responsible to [74:02] find the third parties and sign [74:04] contracts with them and monitor their [74:06] work to make sure that they are doing an [74:08] immaculate job as far as the operations [74:11] of the data center are concerned. [74:13] So, what is exactly the customer [74:15] responsible for in a data center? [74:19] They are responsible for everything, the [74:20] real estate, the physical security, the [74:23] cameras and all that, and then they're [74:24] responsible for the network. [74:26] They're responsible for storage [74:28] solutions to store the data permanently, [74:31] a persistent storage [74:33] for the data. [74:36] They're responsible for the hardware, [74:38] whatever the hardware is, servers, [74:40] monitors, storage solutions, so on. This [74:43] is all the customer's responsibility. [74:45] Virtualization, if they are going to use [74:47] virtualization, and definitely in a in a [74:50] huge data center, virtualization will be [74:52] used, [74:53] then who is the vendor of the [74:54] virtualization [74:56] or the hypervisor, and what's the [74:58] licensing required, what's the cost, the [75:00] maintenance support, and all that, they [75:02] are responsible for that. They are [75:03] responsible for deciding on which [75:07] operating systems are going to be used [75:08] on the different servers hosting the [75:10] different applications. [75:12] Also, if there are any message brokers, [75:14] components that have to do between the [75:17] application components, [75:19] basically, for them to communicate with [75:21] one another, they call it middleware, or [75:22] they call it message brokers as well. [75:25] They are responsible for deciding what [75:26] that is going to be. If it is Python, [75:29] for example, so what will be the [75:31] programs that are required to run [75:33] Python? We call that the runtime. [75:35] And what will be the data or the [75:37] applications, and what will the [75:39] application communicate and process and [75:41] store? And also, the actuality or the [75:45] actual applications is also the [75:46] responsibility. [75:48] So, they are responsible for the entire [75:50] spectrum, from the physical all the way [75:53] to the data and its storage and security [75:55] and so on. It's all the customer's [75:57] responsibility. Who's going to pay for [75:59] that? It's the customer. And that's why [76:01] they call it a capex model. This model, [76:04] the on-premises data center owned by the [76:06] customer or leased from another company, [76:09] for them, this is called the capex [76:12] model, capital expenditure model. That [76:15] means, Mr. Customer, you want all of [76:17] this? Yes, you have to pay. So, you have [76:19] to pay upfront to buy the equipment. You [76:21] have to pay upfront to rent or own the [76:25] place. You have to pay for the [76:26] construction. You have to pay for the [76:28] cooling. You have to pay for this. You [76:29] have to pay for that. So, each time you [76:31] need something new, okay, fine. Please [76:33] show us your credit card, and we're [76:35] going to charge you upfront. [76:37] To establish and build a data center, it [76:40] could cost up to 50-100 million dollars [76:43] to establish data center, and then it [76:45] will be costing a similar cost as well [76:48] to operate it on an ongoing base. Capex [76:50] model is very expensive to the customer. [76:52] Think about a startup, a startup that [76:54] needs to start, and they have an idea, [76:57] and they want three, four, five servers [76:59] or something, and they don't want to [77:01] spend a lot of money. [77:03] If they use services, they want to pay [77:05] for it as a utility bill, and if they [77:07] don't, then they don't pay anything. [77:10] As opposed to buying three or four [77:12] servers, and then hosting them in a room [77:14] in their office, and they don't have [77:16] office, they are working remote. So, how [77:18] can they facilitate the power and the [77:20] cooling and the storage and all that? [77:23] They have to buy, buy, buy. [77:25] So, in that case, this is an obstacle, [77:27] and this is a showstopper, they can't [77:29] afford that. And this is where the cloud [77:32] computing comes into play as a utility [77:35] service, [77:36] which provides you everything you need, [77:38] and you only pay when you use. And this [77:41] will be our next discussion. [77:46] So, let's look at what cloud computing [77:48] is compared to on-premises data centers. [77:51] And does it really provide us with a [77:54] financial model other than the capex or [77:57] the capital expenditure which the [77:59] on-premises data center require? [78:03] So, what is the attractiveness of the [78:05] cloud? And what is the cloud? Why do [78:07] they call it the cloud? They call it the [78:08] cloud because they are going to provide [78:10] you all the services that you need. So, [78:13] in cloud computing, everything the [78:15] customer needs is pre-built and ready [78:17] for use. [78:19] So, we have everything ready for you, [78:20] just decide when you want to use it, [78:22] enroll or sign up, and then start go [78:24] ahead and use it. [78:26] So, that includes the infrastructure, [78:29] network, physical, storage, all the way [78:32] to the application and database, if you [78:34] want, [78:35] passing by storage and security and and [78:38] and. [78:39] So, all of that is pre-built. Why do [78:41] they call it the cloud? Because you [78:43] don't know where it is. And you [78:44] shouldn't know, and you are not [78:46] concerned to know where it is. You need [78:47] to connect to it, [78:49] establish your services, not even [78:51] knowing where that data center is. [78:54] And someone would would say, "Okay, hold [78:57] on, hold on. Now you are talking about a [78:59] data center. So, how is a data center [79:01] different from the cloud?" [79:04] In the cloud, the vendor of the cloud, [79:06] let's say AWS or Microsoft or Google, [79:10] they have already pre-built the [79:11] infrastructure. They have already [79:13] pre-wired the servers, they put them in [79:15] the racks, they have the 24/7 [79:18] operations, and they have everything, [79:20] and it is waiting for customers to come [79:22] and sign up. [79:24] Do you have to go to AWS? No, online, on [79:26] the internet. [79:28] And the promise is what you use, we'll [79:31] send you a bill for the usage. And if [79:33] you don't use anything, even if you are [79:35] signed up, we're not going to send you [79:37] anything. You don't have to pay anything [79:38] up front. It's up to you. [79:40] If you want in some services to pay a [79:41] little bit up front to reduce the [79:44] monthly or the usage bills, that's up to [79:46] you. But if you don't want to, that's [79:48] perfectly fine. [79:50] So, who has spent money or followed the [79:52] capex model to establish and build that [79:55] data center? The vendor. [79:57] AWS or Azure or GCP. [80:00] For you, that becomes an operational [80:02] expenditure model. [80:04] So, as you use, you pay. This is exactly [80:07] like electricity. When you travel and [80:10] you switch off everything in your home [80:12] and you don't use water or electricity, [80:14] the bill will be zero. [80:17] If you come back and you start using the [80:19] AC and the water and showers and all [80:22] that stuff in the bathrooms, then you [80:24] will be getting some money in the bill [80:26] next month, right? [80:28] So, that's exactly the same like your [80:30] phone bill, like your utility bill, like [80:33] your Netflix bill, like your Zoom bill, [80:35] anything. When you use, we charge you. [80:38] You don't use, we don't charge you. This [80:39] is called OPEX model or operational [80:42] expenditure model and this is where the [80:44] attractiveness comes from. [80:46] Think about the startup we were talking [80:48] about. They don't have a lot of fund. [80:50] And they would like to build a proof of [80:52] concept. And they don't want to buy [80:53] anything and they would like to switch [80:55] it off as soon as it is done. [80:58] And stop paying for anything from that [81:00] point onwards. So, in that case, OPEX [81:03] model is perfect because they know what [81:05] they are going to use, they will find [81:08] out about the prices even before using [81:11] that and then they can estimate the [81:13] budget that they'd like to spend and [81:15] they have the funds for that little [81:16] budget and they start using, finished, [81:19] switch it off, life is good. Or build [81:22] the proof of concept when you go to talk [81:23] to an investor, turn it on so you can [81:25] demo that to the investor and then [81:27] switch it off. That's it. [81:29] So, OPEX model is the attractiveness of [81:31] the cloud and that's why when someone [81:34] tells you that cloud is going to [81:35] disappear or go away or people are [81:37] leaving the cloud and companies are [81:40] walking away from the cloud, tell them I [81:42] don't think so because even when the [81:44] economic or the global economic outlook [81:48] is bad, companies would save money by [81:51] not investing in building data centers [81:54] or refreshing data centers or expanding [81:56] data centers and they will find cloud [81:58] solutions to suit them so it's easier [82:01] and faster to build and also it is [82:04] cheaper to use in the most case if they [82:07] are used properly. I'm not saying that [82:09] cloud is cheaper all the way because it [82:11] turned out in some use cases to be more [82:14] expensive, not less expensive. [82:17] So, the message you can respond to those [82:19] who claim that cloud will go away, that [82:21] cloud is here to stay and it will stay [82:24] because of the fact that it depends on [82:27] an OPEX model and customer doesn't have [82:30] to pay anything up front. [82:33] In a lot of the videos that I watch on [82:37] YouTube and other sources, I'll find a [82:39] lot of people, especially the ones who [82:41] are coming from networking background or [82:43] the ones who teach networking, Cisco and [82:46] CCNA and all that stuff, they always [82:48] claim that cloud is just a data center. [82:51] That's it. So, if you learn networking, [82:54] you know the cloud. And that's [82:55] absolutely absolutely wrong. [82:58] I come from a networking background, I [83:00] know very well cloud computing as well [83:02] and it is absolutely an inaccurate [83:05] statement to say that the cloud is a [83:08] data center. [83:09] The cloud is built in a data center, but [83:11] it has hundreds of services that have [83:14] nothing to do with networking. Yeah, it [83:16] functions on a network. I cannot say [83:19] that the data center is the street [83:21] because people use the street to get to [83:23] the data center so the data center [83:25] becomes the street and that's wrong. [83:27] 100% the same analogy. I cannot say the [83:30] cloud is just a data center. Why? [83:33] Because when we have a customer with the [83:35] customer's own data center, then I have [83:37] to go to the data center, I have to get [83:39] in to start mounting our own servers, [83:42] mounting our own racks, connecting them [83:44] and all that. We are building the data [83:47] center, we have to know where it is, we [83:48] have to have access to it and all that. [83:50] That's a data center. [83:53] But the data center in the cloud [83:55] computing is just the component, is just [83:58] the place, is just the network, but that [84:00] is not everything in the cloud. [84:03] Okay, so it's a component of the cloud, [84:04] but it's not a synonym of a cloud. So, [84:07] this is a wrong statement. Data center [84:10] is not is not the cloud. [84:13] It is a component that the cloud uses to [84:17] provide services to the customers. [84:20] So, cloud is [84:23] the data center housing or hosting the [84:26] equipment and the servers and the [84:28] applications and the softwares and the [84:30] teams and all that for the cloud [84:32] provider. [84:33] But the automation of services in the [84:36] cloud and the orchestration, basically [84:39] when you get to the AWS management [84:41] console, [84:42] you can start to use the different [84:45] services including the network, [84:47] including the storage, including the [84:49] security, including AI, including [84:51] machine learning, including any service [84:54] you may think of, you consume it through [84:57] a portal or a management console or [85:00] online basically and then behind the [85:03] scenes, whatever you click, it does an [85:05] action in the background that has been [85:07] pre-built to do the task that you have [85:10] clicked. So, you have the icon [85:11] representing what you need to do, but [85:13] then in the background, there's a lot of [85:15] automation programs that have been [85:17] written and scripts that will execute [85:20] what you are planning to do by clicking [85:22] that icon. [85:25] So, the automation and orchestration on [85:27] top of the data center housing and [85:30] hosting all the services and servers and [85:31] applications, that provides me what is a [85:35] cloud. [85:36] So, is it enough for me to learn [85:38] networking and data center to be expert [85:41] in the cloud? I would tell you that you [85:44] are 10-15% of the cloud knowledge that [85:46] you need to acquire. [85:48] So, don't fall for those who are telling [85:51] you you have to start with a networking [85:52] career, otherwise you will not be a [85:54] cloud engineer and you can't do cloud [85:56] without networking. That is all BS and [85:59] we are going to see that in this course. [86:01] By the end of this course, you can jump [86:03] into the cloud. Actually, we are going [86:05] to start learning the cloud as we learn [86:07] the fundamentals in this course. [86:11] All right. So, again, this building for [86:14] AWS in Mumbai in India, that's the data [86:17] center, but there is a lot of programs [86:19] and scripts, the automation, the [86:21] orchestration of services and how they [86:24] integrate and how they work together [86:26] that is done and it is provided to you [86:28] through a web application, a web [86:31] browser. You can log in and then you can [86:33] consume all these services without [86:35] having to call anyone. You can deploy [86:38] servers, you can deploy virtual [86:40] machines, you you can choose the [86:41] operating systems, the specifications of [86:43] the virtual machines and you can launch [86:44] the virtual machines and you can work on [86:47] them without even having to know where [86:49] that is and all online and without [86:51] having to call anyone from AWS. So, [86:53] that's the beauty of the cloud, that's [86:55] the attractiveness of the cloud and and [86:57] that's why the cloud will continue. [87:03] Okay, let's now discuss cloud service [87:06] models. When I buy a service from the [87:08] cloud, what is that called? And there [87:10] are three main ones and there are plenty [87:12] of as a service models in the cloud. [87:16] Okay, so we'll talk about the as a [87:18] service or the AAS model in the cloud. [87:22] Before we start talk about the cloud, [87:23] let's think about the on-premises. What [87:26] is the customer responsible for and what [87:28] is the cloud provider responsible for? [87:31] So, this arrow, if the color is green, [87:34] that is the span of the customer [87:37] responsibility and if it is orange, that [87:39] will be the the vendor responsibility. [87:42] On-premises, as we mentioned, the [87:43] customer is responsible for everything [87:45] from the network all the way to the [87:47] application. [87:50] And then there is something called IAS [87:52] or infrastructure as a service. So, [87:54] basically you are using infrastructure [87:56] only from the cloud provider. For [87:57] example, you are hosting a virtual [88:00] machine [88:01] in AWS [88:03] and that virtual machine, it's up to you [88:05] to decide its specs, it's up to you to [88:07] decide the operating system and which [88:09] data and what you will use it for and so [88:11] on. [88:12] So, in that case, if it is [88:13] infrastructure as a service that you are [88:16] using from the cloud provider, then the [88:18] cloud provider will be responsible for [88:20] the network, for the storage, for the [88:22] hardware and the actual virtualization [88:24] engine. [88:27] But once you launch your virtual [88:28] machine, [88:30] then choosing the operating system, what [88:32] middleware, what runtime, what data, [88:34] what application is your responsibility. [88:37] So, this is infrastructure as a service. [88:41] Now, what if I don't want to be [88:42] responsible for the operating system and [88:44] the middleware as well? I I want to ship [88:46] that and the runtime maybe. I want to [88:48] have that ready from the cloud providers [88:51] and I'm going to take it as part of the [88:52] service I'm getting from them. [88:55] So, in that case, the runtime, the [88:57] middleware and the operating system and [88:59] everything below is going to be part of [89:02] the platform as a service or pass, PAAS. [89:07] In this case, the customer will be only [89:09] responsible for the application and the [89:10] data. Data in the databases and data in [89:12] the application. We'll talk about [89:14] uh databases later on. [89:17] The third one, which most of us use [89:19] right now, like Uber and Netflix and [89:22] similar services, is called software as [89:24] a service or a SaaS offering, SaaS SaaS [89:28] services. [89:29] SaaS. [89:31] So, all of them they have as a service, [89:33] as a service, as a service. Basically, [89:34] like a utility that you are using and [89:36] you're paying for. So, services in the [89:39] cloud, majorly they will fall under one [89:42] of these categories, and that's how we [89:44] map services to what service models we [89:47] are using from the cloud. So, these are [89:48] the three ones, and of course, when it [89:50] comes to SaaS, Netflix and so on, you're [89:53] not responsible for anything except for [89:56] signing up and using the service. [90:01] Let's talk about cloud deployment [90:03] models. Is there anything that prevents [90:05] a company from building their own [90:07] orchestration in their own data center [90:10] and making that a private cloud? And the [90:12] answer is [90:13] there is nothing to prevent them. They [90:14] can do that, and that's why [90:16] there are different deployment models. [90:18] So, we have public clouds like AWS, [90:21] Azure and GCP, and we have private [90:23] clouds that a bank or a corporate or a [90:25] hospital may decide to build in-house [90:29] and to manage it using their own teams, [90:31] and that will be private for them only, [90:34] for that corporate or that organization [90:36] or that hospital only. [90:37] So, in public clouds, what is the [90:40] criteria or the specs? In public clouds, [90:43] the resources are publicly shared. [90:46] So, I could be using a virtual machine [90:47] on a physical server in AWS, and maybe [90:50] you are from a different country and you [90:52] launch a VM and it and by coincidence, [90:55] it lands next to my VM on the same [90:57] physical server. Public clouds, by [90:59] nature, they are shared multi-tenant [91:02] infrastructures. [91:04] And internet connectivity is the common [91:06] way of getting to your virtual machines [91:09] and applications in the cloud in this [91:11] case, [91:12] and it's best suited for less [91:13] confidential data. [91:15] So, banks, for example, or hospitals, [91:17] they will think thrice, not twice, [91:19] before they are going to move the credit [91:22] card information for the customers or [91:24] their bank account details or their [91:27] confidential information into the cloud. [91:30] And that's why companies they don't live [91:32] off the public cloud only, but for [91:35] whatever data that they can't move to [91:37] the cloud, they can establish their own [91:39] private cloud. [91:40] And as the name implies, the resources [91:42] available here are going to be for [91:44] private use. This is only to host the [91:47] confidential data that they cannot move [91:49] into the cloud. [91:52] But they can have orchestration and [91:53] automation in their own on-premises data [91:55] center, so they have a private cloud. [91:59] So, this will be for a single customer, [92:00] and the customer can have can be a group [92:03] of companies and they are using their [92:05] private cloud. It doesn't have to be [92:06] like a one business unit in a company. [92:08] It could be multiple business units in [92:10] Bank of America that are using their [92:12] private cloud to host different [92:14] applications and relevant data. [92:17] Connectivity in this case, how can they [92:20] connect into their private cloud? They [92:22] can have high-speed connectivity from [92:24] service providers. They can have their [92:26] own fiber optic cables that they can [92:28] provide them hundreds of gigabits per [92:31] second speeds into that private cloud. [92:35] And this is best suited for confidential [92:37] data client private systems. [92:40] All right. [92:41] What if Bank of America has lots of data [92:44] that can be moved into the cloud, but it [92:47] also they have sensitive data that they [92:48] cannot move into the cloud. So, they [92:50] want to use public cloud, but also they [92:53] need to use the private cloud. What if [92:55] we need communication between the two? [92:57] For example, an application in the [92:59] public cloud would like to highlight or [93:02] reference some data from [93:04] the private cloud or the other way [93:06] around? Then this brings to us what is [93:09] called a hybrid cloud. So, a hybrid [93:12] cloud is a mix of public and on-premises [93:15] private cloud, and both are orchestrated [93:18] to run a single task. [93:21] And that's how it would look like. So, [93:23] the corporate data center with [93:24] orchestration becomes a private cloud, [93:27] and then let's say AWS, and they can [93:29] have private connectivity between them [93:32] or connectivity through the internet. [93:34] Both would work. [93:37] And of course, orchestrating this and [93:39] that, and which users will log in here [93:41] and which user will be able to access [93:43] the cloud or both of them, this is [93:45] orchestration. It's going to be more [93:47] complex because now we need to manage [93:49] private and hybrid access and security [93:52] and so on. [93:55] And this is suitable for so many use [93:57] cases, and it is proving that hybrid [94:00] cloud is the direction that most of the [94:02] companies using the cloud are using [94:04] right now or they will use. So, that's [94:06] why we need to be also knowledgeable [94:08] about hybrid cloud. [94:12] And in this case, it's up to the [94:14] customer to decide what runs here and [94:16] what runs there, and they can optimize [94:18] application usage, access, cost [94:20] optimization as well, more control, and [94:23] they can run applications where they [94:25] decide. They can use the cloud only for [94:30] failover when they have a problem in the [94:31] data center, this is called disaster [94:33] recovery, for example, or they can just [94:36] store their data as a backup, as a [94:38] second copy, in the cloud in case if the [94:41] main data center fails, then we can [94:43] launch it from the cloud. [94:47] Then the trend that is evolving as well, [94:50] and a lot of companies are deploying. It [94:52] has proven that cloud providers are not [94:56] one size that fits all. [94:58] For example, AI and machine learning, [95:00] Azure and Google are much better than [95:02] AWS. So, a company might host their AI [95:06] in Azure or in Google, for example. [95:08] Whereas the company will be hosting [95:10] their e-commerce on AWS because AWS is [95:13] e-commerce, Amazon is e-commerce. [95:16] So, now, once they start splitting [95:18] workloads among the different cloud [95:20] providers, this also will give them the [95:23] advantage of avoiding vendor lock-in. [95:25] So, if I go to AWS and put everything in [95:27] AWS, now AWS [95:30] kind of controls me and controls the [95:33] prices and discounts because if I'm not [95:35] happy, I will have to move stuff and [95:37] move it elsewhere, which is not an easy [95:39] task. [95:40] And that's why vendor lock-in can be [95:43] avoided by using multi-cloud, and also [95:45] give the customer the choice of which [95:47] one provides me the best features for [95:49] the lowest cost, and that is what I'm [95:51] going to follow. So, multi-cloud is very [95:53] important, and that's why we always [95:55] advocate for learning at least two of [95:58] the three major clouds, if not the three [96:00] of them. And I'm not saying you have to [96:02] become an expert in all of them, that [96:03] would be great if you can do it, but [96:05] what I'm saying is you need to have [96:07] enough knowledge about them, not at the [96:09] start as you move on into your career. [96:13] All right? So, in that case, customers [96:15] will put some stuff in AWS, for example, [96:17] and some in Azure, [96:19] and that will be a single heterogeneous [96:21] architecture that includes all of that. [96:24] So, the organization will continue [96:26] towards the multi-cloud because it is [96:27] proving that cloud providers are not all [96:30] good and at the same price point when we [96:33] compare the same services in each in [96:34] each one of them. [96:37] So, what about hybrid multi-cloud to [96:39] make it even harder? This is when we [96:41] connect our private cloud or data center [96:43] into the multi-cloud because we need to [96:46] consume services from the different [96:48] cloud vendors that we are using. So, [96:50] that will become a hybrid multi-cloud [96:53] solution. [96:55] And of course, the challenge will always [96:57] be how will you be able to orchestrate, [96:59] control security, and define users and [97:02] access permissions across the different [97:04] cloud environments that you are using. [97:10] So, we have learned at a high level what [97:12] cloud is and what a data center is, and [97:14] we have learned about public and private [97:15] clouds, and hybrid cloud and hybrid [97:18] multi-cloud and what multi-cloud is. [97:21] Which one should I start with? I love [97:23] what you said, and I would like after [97:25] this course to start working towards [97:27] building my cloud skills. [97:29] Should I go with AWS? Should I go with [97:32] Azure or should I go with GCP or all of [97:34] them? What do I do? [97:36] And in order to find out, there is [97:38] something called the Gartner Magic [97:40] Quadrant. This is a report that is [97:42] launched annually or sometimes uh [97:45] multiple times a year [97:47] by Gartner. And Gartner, what it does is [97:50] here is the public cloud providers [97:53] comparison. And the magic quadrant is [97:56] this part. So, whoever is in this part [97:58] is one of the top players. So, in 2021, [98:02] AWS was here, Azure was here, and Google [98:04] was here. I'm not going to talk about [98:06] the other players. [98:08] In 2023, see the distances here and how [98:12] the the horizontal gap between them was. [98:16] In 2023, [98:17] the vertical distance narrowed, and also [98:21] the horizontal distance narrowed. This [98:23] axis is called completeness of vision, [98:26] and this is the ability to execute. So, [98:29] AWS was always at the top of the ability [98:31] to execute. [98:32] But here, the vision, which is the [98:34] vertical gap, now Microsoft is even [98:37] better than AWS in a vision perspective. [98:41] But AWS is more able to execute for the [98:45] customers and services and all that [98:46] stuff. But Google is getting very close. [98:48] In 2025, [98:50] you can see that the gap between Azure [98:53] and Google in both the vision and the [98:56] ability to execute is very narrow. [98:59] AWS is still behind Microsoft in terms [99:03] of vision, but they are still able or [99:05] their ability to execute is better, but [99:07] now even the vertical ability to execute [99:09] access is narrowing, the gap is [99:12] narrowing right now. So, it is a [99:14] catch-up. They are catching up, but AWS [99:16] is still the major player [99:19] across the globe in terms of market [99:21] share. By all means, if you are going [99:23] into AI and machine learning, skip AWS [99:25] and get into Azure or GCP. They are much [99:28] better in AI and machine learning than [99:31] AWS is. [99:33] If you look at the market share [99:34] percentage, we'll find that AWS has 30% [99:38] of the public cloud market share, and [99:41] Azure has 20%, and Google has 13%. [99:46] So, what's the message? The message is, [99:48] if you don't know, ask and find the [99:51] reputable job boards in your country and [99:55] try to find how many Microsoft, how many [99:57] AWS cloud, how many GCP jobs are there. [100:01] And follow that for a 2-weeks, 1-month [100:04] period to find out which one posts more [100:06] jobs, that means it's in higher demand. [100:08] Ask in the forums on the social media in [100:11] your country, [100:12] which one should you start with, which [100:14] one is providing higher salaries, more [100:16] jobs, more demand, and so on. Start with [100:18] that one. [100:19] If you couldn't find a solution, some [100:21] people told you AWS, some people told [100:22] you Azure, some people told you Google, [100:24] and there is no preference, then go with [100:27] AWS for the infrastructure or for the [100:29] start, but as soon as you want to shift [100:32] into machine learning and AI, move to [100:34] Azure or GCP. [100:37] Generally speaking, you are you are [100:38] never go wrong with one of these two. [100:42] But again, if you know which country [100:44] which one is the preferred one in your [100:46] country, then definitely by all means [100:48] you are doing the right thing. That's [100:50] it. So, now you know about the cloud [100:51] providers, about private, public, and [100:53] hybrid, and multi-cloud, and also you [100:55] know about the models, and you know [100:57] about the cloud provider to start with. [101:05] All right, so let's start with the first [101:06] module from the networking focused [101:09] modules. These are These modules will [101:11] constitute a deep dive into networking [101:13] fundamentals, and that would be more [101:16] than enough for you to proceed into the [101:18] modern IT roles that you are going to [101:20] cover at the end of the course [101:22] without having to go through A+, [101:24] Network+, and CCNA. All right? So, what [101:26] are we covering in the networking [101:28] fundamentals module? [101:30] We are going to cover what is a network. [101:32] So, let's get to introduce ourselves to [101:34] what networks are, [101:37] and we'll look at the network types, [101:38] LAN, WAN, that that wireless LAN or [101:41] WLAN, CAN, and we'll talk about these in [101:44] more details. Also, we'll look at the [101:46] types of network traffic or network flow [101:49] that could happen [101:51] within a network. [101:53] We'll look also at the wired network [101:55] devices that we may encounter that [101:57] basically build the network. [102:00] We'll look also at the network cabling. [102:02] How do they connect to each other and to [102:04] the servers and to users and so on. [102:07] We'll also look at the data center [102:09] network or DCN. So, we introduced what [102:12] data centers are. Now, we are going to [102:14] dive [102:15] into what a data center actually looks [102:18] like. [102:20] We'll look at the CAN, campus area [102:21] networks, and we'll also look at what is [102:24] the internet. I mean, we talked about [102:26] LAN, WAN, CAN, wireless LAN. What is the [102:28] internet then? We're going to uh [102:30] summarize that, and then we'll look at [102:32] the wireless network devices, which is [102:34] something that you are used to at your [102:36] home or maybe at your office or at the [102:38] airports. You just [102:40] take your phone and then connect to a [102:42] Wi-Fi network, enter the password, and [102:44] you're connected to the internet. [102:46] All right, so let's start with the first [102:48] one, which is what is a network. So, a [102:51] network is nothing but a group of two or [102:54] more computers, and other devices also [102:57] can connect to the network. It's not [102:58] only limited to computers [103:00] that are connected to that network or to [103:03] that medium in order to share data. They [103:06] could be sharing files, they could be [103:07] sharing images, they could be sharing [103:09] videos. It could be a server or a [103:12] website that I'm connected to. Whatever [103:14] the means or the use case is, [103:17] they have to connect somehow into the [103:19] network to be able to communicate. [103:23] And devices that may connect to the [103:25] network are not limited only to servers [103:27] and computers and virtual machines. They [103:28] could be printers, they could be your [103:31] laptops, they could be phones, they [103:33] could be tablets, they could be security [103:35] cameras. For example, the surveillance [103:37] cameras, could be your smart TV. [103:39] If you have a network, then you can [103:42] choose what devices will be connected [103:45] into that network to communicate. [103:48] And here's an example for a home [103:51] network, but this is a wireless network. [103:53] So, we have a wireless device, [103:56] and then I can have my desktops, I can [103:58] have my phone, my tablet, my printers [104:01] connect to it. So, I can from my laptop [104:04] or from iPhone or my tablet, I can, for [104:07] example, print images or print documents [104:12] on the printer. That's one use. Or it [104:14] could be that I would like to connect to [104:15] the internet, so I'm going to connect [104:17] wirelessly within my home, [104:19] but then I need a device that will [104:21] connect me to the internet. We'll look [104:23] into that. [104:24] Each device in a network must be [104:26] uniquely addressable. So, that means it [104:28] must have a name or an address of some [104:32] sort [104:33] in order to be able to connect to the [104:35] network and communicate with the other [104:36] devices and with the internet if [104:38] required. And that is called an IP [104:41] address. We're going to cover that later [104:43] on. [104:45] So, what are the network types that I [104:47] may come across in my career for cloud [104:51] or for networking or security or even [104:54] development and so on. [104:56] There is one called LAN or local area [105:00] network. And as the name implies, it's a [105:02] network in a local area. [105:04] And then WLAN, wireless LAN, wireless [105:08] local area network. And then WAN, wide [105:11] area network. [105:13] And CAN, campus area network. We're [105:16] going to cover all of these one by one [105:18] as we proceed. So, let's start with the [105:20] first one, which is local area network, [105:22] abbreviated LAN. [105:24] So, a LAN is a network that connects [105:27] computers and devices in a small area. [105:30] Like what? It could be a home office, it [105:32] could be an office business, could be a [105:35] school, it could be a building, it could [105:37] be a company. [105:38] Any of that is called a LAN. [105:41] Why do we build a LAN? Because we need [105:43] to connect the servers for the LAN, we [105:45] need to connect the printers, the users, [105:47] and use the internet, for example, or [105:49] share files or print documents. [105:53] So, examples of a LAN is all the [105:56] computer servers, printers, and CCTV [105:58] cameras in a school. [105:59] So, if I have a school, I would like to [106:02] have the library connected to the [106:05] internet. I would like to provide [106:07] internet access [106:08] to the students, maybe, or the teachers. [106:11] It could be wired or wireless. I want to [106:13] connect the smart boards in the [106:15] classrooms [106:17] to the network as well, so they can [106:19] share documents and files and stuff like [106:21] that. And this is how it would look [106:23] like. [106:24] So, I have the LAN, [106:26] which will be composed of or consist of [106:29] network devices. We're going to talk [106:31] about what these devices are. [106:33] And then we can connect servers, we [106:35] tablets, we can connect printers, smart [106:38] boards, maybe phones that work on IP on [106:41] networks, printers, maybe uh security [106:44] cameras, and screens, laptops. All of [106:48] these are possible connections in a LAN. [106:51] And of course, [106:52] I would connect that into the internet, [106:55] so students or researchers or teachers [106:58] or assistants, they will be able to send [107:01] and receive emails and connect maybe to [107:03] the Ministry of Education and other [107:06] sites while performing the classes or [107:08] while presenting the classes. [107:11] The second type is WLAN or wireless LAN. [107:14] So, the wireless LAN, it's similar to [107:17] what a LAN is, so it's a wireless [107:19] network in a small area. It could be a [107:21] shopping mall, could be school, could be [107:23] an airport. [107:24] I mean, relatively small, but I'm not [107:26] talking about 2 m. I mean, it can be [107:29] multiple buildings even attached or [107:31] maybe a campus building, but that would [107:32] be a big or a larger wireless LAN. [107:35] So, it is like a LAN, but it is [107:37] wireless. So, we don't use cables to [107:40] connect all the devices into the [107:41] network. [107:43] Examples to that, when we use our phone, [107:46] laptops, or tablets, when we connect to [107:48] the Wi-Fi network at home or in the [107:51] office. That is a wireless LAN. [107:54] And here's how it would theoretically [107:57] look like if this is what we are talking [107:58] about. And of course, we need a device. [108:01] We call it the wireless router. We'll [108:03] talk about what a router is later on in [108:05] order to be able to connect to the [108:06] internet and then provide the Wi-Fi [108:08] service to the devices. So, basically, [108:11] what happens is through Wi-Fi, I can [108:13] connect to the router, and this router [108:15] is already connected to the internet [108:17] because you have to subscribe to the [108:19] internet to connect your home [108:21] to the internet, right? You have to call [108:23] AT&T or maybe Bridge Telecom, and then [108:25] they will provide you with the Wi-Fi [108:27] router and the connection. They will [108:28] send in a technician, maybe, or a [108:31] do-it-yourself kit, and then you fix it, [108:34] put the username, passwords, all the [108:35] stuff that they will send you, and you [108:36] are connected to the internet, and now [108:38] your computers can connect to the [108:40] internet, as well. [108:43] Then we have wide area network. So, wide [108:46] area network is a network that connects [108:47] computers and networks over long [108:50] distances. So, it could be that I have a [108:52] branch in New York and another branch in [108:55] California or the corporate in [108:57] California, and I would like to connect [108:58] them to each other. It could be across [109:00] cities, could be across states, across [109:02] countries, or even across the globe. The [109:04] WAN can connect many LANs together, so [109:07] people can communicate and share files [109:09] and so on. And here is an example. If we [109:12] have a company LAN branch in Germany, [109:15] but the headquarters of the company is [109:17] in the US. How can we connect them? One [109:19] way would be to do a WAN connection [109:22] between them. A high-speed WAN [109:24] connection, of course, is going to be [109:25] costly because this is across [109:27] continents. [109:28] And then the LAN in Germany and the [109:31] headquarter LAN in the US can now be [109:35] connected through that WAN. We're going [109:37] to look at the details of what a LAN [109:39] or network devices that can build a LAN [109:42] and what network devices can build a [109:44] WAN. [109:47] And since we are talking about WAN, then [109:49] what is the largest WAN in the world? [109:52] And that is the internet. So, this is [109:54] our largest WAN in the world. So, I can [109:56] have [109:57] um [109:58] someone in a home office in Japan, [110:01] and maybe a branch office that is in [110:04] Germany or a company that is in Germany, [110:07] and they are all connected to the [110:08] internet, and they can exchange data or [110:11] access data that is hosted in the US, [110:13] for example, in the corporate office. [110:17] So, this is the gigantic WAN that we [110:20] have, and we are all using it and we are [110:22] used to it. [110:26] Now, let's look at types of traffic [110:28] flow. When we are talking about a [110:30] network and I have devices connected, do [110:32] they connect one-to-one or one-to-many [110:35] or one-to-everyone? How do they [110:37] communicate? What are the different ways [110:39] to send traffic in a network? [110:43] And there are three major types: [110:45] unicast, multicast, and broadcast. There [110:48] is another one called anycast, but it's [110:50] not the time to talk about it now. [110:52] So, when we when we talk about unicast, [110:54] what do you mean? If I want to connect [110:57] to [110:58] my bank account or online banking, that [111:01] is one-to-one. I am talking to the bank [111:04] server, and I'm not sharing that data [111:06] with anyone else. [111:07] So, this is one-to-one. As if Sarah and [111:10] Joan are communicating with each other [111:12] and they are separately in a meeting [111:15] room, and there is no one else. So, [111:16] that's one-to-one traffic between them. [111:19] So, the data goes from one device in the [111:21] network to a specific device, from a [111:23] client to a server, from an iPhone to [111:26] the HR server, for example, in the [111:29] company. [111:31] Then we have multicast. Multicast means [111:34] one to a group. So, it could be that I [111:37] have an IPTV server [111:40] in a hospital, for example, and then the [111:42] patients in the rooms, they can turn on [111:44] their TVs. It could be a hotel, as well. [111:47] They can turn on in their TVs, and I [111:49] could be watching the same movie that [111:51] you are watching and someone else is [111:52] watching. [111:53] So, that would be one-to-many. That [111:56] would be multicast [111:57] or streamed to the others. And Netflix [112:00] is an example of that, as well. [112:02] A broadcast, on the other hand, is [112:04] one-to-all. Like if there is a PA [112:06] system. Think a PA system connected to [112:09] the network [112:10] in an airport. So, when the message is [112:13] presented or the message is run, now [112:16] we're talking about British Airways [112:18] flight number such and such is boarding [112:20] now, and that is in gate such and such. [112:23] Everyone who is within the reach of that [112:27] audio system or a PA system will be able [112:30] to hear it, right? So, in networking, if [112:33] one is sending a broadcast, that means [112:36] everyone on that network is going to [112:38] receive that traffic. [112:45] Now, let's talk about wired network [112:47] devices. [112:48] If I'm talking about a LAN or a WAN, [112:51] what are common devices that I may come [112:53] across when I am building a LAN or [112:57] building a WAN or even investigating, [112:59] troubleshooting, configuring, or even [113:01] just looking at a design? [113:03] What are the common devices that build a [113:06] WAN or build a LAN? That's what we need [113:08] to know now. [113:09] So, networking devices are needed to [113:12] create LANs and WANs. So, what are they? [113:14] What is inside this little bubble here, [113:17] and what is inside that little cloud [113:19] over there called a WAN? [113:23] So, the very first one that you may [113:25] rarely encounter, because that's an old [113:27] technology, is called a hub. [113:30] So, what's a hub? It's a network device [113:32] that connects multiple computing devices [113:34] in a LAN. So, can I connect a printer? [113:37] Yes. Can I connect a laptop? Yes. Can I [113:39] connect a server? Yes. Can I connect a [113:41] CCTV monitoring or surveillance camera? [113:43] Yes, you can do all of that. But it is [113:45] not intelligent. And here's an example [113:47] of how a local area network, an [113:49] inexpensive one, may look like. [113:52] The disadvantages of a hub, it sends [113:55] data to all connected devices. So, it's [113:56] like a broadcast. If any device sends [114:00] Let's Let's say this laptop is trying to [114:02] print something to the printer. [114:04] So, the traffic that will be received is [114:06] going to be sent on all ports of the [114:09] hub. And these are ports that I'm [114:12] talking about. These are the hub ports [114:14] that we connect the devices to. [114:16] If this is going to the printer, this [114:18] should not have been sent here and [114:20] should not have been sent here. So, it [114:22] wastes the bandwidth. It wastes the [114:24] media or it occupies the media of the [114:26] network for unnecessary reasons, for [114:29] devices that don't need to receive that [114:31] traffic. [114:32] And there is no filtering and there is [114:34] no intelligence. It's just forwards [114:36] traffic. That's it. [114:38] All devices will share the same [114:39] bandwidth. So, these are major [114:42] disadvantages of hubs. [114:44] And it is lower and less secure, as [114:46] well. [114:49] Another networking device type that we [114:51] may encounter when we are building LANs [114:54] is a switch. [114:56] And that is an intelligent version of [114:57] the hub. It is much faster, and it is [115:00] more intelligent and can do isolation, [115:02] as well. [115:02] And here's an example of how a switch [115:05] from a company called D-Link, for [115:07] example, looks like. So, this one has 8 [115:11] * 3, so that's 24 ports. [115:14] I have here LED indicators, LED [115:16] indicators. When one of the ports is [115:18] connected and there is traffic on it, it [115:20] will be flashing lights, showing that [115:23] this is connected. And the light can be [115:25] green, can be red, can be orange to [115:27] indicate whether it Green means normal [115:30] operation, orange means there might be [115:32] some errors, red that means uh a major [115:35] problem, or maybe it's just switched [115:37] off, so there is no connection into it. [115:40] And as you can see, this Each one of [115:41] these is called a port or an interface. [115:43] So, this is a switch port where we have [115:46] the cable connect to. [115:49] So, these are 24 ports. That means I can [115:51] connect physically 24 devices to this [115:54] switch. [115:55] So, that's an example of how a switch in [115:58] a LAN would look like. [116:00] Now, if I take that and I start to [116:02] connect the devices to it, so each one [116:05] is going to connect through a physical [116:07] cable. We're going to look at the [116:08] details of the cables later on, and that [116:10] occupies one port, that occupies a [116:12] second port, third port, fourth port. [116:15] So, now I have 20 ports left for extra [116:17] devices or for future connectivity. [116:20] So, a switch can be physical or virtual. [116:23] So, this is a physical switch. We can [116:24] see it. And if it is in front of me, I [116:26] can touch it, as well. I can power it [116:28] on. I can connect a cable into it. But [116:31] there are also software switches. These [116:33] are the virtual switches, and we're [116:35] going to cover that as we move on. [116:37] Advantages of switches compared to hubs, [116:40] it will send data only to the intended [116:42] device. So, if we have the same scenario [116:44] where this laptop would like to send [116:46] traffic into this printer, [116:49] the the traffic is going to be switched [116:51] only between this port and this port. [116:53] So, this will not see it, and this will [116:55] not see it. Which means I am segmenting [116:58] the bandwidth. It's not like one common [117:00] bandwidth. So, at the same time, this is [117:02] sending to the printer, it could be that [117:05] someone sitting on this device is [117:07] displaying the video from the camera on [117:10] this monitor, for example. And they are [117:11] completely separate, and they don't see [117:13] each other. [117:14] And it is faster and more secure, [117:16] because now we can do the isolation. It [117:18] is intelligent, as well. We can have [117:20] security features configured, and each [117:22] connection can use its full speed. If [117:25] this port is 100 megabits per second or [117:28] maybe 1 gigabit per second, so it has 1 [117:31] gig speed into the switch. Similarly, [117:34] the second third and fourth. [117:37] And it can handle many devices more [117:38] efficiently compared to hubs. [117:42] One important feature when we talk about [117:45] switches is something called virtual [117:47] local area network or a VLAN. What is [117:50] that? [117:51] So, a switch can be configured. So, we [117:54] can configure the switch or virtualize [117:56] the switch to have multiple isolated [117:59] segments, multiple or completely [118:01] isolated from one another. They cannot [118:03] talk to each other. [118:05] So, separate segments, they are called [118:06] virtual LANs or VLANs, that can be used [118:09] to group devices logically. [118:11] So, as we have discussed the concept of [118:13] virtualization on a physical server [118:16] level, that we can have virtual machines [118:18] into that server, [118:19] we also can have virtual LANs into the [118:22] switch. [118:24] And how can we do this? We can create [118:26] VLANs, the different segments. Let's say [118:28] VLAN 10, VLAN 20, VLAN 30, for example. [118:31] That's the idea of the VLAN. [118:33] And then we map the switch port to VLAN [118:36] 10 that we needed to connect to VLAN 10. [118:38] So, the devices that need to connect to [118:40] VLAN 10, they are going to be configured [118:42] or their physical ports on the switch, [118:44] they are going to be mapped into VLAN [118:46] 10. Similarly, for VLAN 20 and 30, and [118:49] so on. Why would I do this? Could be [118:51] that I need the accountants or the [118:52] accounting team to be on a separate [118:54] VLAN, and they can communicate with one [118:57] another and with their server, but this [118:59] is sensitive information. I don't want [119:01] guests that will connect to the network [119:03] to be able to communicate or maybe sniff [119:06] or copy that traffic between the [119:08] accountants for some reason. [119:10] Okay, and that's how it will look like. [119:11] So, now I decided the the four left most [119:14] [clears throat] [119:15] ports are going to be in VLAN [119:18] I'm just referencing here the color, but [119:20] it could be VLAN 10. [119:22] And the next four ports are going to be [119:25] configured or mapped into VLAN [119:27] representing it as red, but this could [119:29] be VLAN 200, for example. [119:32] So, any devices that will connect into [119:34] the red ports or the red map ports will [119:37] not be able to communicate with the [119:39] ports that are in the blue or VLAN 10. [119:43] They will never be able to communicate [119:44] this way without extra configuration or [119:48] extra devices. [119:50] Advantages? This is better security. You [119:52] can have isolation and segmentation into [119:55] your uh LAN. [119:57] And isolation also that data will only [119:59] go to the right VLAN. So, if I send [120:01] traffic from this device, [120:04] it will only be with the basic [120:06] configuration of only segmentation, only [120:08] VLANs, it will only be able to [120:10] communicate with other ports in the same [120:12] VLAN, and that's it. It will never be [120:14] able to get into the blue port VLANs [120:18] unless I do something extra. [120:22] Okay, so we talked about the hub and we [120:24] talked about the switch and we talked [120:25] about the fact that the switch can be [120:27] segmented or configured to have isolated [120:30] segments, isolated VLANs. [120:33] Now, let's talk about the third device [120:35] that we may encounter when we are [120:37] dealing with LANs [120:39] and WANs, as well, and that is the [120:41] router or the router, however you would [120:42] like to pronounce it. [120:44] So, the router will connect different [120:46] networks together. Networks that are not [120:49] the same, they will be connected [120:51] together using a router or a group of [120:54] routers. [120:55] And these are some examples of physical [120:58] routers and how they would look like. [121:00] In essence, it looks like switch in [121:03] terms of ports, but the device is a [121:05] router. That means it has more [121:07] intelligence than just a switch. And it [121:10] can have bundled a switching function, [121:13] but we'll talk about that next. [121:16] So, the router will know how to send [121:17] data from one network to another. So, [121:19] that's the connection between separate [121:22] networks. [121:24] And the router, as the switch, can be [121:26] also physical or it can be software, [121:29] virtual. [121:31] And here's an example. So, we have the [121:33] branch that was in Germany [121:36] and the head office that was in the US. [121:38] If I need to connect them, what do I [121:40] need to do? [121:41] So, they will have to connect because [121:43] they are far away from each other. This [121:44] is a LAN and this is a LAN. They need to [121:46] connect through routers, through the [121:48] WAN, and the essence of the WAN is [121:51] routers. [121:53] So, I have to procure a router at the [121:56] Germany branch and another at the US [121:58] branch. [121:59] I need to connect each one of the [122:01] routers to the local LAN. It cannot [122:03] represent the LAN if it's not connected [122:05] to it because when traffic will leave [122:07] one of the devices and needs to get to [122:09] the US, it has to pass through the [122:12] router, and the only way is to have a [122:14] physical connection from the router to [122:17] the same segment or VLAN where these [122:20] devices connected to. [122:22] Then, I need to talk to the service [122:24] providers, AT&T, for example, or [122:27] um Verizon Wireless or Bell Canada or [122:30] whatever the company is, and I will ask [122:32] them, "Okay, here's the address and [122:34] here's the address in the US, and I [122:35] would like to connect this address in [122:38] Berlin or Germany, whatever the city is, [122:41] and I want to connect it to the US, and [122:43] this is the speed I want." You will sign [122:45] some contracts, they will take some [122:46] time, provide the connection, provide [122:48] the configuration, and everything works. [122:51] So, the router can also be used within a [122:54] LAN to connect the different VLANs. [122:57] Remember when [122:59] we mentioned two slides earlier that [123:02] a VLAN is a completely isolated segment [123:05] in a LAN from the other VLANs, right? [123:08] What if there is a need for me to have [123:10] one device from here or maybe the [123:12] monitor watch the video streams that are [123:15] coming from the camera. [123:16] How can we do this? [123:18] This is a network and this is a [123:19] completely separate network. This is a [123:20] segment and this is a completely [123:22] separate segment. So, the only way to do [123:24] that is to do routing between them [123:26] because the router is the device that [123:28] connects multiple LANs together. [123:32] And how can we do this? The router must [123:34] be connected to the different VLANs in [123:36] order to be able to forward traffic [123:38] between them. And how do we do this? I [123:40] need to have separate interfaces on the [123:43] router connect to the different VLANs, [123:46] and then I will configure the router [123:47] here to be part of this network and the [123:50] router here to be part of this network, [123:52] and then the router will be able to [123:53] forward traffic between the two when [123:56] there is traffic to be sent across the [123:59] two networks. [124:01] As I mentioned earlier, there could be [124:02] some switches that are intelligent and [124:04] they have routing function, or it could [124:06] be a router that has switching function. [124:09] No matter how it is, these are called [124:11] intelligent switches or they could be [124:12] routers with switch functions. Sometimes [124:15] they are referenced as multi-layer [124:17] switches. [124:19] We are going to talk about why where did [124:20] the multi-layer come from, but for now, [124:23] intelligent switch or a switch router [124:25] combo or an multi-layer switch, they are [124:28] all synonyms for the same thing. [124:31] So, the switch router combo device can [124:33] do both switching and routing functions. [124:35] And we signified the fact that this can [124:38] do routing as well by the little icon on [124:40] the switch. [124:41] So, in that case, if I need [124:43] communication between this network and [124:45] this network, I don't have to have an [124:47] external router. [124:50] A combo router here, that means there is [124:52] a software function on the switch that [124:54] can do routing as well. So, if I [124:57] configure that properly, I will be able [124:59] to allow traffic from the red VLAN into [125:01] the blue VLAN and the other way around. [125:03] So, no need for external routers to [125:05] connect the different VLANs in this [125:07] case. All right? So, we learned about [125:10] hubs, switches, VLANs in a switch, [125:12] segmenting a switch, router, and now we [125:15] learn about switch router combo, and [125:17] please remember that a router connects [125:19] different VLANs. [125:22] Not devices in the same VLAN. The switch [125:25] connects the devices in the same VLAN, [125:27] or it could be multiple VLANs. [125:30] But a router connects the different [125:32] VLANs or connects a LAN to another LAN [125:35] through a WAN. [125:40] So, we learned about types of networks [125:42] and network devices that we may [125:43] encounter. So, network cabling, how can [125:46] I wire the router into the switch? How [125:48] can I wire my CCTV camera into the [125:50] switch? How can I use connectivity in [125:53] the WAN? What type of cabling, physical [125:55] cabling that I could use? [125:57] Is it any cable? Can I just bring any [125:59] wires and connect them or does it have [126:01] to be of specific type? And what will be [126:05] the end connectors that will connect [126:06] into the devices? That's what we need to [126:08] see right now. [126:10] So, network cables are physical wires [126:12] used to connect computers, routers, [126:14] switches, and other devices. [126:15] They can carry electrical signals if [126:17] they are copper cables, or they could be [126:19] light signals if they are fiber optic [126:22] cables. [126:25] So, let's start with the first one, [126:26] which is the Ethernet cable or the [126:28] copper cables. Also, we call it twisted [126:30] pair or TP cables. They could be UTP, [126:33] they could be STP, different names for [126:35] them. [126:36] These cables have standards and they [126:38] have standard connectors. Maybe they you [126:40] have come across them when you are [126:41] connecting [126:42] uh your TV, for example, to the wall in [126:45] order to reach the internet. [126:46] So, this is called an RJ45 connector, RJ [126:51] 45. So, that's the standard name for [126:53] this connector. It has eight pins, eight [126:55] copper pins, and the cable has eight [126:58] wires. They are twisted pairs, and [127:00] that's why it's called a twisted pair. [127:02] The each two wires are twisted together [127:05] in a pair, so we have four pairs, and [127:08] then we have the little pin right here, [127:10] which latches into the switch port. [127:13] So, if you look at the pin and here, [127:15] you'll find that there is a groove on [127:17] the top of the port. So, there is a wide [127:19] rectangle and then there is a small [127:21] rectangle. This is where the pin will [127:24] latch, and the wires on this side are [127:27] going to touch on wires on this side in [127:30] the switch, and that's how it connects [127:32] into the switch. [127:35] So, this is used in most homes and [127:37] offices, short distances, not long [127:39] distances, and common cable types are [127:42] Cat 5e enhanced, Cat 5, or Cat 6 and Cat [127:45] 6a. [127:47] Depending on which one, it can go for [127:48] higher speeds, and the distance is [127:50] usually limited. We're talking about 100 [127:53] m or 90 m, depending on who you talk to. [127:57] Okay, and it can carry uh speeds from [128:00] 100 megabits per second to 10 gigabits [128:02] per second. It could be with the new [128:04] technologies and all that could be even [128:06] higher speeds, but it's usually limited [128:08] in distance, and the data on the cable, [128:11] the actual traffic, is represented as [128:13] electrical signals. [128:15] So, either there is a voltage or there [128:17] is no voltage, 1 0. That that's it. [128:19] We're we're going to come into that [128:21] later on. [128:22] So, maximum length is around 100 m. Some [128:25] people will tell you 100, some people [128:26] will tell you 90, but it's very limited [128:28] distance as we speak. [128:31] The second common cable type that we use [128:34] in our LANs and WANs is the fiber optic [128:37] cable. [128:38] Fiber optic cables carry light signals, [128:41] and they can go for long distance [128:43] connections. Believe it or not, the [128:45] internet has underwater, undersea, and [128:49] under ocean cables to connect the [128:51] continents together for the internet. [128:54] These cables are sturdy, they are very [128:58] uh rugged and very protected, so there [129:00] is no water leakage and it's not easy [129:02] for a fish to cut them and all that. And [129:04] when any incident happens that one of [129:06] these cables is cut, you will find a lot [129:08] of countries suffering if they are [129:10] dependent on that cable. [129:12] So, when do we use them? We use them [129:14] when we need long distances and higher [129:16] speeds that cannot be achieved using the [129:18] copper cables or the twisted pair cable. [129:21] And they convey the data, they encode [129:23] the data, they represent the traffic in [129:25] light signals and not in electrical [129:28] signals. [129:30] And they are much faster than Ethernet [129:32] and can travel longer distances and [129:34] often used by internet service providers [129:36] and data centers and also they are used [129:39] commonly in WANs, wide area networks. [129:44] Now, let's talk about data center [129:46] network or DCN. [129:48] So, the data center network, abbreviated [129:50] DCN, it's a type of a local area network [129:53] that will connect the servers, storage [129:55] systems, and networking equipment inside [129:58] a data center. [130:00] So, they can communicate and they can [130:01] serve traffic and they can connect to [130:03] the internet at a very high speed. So, [130:05] it is very common to use fiber cables [130:08] within a data center and not UTP cables. [130:10] The UTP cables can be used at the end [130:12] with the servers, that is possible, but [130:14] fiber is much higher speed and specially [130:17] for the important servers and so on. [130:21] And as you can see, the data center [130:22] switch, it has similar ports like in the [130:25] normal switches, but the capacity is [130:27] much higher. The ability to process, so [130:29] the CPU and the memory and all that are [130:32] much higher as well. It usually has [130:35] multiple [130:36] uh power supplies and usually has [130:39] multiple processor engines as well, so [130:41] it can have more availability and one [130:44] failure in a component will not bring [130:46] the switch down. [130:48] A data center may have lots of these [130:50] switches. I'm here just representing one [130:52] switch, but it can have 8, 10, 16, 20, [130:56] depending on the scale of a data center. [130:59] And the data center usually will have [131:01] one or more internet connections for [131:03] diversity and high availability. So, one [131:06] or more routers are going to connect to [131:08] the different switches into the data [131:10] center and that's how they can serve [131:13] traffic to the internet. So, if I have [131:15] multiples, that means if one of them [131:16] dies, the other one is available. And [131:18] that's called high availability or [131:20] redundancy. [131:24] All right. So, we learned about LANs and [131:26] we learned about data centers. What if I [131:27] need to connect a LAN [131:30] into a data center? So, for example, the [131:31] corporate office exists in a building [131:34] and adjacent to it, we have another [131:36] building that is the data center of that [131:38] bank or that corporate. [131:40] So, in that case, if the LAN that I [131:42] would like to connect is close in a [131:44] closer vicinity, 10 m, 20 m, 1 km, 500 [131:49] m, but not 500 mi away, it is a very [131:53] close, [131:54] then what we can do is we can use a [131:56] fiber cable, we call it an uplink, [131:59] from the switch into the data center [132:01] switch. That is, of course, if this [132:04] switch is capable of providing fiber [132:07] optic cables. Here we are only [132:08] representing a port, but if we use [132:10] copper cables, these are UTP copper [132:13] ports. [132:14] So, if I use a copper cable, that will [132:16] be only 100 m away or less. But if I [132:19] want longer distance, [132:21] 1 km, 2 km, 5 km, then I can use fiber [132:24] uplinks. [132:26] And then, of course, I can use multiple [132:28] ones for redundancy. So, if one fails, [132:31] the other one will still be available. [132:33] And through this uplink, now this LAN [132:36] can connect or share the internet [132:39] connection that is available in the data [132:40] center. So, that's how we can [132:42] consolidate one internet connection, [132:44] high speed, in the data center and then [132:47] all the scattered buildings nearby, they [132:50] can use to route or to use the internet [132:53] instead of having an internet connection [132:56] out of each building. [132:59] What if the LAN that I need to connect [133:01] to the data center is far away? It is [133:02] 200 mi away, 500 mi away, in a different [133:05] country. Then in that case, I have to [133:07] rely on the WAN, wide area network, not [133:11] the uplinks. [133:12] So, in that case, I need to get a router [133:14] connected to this switch and then talk [133:16] to the service provider to have a wide [133:19] area network [133:20] connection served here and another wide [133:23] area network connection served in the [133:24] data center and then proper [133:27] configuration is done and that is how [133:29] they can communicate. And of course, the [133:31] same. If I want to have a central [133:33] internet connection, then through the [133:35] router, through the other router, the [133:38] LAN can be using the internet [133:40] connection. [133:44] A corporate or a bank has two big data [133:47] centers and it would like to have some [133:49] backups between them. Copies of the data [133:52] will be sent between them, so if we lose [133:54] one, the other one will have the data [133:55] available or the applications available [133:57] or the websites available. [133:59] So, how can I interconnect two data [134:01] centers? And in that case, [134:03] it depends on whether they are in a [134:04] close by vicinity or are far away from [134:06] each other, but the common one is that [134:08] we connect them through routers. That is [134:11] more common, although connecting them [134:13] through switches is possible as well, [134:15] but if we connect them through routers, [134:17] then what we'll do is again, we need [134:20] a larger size router that can perform [134:22] much better under load and it can [134:25] provide higher speeds. And then the WAN [134:27] connection and that's how they connect [134:30] to the two sites and each one of the [134:32] data centers can have a separate [134:35] internet connection, so if we lose one [134:37] of the data centers or one of the [134:38] connections, the LANs connected, they [134:40] will be interconnected to this one and [134:42] to that one. [134:43] So, the LAN or one of the branches, if I [134:46] lose one data center connection or I [134:49] lose the switch in the data center, then [134:51] they can reach the other data center [134:54] through this connection instead. All [134:56] right? So, routers can help me connect [134:59] data centers, not only connect wide area [135:02] network branches and local area networks [135:04] only. [135:08] The other type of uh networks that we [135:10] need to talk about is called campus area [135:13] network. And that as the word implies, [135:16] campus, so multiple buildings close to [135:18] each other. It could be a university, it [135:20] could be a hospital, it could be a [135:21] ministry. [135:23] Multiple buildings nearby, they can be [135:25] connected through campus or a CAN, [135:28] campus area network or a CAN. And here's [135:30] an example. I have a data center [135:32] and nearby, could be 500 m away, I have [135:35] building B and maybe 1 km away, I have [135:38] building A. And I have a LAN inside each [135:41] one of these. [135:42] And I could have also [135:45] wireless LAN and a LAN in one of the [135:48] buildings. [135:49] So, in that case, and I have the [135:50] switches connecting all the devices. So, [135:52] within a building, we are fine. We can [135:54] connect and we can share and we can [135:56] print and everything. [135:57] Within the other building, yes, we can [135:58] do that as well. But we need to connect [136:01] to our servers or website or human [136:04] resources department uh servers on the [136:06] internet or maybe we need to connect to [136:08] the internet, generally speaking. [136:10] Then, in that case, if the decision was [136:12] made to connect [136:14] the data center to the internet [136:17] and have common internet connection for [136:20] all of them, then we can connect them [136:22] using uplinks and these will be fiber [136:24] optic because they can go higher speeds [136:26] and longer distances, [136:28] not copper cables in that case or UTP [136:30] cables. All right? So, that's a CAN. So, [136:33] it's a private high speed network that [136:35] links several buildings on one campus or [136:37] a limited area, like a university, [136:39] hospital, or company campus. Of course, [136:41] there is MAN as well, metropolitan area [136:43] network and so on, but it is enough. We [136:45] learned about LAN, wireless LAN, WAN, [136:47] and CAN and that is more than enough for [136:50] our purpose of this course. [136:55] Since we talked about the wired parts, [136:57] let's now talk about the wireless [136:59] network devices. So, what devices that [137:01] are wireless that we may encounter as we [137:05] build networks? [137:08] So, wireless network devices are needed [137:10] to create wireless LANs. And as we [137:13] looked at the example in the home [137:14] office, I need a wireless device that [137:16] will broadcast the wireless LAN and will [137:19] also be able to authenticate or [137:21] basically check the username and the [137:23] password when they log in to the [137:25] wireless network. [137:27] The first device that we need to talk [137:29] about is called a WAP or a wireless [137:31] access point. [137:33] A wireless access point is a device that [137:34] provides Wi-Fi signals, broadcasts Wi-Fi [137:38] or broadcasts wireless LANs into a [137:41] certain coverage area, for example, at [137:43] an airport or in a school. And if the [137:46] area is large, then I may need more than [137:49] one WAP. One will not be enough. [137:51] And this is how they look like. Maybe [137:53] when you are walking down your company [137:55] or street or school [137:57] or shopping mall, look at the ceiling, [137:59] look at the walls, you'll find devices [138:01] similar to these. These are the wireless [138:03] access points. [138:04] In the outside, in the outdoors, they [138:06] have to be rugged and they have to be [138:08] industrial grade and that's how they [138:10] look different on the outdoors. [138:13] A WAP or a wireless access point is not [138:16] a router, not necessarily a router. It [138:18] doesn't have routing function. It only [138:19] broadcasts [138:21] the [138:22] actual wireless signals and then it [138:24] connects through a cable into the LAN. [138:27] So, here is a wireless access point. It [138:29] will broadcast the signal and that's how [138:31] devices will connect into the wireless [138:32] LAN. But is that it? How can I connect [138:34] to the internet? How can I connect to [138:35] the actual network? Let's find out. [138:39] So, a WAP extends your network, it [138:41] doesn't create a new one. So, when it [138:44] creates a wireless LAN, [138:46] the wireless access point itself has to [138:48] connect into your network. At the end of [138:50] the day, what you need in your devices [138:52] not to connect to the web. You need to [138:54] be hooked into the wireless access [138:57] and then from there you'd like to get to [138:59] the internet. So, there has to be a LAN [139:01] backing the wireless network. [139:04] And it will have a wired connection into [139:07] that switch. In larger offices, we will [139:10] also need multiple wireless access [139:13] points because the coverage area is [139:15] larger and one web is not enough. [139:18] All right? So, now we have multiple [139:20] devices, maybe wing A and wing B in the [139:23] building. So, wing A will have one or [139:25] more access points to cover all the area [139:27] and have provide strong signal. And also [139:29] for wing B will have one or more [139:31] depending on the size of the building. [139:34] So, we have that connected to the LAN. [139:36] And then, how can we get to the [139:38] internet? That means we have to have a [139:41] routing function or a routing device [139:42] connected to the internet and to that [139:44] switch in the same VLAN as that [139:48] connection in order to be able to [139:50] provide wireless and then wired [139:54] connection for the traffic to go out to [139:56] the internet. [139:57] One would jump now and say, "Okay, now [139:59] but I don't I don't have that in my in [140:02] my home and I don't have that in my [140:03] home. I only have one device and my [140:06] network is connected to it and [140:07] everything works fine." I would say, [140:09] "Yes, absolutely because that's a [140:11] special case [140:12] and this is how it looks like. But then, [140:14] you need not a wireless access point [140:16] only, but you need a device that can do [140:19] wireless access point function and [140:21] routing or routing function as well. [140:24] So, it would look something like this or [140:26] maybe something like this. And most of [140:28] them, they would have a switch built in [140:31] as well. [140:33] So, that would the backside would look [140:35] something like this. So, go check your [140:36] wireless router right now that you have [140:38] at your home and you will find that it [140:40] may have antennas. The modern types, [140:43] they don't have antennas, they have it [140:44] built in. [140:45] And you will have [140:47] at least two or more ports of connection [140:51] or [140:51] physical connections that can hook to [140:54] the network. So, in that case, what [140:56] happens? You will have one port that [140:58] will be connected to the service [140:59] provider. Usually, it is a special port [141:02] and you will have either internet or WAN [141:04] written on that. [141:06] And then you will have this because if I [141:07] have a printer, the printer needs a [141:09] wired connection, not a wireless [141:11] connection. In this case, we can take [141:13] advantage of the back ports for wired [141:16] connections. [141:17] So, it will serve the wired connection [141:20] requirements and the wireless through [141:22] the antennas and that connects to the [141:24] internet. So, this is a Wi-Fi access [141:26] point that has routing function as well [141:30] and it will have a built-in mini switch [141:33] to connect the wired devices. So, [141:35] hopefully that's clear. Now, we know [141:36] about hubs, we know about switches and [141:38] we know about virtualizing a switch into [141:41] multiple [141:42] uh switches or mini switches called [141:45] VLANs. And then, we learned about [141:46] routers and routers connect different [141:48] networks and we learned about data [141:50] center network and now we we learned [141:52] also about network devices that are [141:55] wireless like wireless access point or [141:58] wireless routers. All right? Hopefully, [142:00] that was clear and easy to understand. [142:06] Let's zoom into or have a closer look [142:08] into the internet. The internet consists [142:11] of millions of local area networks, data [142:14] centers, home offices and offices and [142:17] homes and wide area networks connected [142:20] through routers and high-speed links [142:22] creating one global network. That's what [142:23] the internet is. [142:25] So, I may have a corporate data center [142:28] in India [142:29] and we have that data center switches, [142:31] we have the router and it's connected to [142:32] the internet and I have databases and [142:34] applications and storage and so on. [142:38] Maybe I have a branch in Germany that [142:41] needs to connect to that data center. [142:42] So, that corporate data center is in [142:44] India, but the company has a branch in [142:46] Germany. So, I have a LAN in Germany and [142:49] maybe a wireless LAN as well. I need to [142:51] connect it to the data center. How can I [142:52] do it? Have a router connected to the [142:55] internet. So, there was a possibility to [142:57] connect it through WAN that we talked [142:59] about previously, but also we can [143:02] connect it through the internet. How can [143:04] we make it secure? We'll talk about that [143:05] later on. [143:08] And maybe also one of the employees [143:10] works in the UK in a home office and [143:13] they need or he needs or she needs to [143:15] connect through the internet also to the [143:18] data center. So, that's all possible and [143:20] that's what the internet does, the [143:22] largest global network or global WAN in [143:25] the world. [143:27] So, a closer look into that. What does [143:29] the internet consists of? So, as we [143:32] mentioned, we have home-based users, we [143:34] have separate users in a library, we [143:36] have data centers in other places and [143:38] that is routers connected via very [143:42] high-speed links and that is what [143:45] actually forms the internet. So, [143:47] high-speed connections interconnecting [143:49] tens of millions maybe of routers across [143:52] the globe and that is what the internet [143:54] is that everyone connects to. And once [143:56] you are connected to the internet, you [143:58] can communicate with the rest of the [143:59] internet. [144:05] All right, it's time to start module [144:07] five and this will be about first steps [144:10] into diving deep into networking [144:12] fundamentals. So, understanding more [144:15] about the networks and the first thing [144:16] we need to understand is why do we need [144:18] IP addresses and how do they look like [144:21] and how can we deal with them. And by [144:23] the end of this module, you will be able [144:25] not only to spot IP addresses and [144:28] recognize them and identify the [144:29] different networks, but also you'll be [144:31] able to be given a block of IP addresses [144:34] and design according to requirements an [144:37] IP scheme breaking down that block into [144:40] multiple networks and sub networks and [144:43] assigning them to WANs and LANs and so [144:46] on. So, we are going to cover what are [144:48] IP addresses and why do we need them and [144:50] how do they look like. Numbering [144:53] systems, we'll get into a little bit of [144:55] math. I will make it super easy. I [144:57] promise you. I know a lot of you hate [145:00] math, but I'm going to give you the [145:02] analogies where it will make it a lot [145:05] more easier because you need to [145:07] understand how computers can comprehend [145:10] IP addresses and how can distinguish a [145:13] local IP address from a remote IP [145:16] address and then send the traffic to the [145:18] router or not depending on where it is. [145:21] So, we'll talk about decimal, which is [145:23] the numbering system we all know, the [145:24] 10, 20, 15, 32. This is what we are used [145:28] to. But also, we'll introduce how [145:30] computers deal with numbers and text and [145:32] data, which is binary. [145:34] And we are going to show you how you can [145:36] convert from decimal to binary, from [145:38] binary to decimal. We look at the IP [145:40] address types. There are two versions, [145:43] IPv4 and IPv6. We'll look at what are [145:45] the differences between them. We'll also [145:47] look at hosts and networks. How can we [145:50] assign to the servers on a specific [145:52] network IP addresses and how can I tell [145:55] whether they belong to the same network [145:56] or to different networks. We'll look at [145:59] something called the subnet mask and [146:01] we'll do a lot of practice on that. [146:03] We'll look at the IP address classes. We [146:05] have class A, B, and C. We'll look at [146:07] them and you will be able to distinguish [146:10] between the different classes when you [146:11] see an IP address. [146:13] I will show you how to break down a [146:16] range or a block of IP addresses the [146:19] easy way using online tools. And also, [146:22] we are going to show you the detailed [146:24] way of how you can do it if you would [146:26] like to practice doing that. And of [146:28] course, those of you who are going to [146:30] dive deeper into networking, they should [146:32] be able to understand how that is broken [146:35] down and how it works and how to [146:37] calculate them and all that stuff. [146:40] So, that will be the IP subnetting in [146:42] details. And then, we I'm going to [146:44] provide you with a table that has [146:46] subnets ready for your use if you would [146:48] like to train without going into all [146:51] that hassle every time calculating what [146:53] the subnets are and all that. So, these [146:55] are going to be handy anytime you'd like [146:58] to create [147:01] networks in the cloud and practice on [147:04] addresses and how do they relate to the [147:06] internet and what are private IP [147:08] addresses. So, we have a very long [147:11] module ahead of us, but very interesting [147:13] and I'll make it super easy. I promise. [147:15] So, please hang in there. Networking [147:17] fundamentals are very key to any [147:20] engineering role in the recent or the [147:23] modern IT. And also, if you would like [147:25] to build networks as a developer and you [147:28] start launching your application and [147:30] databases and different apps and put [147:32] security in between, then you need to [147:34] know also all these IP addresses thing. [147:38] And this is where a lot of people get [147:40] stuck in getting into cloud and getting [147:42] into IT because they would say, "This is [147:45] above my head. I can't understand it. It [147:47] involves math. No, no, no, no, not for [147:49] me." [147:50] Stay with me and I promise you that it [147:52] will be super easy by the end. I will [147:54] make it super easy. All right? The first [147:56] thing we are going to look at will be [147:57] the IP addressing and why do we need it. [148:00] Let's look at analogies from our life [148:02] and find out if that is relevant or it [148:05] makes sense or it doesn't make sense. [148:07] How can people communicate? It's very [148:09] easy. Even if I don't know you and you [148:11] don't know me, I can smile and say hi [148:13] and you're you're going to say hi back [148:14] and I'm going to ask you, [148:16] "Uh what do you do here? How's your [148:18] coffee? How's your day?" This and that. [148:20] And then we start and we get to know [148:22] each other, maybe introduce our names [148:25] and maybe phone numbers later on and [148:27] then probably a friendship starts or [148:29] something. [148:31] And we use names to distinguish each [148:33] other. So, if we have a group of people [148:35] standing in a park for example, then [148:38] George and Ahmed and Sarah and Layla and [148:40] Sneha, they can be in in a classroom, [148:44] they can be in a hospital, in a match. [148:46] And if they know each other, they can [148:48] call each other by name. Or if they have [148:49] badges, I'm going to read the badge that [148:51] you have, and then I'm going to call you [148:53] by your name. [148:56] Same thing for mobile phones. Each one [148:59] has a unique number, and that number is [149:02] not used by anyone else in the globe. If [149:05] the number is the same, the country code [149:06] will be different, and the area code [149:08] will be different. So, numbers can [149:10] repeat, but not the area code and the [149:12] country code. So, there globally, there [149:14] are no two people using the same phone [149:16] number if you add the country code and [149:18] the area code. Why do we have unique [149:20] numbers? Because when I'm calling you, [149:23] if you don't have a unique number, I'm [149:25] going to call the wrong person, or maybe [149:26] multiple people will pick up the phone. [149:29] But I want to reach you and nobody else. [149:32] If I would like to call Sarah Joan, for [149:35] example, this is her number on my phone, [149:37] and I'm going to push the screen or [149:40] click on the screen on that one, and it [149:41] will start calling Sarah. [149:43] Same thing, Sarah has my number, and my [149:47] phone number and my name. So, as soon as [149:49] the phone rings, she will look and [149:51] she'll find Ahmed Eid is calling. And [149:53] depends on how important the call, if [149:55] she's available, if she's free, and if [149:57] she's in a meeting, she'll just mute it [149:59] and call Ahmed back later on. [150:02] So, each user of a mobile phone has a [150:05] unique number as well. [150:07] Individuals have mailing addresses, and [150:09] that's how they receive Amazon [150:11] deliveries and food deliveries and so [150:13] on. [150:14] So, John Smith lives in 32 University [150:18] Street in Boston, Massachusetts, and [150:20] that's the zip code, and it is a house. [150:23] Similarly, Sarah Halim, she lives in 122 [150:25] Maidan Street, Dokki, in Cairo, in [150:28] Egypt. She has a postal or PO box, and [150:31] she lives in a house as well. So, street [150:33] number is enough to deliver the package [150:35] to the house. That's more than enough. [150:37] So, if John Smith from the US would like [150:39] to send something to [150:42] Sarah, then he will write to, so that's [150:45] the recipient, the other party, and the [150:47] details of the address of Sarah, and [150:49] then from, who is the sender, so that is [150:52] uh John Smith, and of course, there will [150:54] be a stamp, and that will be sent [150:57] through United States Postal Service. It [150:59] will get to Sarah eventually, and it [151:02] will be delivered using the Egyptian [151:04] post to her address. She will read the [151:07] letter, and then maybe she will respond [151:08] and send it back. The same thing applies [151:11] to email addresses. I send you an email, [151:15] you know who sent it to you, and then [151:16] you reply to my email address. So, if [151:18] Sarah would like to respond to John [151:21] through a letter in an envelope, then [151:22] she will be the sender, and he will be [151:24] the receiver. And again, the postal [151:26] services, if the address is correct, [151:28] they will be able to deliver it back. [151:30] So, this is all human being stuff, and [151:33] it's very common to all of us. Now, the [151:35] question is, if I have a desktop [151:38] connected to the internet in Germany, [151:40] and another one in Brazil, [151:42] and I have a mobile phone user in Egypt [151:45] connected to the internet, and a laptop [151:47] user with a browser in India. [151:50] How can they all get to amazon.com? [151:53] They want to buy stuff from amazon.com. [151:55] They would like to get into the [151:57] e-commerce website of Amazon, and then [151:59] each one of them is going to look at [152:02] the products, and then decide what to [152:04] buy. [152:05] How can we ensure that the internet will [152:07] not be confused that if this guy will [152:09] communicate with Amazon, and and they're [152:11] looking at watches, the response will [152:13] not go by mistake into the user in [152:16] India, or maybe the user in Egypt. [152:18] And if the user in Brazil is looking at [152:21] soccer balls, how do we ensure that the [152:24] response will be addressed properly to [152:26] the right place? [152:28] That means we need unique addresses for [152:30] anything connected to the internet, and [152:32] that is called an IP address, an [152:35] Internet Protocol address. [152:38] So, if we take one of these users that [152:41] would like to get into Dolphin Ed [152:42] Academy, which is hosted on the [152:44] internet, [152:45] on a server, then how can they approach [152:50] or address the request sent to the [152:52] website to sign in? [152:54] And how would the server know who is the [152:56] sender, so they can respond to the [152:59] correct user and provide the sign-in [153:03] page? So, we need an address. We need a [153:05] client address, and we need a Dolphin Ed [153:08] Academy server address. [153:10] Who's going to do the connection between [153:12] them two? Because they are different [153:13] networks, and this could be could be in [153:16] the US, and the user could be in Egypt. [153:19] So, that means we have to have routing, [153:21] because the only way we learned that we [153:24] can connect two different networks is [153:26] through routers. So, we have to have [153:28] routing functionality in between, at [153:30] least one in the internet, and we said [153:32] that the internet is a gigantic number [153:35] of routers or routers connected together [153:38] with high-speed links, right? So, what [153:41] is the name of that address? What's the [153:42] name of this address? And these are [153:44] called IP addresses. And why are they [153:47] called IP? Because it stands for [153:49] Internet Protocol, which is a set of [153:52] rules that are standardized globally [153:56] that govern how data is sent and [153:57] received over the internet or any other [154:00] network. There used to be other [154:02] protocols for other ways to build [154:04] networks, but now IP is the predominant [154:07] one. So, think of the Internet Protocol [154:09] as the postal system on the internet or [154:13] any other network, whether it is in a [154:14] data center or in a local area network [154:16] or a wireless LAN. [154:19] So, now the IP address, or the address [154:22] of the client, is called the client IP [154:24] address, and that of the server is [154:26] called the server IP address. [154:29] And the routing function is called IP [154:31] routing as well, because now we are [154:33] speaking a common global language on the [154:35] internet called Internet Protocol, the [154:38] IP language. [154:41] So, if we extend that and give an [154:43] example, then the IP will define IP [154:47] address blocks, of which IP addresses [154:49] they will get assigned to each device. [154:51] And if you are on the internet, like the [154:53] phone system, it has to be a unique IP [154:56] address to define you on the internet. [154:59] It has to be. There is no budging on [155:01] this. It can't be that my home wireless [155:04] LAN and your home wireless LAN are using [155:06] exactly the same internet IP address. [155:09] There is no way this will happen. And we [155:11] are going to get into how this is [155:13] guaranteed. [155:14] Okay. So, we need the client IP address, [155:16] and we need the IP routing. So, IP [155:18] Protocol as well will define [155:22] how routing can happen, and how routers [155:24] function, and how they understand [155:26] messages, and how they can forward them. [155:28] So, all of this is within the IP realm [155:31] of protocols or functionalities. [155:34] The messages sent from me to the server, [155:37] and from the server responses to me, [155:39] they are called IP packets. [155:46] Now, let's look at the format of the IP [155:48] addresses. How would an IP address look [155:50] like? [155:52] If we extend that into the client-server [155:55] web application that we have looked at, [155:57] then we need an IP address [156:00] on the client side. Here is an example. [156:02] This is how it looks like, a number [156:04] {dot} a number {dot} a number {dot} a [156:06] number. [156:07] And we need the IP routing functionality [156:09] here, and this could be the IP address [156:11] on the server. Just examples. So, the [156:13] client, no matter what, must have an IP [156:16] address, and the server you're trying to [156:17] get to must have an IP address as well. [156:20] How can we define or find the device IP [156:23] address that we are using? How can I [156:25] confirm that I have an IP address on my [156:28] computer, for example? [156:30] Then, if you are using [156:32] a Windows laptop or a Windows device, [156:34] then you can open the command CMD, go in [156:39] the search bar at the bottom, [156:41] and then click CMD type CMD and click. A [156:44] black window will open, and then you can [156:46] go and do IP config. That's That's it. [156:49] So, you will have a prompt like this, [156:50] and then you just type IP config and hit [156:53] enter. You will get the IP configuration [156:55] on your machine, and you will get either [156:58] the wired or the wireless will have an [157:00] IP address for you. [157:02] If this was on a Linux or a Mac OS [157:05] device, you can use the IPA command. [157:08] That is possible. Maybe it will work. If [157:10] it's not installed, the IP utility on [157:13] your laptop or on your Mac on your [157:15] Linux, you can use a different command [157:17] like the IP config get IF get interface [157:21] address EN0. And let me show you that on [157:24] my Mac to prove that I have an IP [157:26] address. So, here's my terminal, and [157:29] what I will do is I'm going to do IP [157:31] config [157:33] get IF address, [157:35] and that is EN0, and you'll find that it [157:38] has an IP address, as you can see here. [157:41] So, 192.168.68.108. [157:44] So, that is a number {dot} a number [157:46] {dot} a number {dot} a number, and [157:48] that's how an IP address looks like. [157:52] So, use IP config enter if you are on [157:55] Windows after you open the CMD, the [157:58] command, and you will see that. If you [158:00] are on Linux, try this, and try this. [158:02] One of them should work. [158:07] So, the IP address available versions [158:09] are IPv4 [158:11] and IPv6. [158:14] The IPv4 is easy to understand when you [158:17] look at it. It is 32-bits long. We are [158:20] going to talk about what a bit means [158:23] very uh soon in the next slides. [158:26] And it is four fields separated by [158:30] {dot}, [158:31] as you can see here. So, 120 {dot} 130 [158:35] {dot} 233 {dot} and then 12. [158:40] It requires a subnet mask. We are going [158:42] talk about what that is. Can have public [158:45] or private ranges. We're also going to [158:47] cover that later on. [158:49] The IPv6 is written or represented in [158:52] hexadecimal notation. So, you might see [158:55] letters [158:57] A A to F and you might see numbers as [159:00] well. [159:01] It's 128 bits long, eight fields, and an [159:04] example is [159:06] a number colon number colon number [159:07] colon. And as I mentioned, you can see [159:09] numbers and you can see A to F symbols [159:11] as well. And it requires a subnet mask [159:13] as well and can have public or private [159:16] ranges as well. [159:19] So, how can computers read IP addresses? [159:21] How can the computer or my device or my [159:23] phone be able to read this IP and to [159:26] make sense of it or read that IP and [159:28] make sense of it? How is that possible? [159:30] How can we allow computers and computing [159:33] devices to read this IP address and [159:35] recognize them and find out which [159:37] networks they reside on and what are the [159:40] host identity on that network? This is [159:43] very important and that's why we will a [159:45] little bit get into some simple math to [159:49] explain to you how is that represented [159:51] inside the computer because the computer [159:53] does not have eyes to speak or read [159:56] English and find out the decimal and the [159:59] hexadecimal and other representation. [160:01] Everything inside the computer is [160:02] binary, binary numbering system. So, we [160:05] need to understand it at a high level to [160:07] be able to break down IP addresses and [160:09] explain to you how that happens in a [160:12] computer. [160:18] All right. Now, let's introduce a little [160:21] bit of simple math and we are going to [160:23] compare that to the decimal numbering [160:25] system that we all know and deal with [160:27] every day when we pay money, when you [160:29] calculate the change and all that [160:32] because we need to understand how do [160:35] computing devices understand IP [160:37] addresses and how can they tell [160:40] if an IP address belongs to their local [160:42] network or needs to communicate with an [160:44] external network or another network. So, [160:47] to do that, let's refresh our knowledge [160:50] about the decimal numbering system. [160:53] Several numbering systems exist. We are [160:56] used to the decimal one, the one that [160:58] has the symbols 0 1 2 3 4 5 6 7 8 9. And [161:02] any number that we use today [161:04] consists of a combination of these [161:08] digits, we call them, or these symbols. [161:11] And there are 10 symbols and that's why [161:13] we call them decimal because it has five [161:16] and then another five. [161:18] So, from 0 to 9, including 0, are 10 [161:21] symbols, not nine symbols. [161:23] Computing devices, they use the binary [161:26] numbering system internally. [161:28] And this has only two symbols, that's [161:31] why it's called binary, the 0 and the 1. [161:34] There also exists other numbering system [161:36] and as an example, the hexadecimal. [161:38] Hexadecimal means 16. Hex is 16. [161:41] And has 16 symbols and they start from 0 [161:44] all the way to 9 and then A B C D E F. [161:48] So, from 0 to 9 is 10 and then 2 4 6. [161:52] That's why it's 16. [161:54] Example, if we have a number 521, [161:59] that is decimal. Can we represent that [162:01] in binary? Of course, we can. [162:03] And that will be the representation [162:05] because we can only use 0 and 1 in [162:08] binary. And in hex, it will look [162:10] something like this. 0x, which means [162:13] means hexadecimal, and then 209. [162:16] Don't worry about the conversion. If you [162:18] would like to use your calculator to to [162:19] confirm this, that's fine, but we are [162:22] going to explain the binary. We are not [162:24] going to explain the hexadecimal in this [162:26] course. [162:27] Computing devices use binary numbering [162:29] systems internally. Even your [162:30] calculator, even if it is a handheld [162:33] calculator and you are typing numbers [162:35] and doing mathematical equations [162:37] internally within the calculator, it's [162:39] zeros and ones. It's converted into [162:42] binary and represented as binary within [162:45] the calculator. And that is true for [162:46] your phone, for your laptop, for your [162:48] iPad, for your computer, and so on. [162:52] Decimal numbering system, when we have a [162:55] number like this, [162:57] how do we pronounce it? We don't say 3 4 [163:00] 5. We say 345. [163:04] Why did we say about the three 300? [163:07] And why we did we say about the four 40? [163:10] As if we are multiplying by 10 and here [163:12] we are multiplying by 100 and this is [163:14] only five, 345. [163:17] This is because depending on where the [163:19] digit sits, where it is located in the [163:21] combination of symbols, [163:24] that has a weight. Each position has a [163:27] weight. [163:28] And this is something we all know. So, [163:30] let's say if I'm looking from the [163:32] right-hand side on the first, second, [163:34] third, and fourth positions, [163:36] we know that the first one is called the [163:38] units [163:39] and this is the tens and this is the [163:41] hundreds and this is the thousands and [163:43] so on. [163:46] And why do we call them like that? [163:47] Because any number that exists in the [163:49] first position, its weight is multiplied [163:52] by one and that will be the weight of [163:54] the position itself. [163:56] Then, we have the second position, which [163:58] is tens, and that is 10 [164:00] times one. [164:02] The hundreds is 10 times 10 or 100. [164:04] That's the weight. And then the [164:05] thousands is 10 times 10 times 10, which [164:08] is 1,000. So, if we have the number 345, [164:11] the reason is this is in the hundreds [164:14] position, so it is not three, it is 300, [164:17] three times the weight. [164:19] Here, it is four times the weight, [164:21] that's why it's 40. And here, it is five [164:23] times one and that's why it's only five. [164:28] And if we have a number like this, we [164:30] would call it or we would pronounce it [164:33] as spell it as 5,394, [164:37] exactly because of the same reason. [164:39] It's five times the weight of the fourth [164:42] position and three times the weight of [164:45] the third position, nine times the [164:47] weight of the second position, and then [164:49] four times the weight of the first [164:51] position. [164:52] And that's exactly how it looks and the [164:54] position weight is how it is written in [164:58] this row. And if we multiply these, we [165:00] can get each digit what it is exactly. [165:05] And then if we combine these, we get the [165:07] total number. So, it's 5,394. [165:12] So, this is how it looks in decimal. How [165:15] is it in binary? Let's consider that [165:17] next. [165:23] All right. Let's now have a brief [165:25] overview of the binary numbering system [165:27] and I promise you it is easy to [165:29] understand, so don't freak out. [165:33] The binary numbering system has only two [165:35] symbols, the 0 and the 1. [165:39] Each digit in binary number is called a [165:41] binary digit or bit. Remember when we [165:44] said that the IPv4 or the IP address is [165:47] 32-bit long? So, we call it in decimal [165:50] digit only, here we say it's binary [165:53] digit abbreviated a bit. So, when we say [165:55] a digit, we're talking about decimal. [165:57] When we say a bit, we're talking about [165:58] binary. [166:01] For example, this long number or long [166:04] binary string is a representation of [166:06] 521. [166:10] Let's look at something called [166:11] exponents. That's also in math, we use [166:14] it. And this is a shortcut for repeated [166:16] multiplication. We use it a lot in [166:18] binary and that's why we are bringing [166:19] that in here. [166:21] So, for example, if we multiply 2 * 2, [166:24] that's 4 * 2 is 8 * 2 is 16. [166:27] Okay? So, this is a two multiplied by [166:30] itself four times and that's the 16. Is [166:33] there a way we can shortcut or we we can [166:36] represent this in a shorter form? And [166:38] the answer is absolutely, we can do this [166:41] and it is the base is two [166:44] and the number of times it's multiplied [166:46] by itself is the exponent. So, this is [166:49] the base and this is the exponent. [166:52] All right? And it's pronounced two to [166:54] the power four. And it can also be [166:57] written like this, two [166:59] control four, and that means two to the [167:02] power four. That means 2 * 2 * 2 * 2. [167:06] If I say three to the power two, means [167:09] what? 3 * 3. 3 to the power five, that [167:11] means 3 * 3 * 3 * 3 * 3, five times. [167:17] Any number to the power zero is one. So, [167:19] 2 to the power zero is one. 10 to the [167:22] power zero is one. But we are going to [167:24] focus on binary again. [167:28] So, what's about the weight of the [167:29] position when it comes to binary? [167:33] So, as in the decimal system, each bit [167:35] position in binary has a weight. [167:38] As we spoke about the tens and the [167:40] units, tens, hundreds, and thousands, [167:43] here, it doesn't spell like tens or [167:45] hundreds or anything because we don't [167:47] have 10. We have only 0 and 1. [167:49] So, let's look at the first position, [167:51] the first on the right-hand side. [167:53] So, the first position's weight is one. [167:58] The second position is weight is two two [168:02] times one, which is two. [168:05] And guess what will be the third one? It [168:06] will be 2 * 2 because in decimal we did [168:10] one and then time 10 * 1 and then 10 10 [168:13] * 10 and then 10 * 10 * 10 for the [168:16] thousands and so on. [168:18] Here, it's exactly the same, but we [168:20] replace the [168:21] 10 by 2. [168:23] So, 1 * 1 is 1, that's the weight of [168:26] this position. [168:27] 2 * 1 is 2, that's the weight of this [168:29] position. 2 * 2 is 4 and that's the [168:32] weight of this position. Guess what will [168:33] be the next one? Yes, two [168:35] times two times two, which is eight. [168:38] And then, 2 * 2 * 2 * 2, which is 16. [168:41] And then [168:43] 2 to the power 5, which is five times, [168:46] that's 32, 64, 128, 256, 512, 1024, and [168:51] so on. We are only going to focus on [168:54] eight [168:55] bits long strings because the IPv4 [168:59] address or the IP address has four [169:02] eight-bit numbers. So, let's go ahead [169:05] and look at how we can convert decimal [169:08] numbers into binary. And all of these [169:11] strings are going to be eight bits long. [169:13] So, I'm not going to go to seven or [169:15] nine. We're going to stick to eight all [169:17] the time. Because it is relevant to the [169:20] IP address discussion that we're going [169:21] to do next. [169:24] So, if I would like to represent the [169:26] decimal number zero [169:28] in an eight-bit string, [169:31] well, it's obvious. That will be all [169:33] zeros because I can't take the weight in [169:35] any one position. If you put one in any [169:38] one of these positions, you have to [169:39] account for its weight in the result. [169:42] And zero has to be all zeros. How about [169:45] one? [169:47] We start from the rightmost position, [169:50] and then that will be a one, and else is [169:52] going to be zeros. [169:54] Which means that is the weight is one. 1 [169:57] * 1 is 1, so it's exactly the same. [170:00] Two, that will be zero in the first [170:03] position, and then I'm going to put a [170:05] one in the second position. Why? Because [170:07] the weight here is two, and I want a [170:09] two. What if I want a three? [170:12] What if I want to convert three? So, I'm [170:15] going to take the two and the one with [170:17] me. [170:18] What if I want to represent four? [170:20] This one cannot help me. This one cannot [170:23] help me. The third one, the weight is [170:25] four. So, that's why I'll take it. [170:27] Remember that the weights are 1 2 4 8 [170:30] 16, and so on. [170:32] Five, that means 4 + 1. [170:35] Six, that means 4 + 2. [170:38] Seven, that means 4 + 2 + 1. The weight [170:42] here is 4. The weight here is 2. The [170:44] weight here is 1. [170:46] If I add 1 + 2 + 4, that is 7. 8. [170:51] That is 0 0 0, and then the weight in [170:55] the fourth position is 8. So, I'm going [170:57] to put a one there. [170:59] Nine, it is going to be 8 + 1. [171:03] 10, [171:04] it's going to be 8 + 2. [171:07] 11, that will be 8 + 2 + 1. 12, that [171:12] will be 8 + 4. [171:14] And so on. So, I think you get the [171:16] point, and that is how it works. So, 16, [171:19] for example, 16 means I'm going to [171:22] get the position that has 16 within that [171:26] number, and then the rest is zeros on [171:29] the left and on the right. [171:32] Let's pick another number. Let's pick, [171:34] for example, 31. [171:36] 31 means 16 [171:40] + 8, that is 24. [171:43] + 4, that is 28. + 2, that is 30. And + [171:47] 1, that is 31. [171:50] If I need to shift to 32, the next [171:52] number, that means I cannot have zeros [171:54] in the very first five positions, and [171:56] then I'm going to put a one in the [171:59] position where its weight is 32. [172:02] 33, that means 32 + 1. [172:06] And so on until we get to 63. 63 means [172:10] 32 + This has a mistake here, so it [172:13] should be one. [172:14] So, it's 30 32 + 16 [172:17] + 8 + 4 + 2 + 1. So, that's 48 + 8, that [172:22] is 56. 56 + 4 is 60, and then 62 63. [172:28] Okay? And afterwards, if I would like to [172:30] get to 64, then I have to zero all these [172:33] ones because I'm going to take the [172:34] position that has a weight of 64. [172:38] What if I want 127? [172:42] What do you think the equivalent numbers [172:44] are going to be? [172:45] Can I take the eighth position? And the [172:47] answer is no, I cannot. Why? Because the [172:50] weight is 128, and that's larger than [172:52] the number I want. [172:55] And then the next one, 64, I'm going to [172:56] take it. Why? Because it's less than [172:58] 127. [173:00] 32, the next one. 32 + [173:02] 64 is 96. So, that's less than 27. [173:07] And what's the next one? That is going [173:09] to be 16. 16 + 96 is 112. So, it's still [173:15] less than 127. [173:17] What about the next one? The next one is [173:18] going to be eight. So, 112 + 8 is 120. [173:22] So, I'm going to take it with me. [173:24] How about the next one? The next one is [173:26] four. So, that's 124. What are we [173:29] missing? We are missing the two and the [173:31] one. So, seven ones are going to give me [173:34] the 127. What will be the 128? That will [173:37] be one, and then 0 0 0 [173:40] 0 0 0 0. How did I get to that? Because [173:43] the weight here on the on the eighth [173:46] position is 128, and that means I don't [173:48] need anything else. We are going to [173:50] practice a lot on this one, and you are [173:52] going to be proficient as you get to it. [173:57] So, that's 127 128. How about 192? 192 [174:00] is, if you think about it, that is 128 + [174:03] 64. If you do the math, you'll find [174:06] exactly these are what you need, and [174:08] then you don't need anything else [174:09] because you have already reached the [174:11] decimal equivalent that you want. [174:13] How about if we put all ones in an [174:16] eight-bit string? What will be the [174:18] equivalent? The equivalent is going to [174:20] be 128 [174:22] + 64 + 32 + 16 + 8 + 4 + 2 + 1. If you [174:28] combine all of these, you'll end up with [174:30] 255. So, the largest number you can have [174:33] in an eight-bit string is 255. [174:38] And the lowest number is all zeros, [174:41] which will give you zero. So, the range [174:44] is from zero to 255 [174:47] when it comes to an eight-bit string. [174:51] And these are 256 [174:54] different numbers. [174:56] One would tell me, "No, no, no, no, no, [174:57] hold on. This is 255 only." I would say, [174:59] "No, that's That's incorrect." Let's [175:02] take a simpler example. If it is 0 1 2 [175:05] 3, how many symbols do you have? How [175:06] many numbers do you have? You have four, [175:08] although you are starting from zero. [175:10] Similarly, if I start at zero and end at [175:12] 255, that means I have 256 different [175:17] numbers that I can represent by an [175:19] eight-bit string in binary. [175:22] How about if it is only two bits? [175:26] Two positions. How many can you [175:28] represent? [175:29] Let's see. It's 0 0. [175:32] 0 1, that's a different number. 1 0 is a [175:35] different combination. And then 1 1. So, [175:37] that means in two bits, I can represent [175:39] four different numbers. [175:41] And these are 0 1 2 and 3 in decimal. [175:45] We're going to practice a lot more on [175:46] this, so you are going to be familiar [175:48] with it. [175:52] All right. So, let's do binary to [175:53] decimal practice. Let's do more [175:55] examples, and these are going to be [175:57] random, and I will show you the table of [175:59] the weights, so it will be much easier [176:01] to decide on this. [176:03] All right. So, what if I forget the [176:05] numbers? I forgot the bit positions. How [176:07] can I find it? The first one is one. [176:09] Remember that, and then any other one is [176:12] 2 to the power one. [176:14] So, here 2 to the power [176:16] I'm sorry, n, not one. And n is the the [176:19] bit position. So, this is the second [176:34] So, this is the second position. That [176:35] means 2 * 1, it's it's two. This is the [176:38] third position. So, you need to multiply [176:41] two times. So, that is 2 to the power 2, [176:44] which is four. This will be 2 to the [176:46] power 3. So, 2 * 2 * 2, that's 8. And [176:49] then 4 16 32 64 128. And we will always [176:54] deal with eight-bit long [176:57] symbols or strings, and that's what [177:00] relates to the IP addresses that we are [177:02] going to discuss. So, for networking, [177:04] for cyber security, for development, for [177:06] cloud, for anything, all you need to [177:08] know in binary is the eight-bit string [177:11] conversion, and you'll be good to go. [177:14] So, here is a practice. Find the [177:15] equivalent in decimal for the following [177:19] binary. [177:20] So, this is the rightmost, so this is [177:22] position one, and this is position [177:24] eight. [177:25] So, the weight here is 128. [177:28] And then 64 32 16, and so on. So, let's [177:31] put it in a table. It will be easier for [177:33] us to remember it. [177:35] So, we need to map [177:37] this binary into [177:39] this weights and positions. So, this one [177:42] is going to map to the rightmost, and [177:45] this one is going to map to the [177:46] leftmost. So, let's write it [177:48] in a cleaner way. So, it is 0 0 1 1 0 0 [177:53] 1 1, and then all zeros. We need to look [177:56] at the positions where the binary or the [178:00] bit is equivalent to one, and we take [178:04] the corresponding weights, add them [178:06] together, and that will be the result. [178:08] So, here I only have two ones in the [178:11] four position and in the eight position. [178:13] So, 8 + 4 is 12. That's the equivalent [178:16] to this number. [178:19] Let's do another one. [178:21] Here's another one. 0 1 1 0 and 1 1 0 0. [178:26] So, let's map that to our table. [178:29] And that will be a one in the third [178:31] position, fourth position, and then [178:34] sixth and seventh positions. So, I have [178:37] one one and one and one. [178:41] So, what are the corresponding weights? [178:43] 4 8 [178:45] 32 and 64. Why I will not take the 128? [178:49] Because the corresponding bit is zero. [178:51] Zero times anything is zero. [178:53] Similarly, zero times anything is zero. [178:55] Zero times anything is zero. Zero times [178:57] anything is zero. That's why I just [178:59] ignored them. [179:00] So, I need to add 64 + 32 + 8 + 4. So, [179:04] these are 96 [179:06] and these are 12. 96 + 12 that will be [179:11] 108. [179:14] Another example. What if I have this [179:16] binary string 1001 1100? [179:20] Again, [179:22] this table should be implanted somehow [179:24] or it should be stored in your mind [179:26] after you practice a little bit. [179:29] So, here is what we have. We have 1 001 [179:33] and then 1100. [179:35] So, what are the corresponding weights [179:37] that we need to add? 8 and 4 [179:39] and 16 [179:43] and 128. [179:46] So, this is this does not count. This [179:48] does not count. And this does not count [179:50] and this does not count. [179:51] So, 128 + 16 that is 144. [179:56] + 4 that is 148 + 8 that is 156. [180:02] All right? [180:04] You can use the calculator if you would [180:05] like to make it easier for you. I like [180:07] to do the mind math, but it's up to you. [180:09] Here is another one. 10100011. [180:14] So, here's our table and here is the [180:16] mapping. So, 1010. [180:19] So, this is [180:20] uh with us and this is with us as well. [180:22] And then 11 at the end and all the [180:25] others are ignored. So, we ignore these [180:27] completely. 128 + 32. So, that is going [180:30] to be 160 [180:32] + 3 that's 163. [180:37] Next one. [180:38] 11001100. [180:41] Although they look the same, but because [180:42] of the bit positions, they will have [180:44] different I like these four are going to [180:46] weigh much heavier than these four [180:49] because of their positions. [180:51] So, if you look at this and then we map [180:53] our table, then we have [180:55] this one is in, this one is in, and then [180:59] we have this one is in, and this one is [181:00] in. And you can see the weight of a one [181:02] here is four and the weight of a one [181:04] here is 64. The weight of the left left [181:07] most one here is 128, whereas this one [181:10] is only eight. [181:11] So, that is 12 and then we have 192. [181:14] That is 204. [181:17] So, hopefully that is easy to understand [181:20] and do. Always write down this table if [181:23] you are not sure about the weights. And [181:26] the rule is very very simple. Wherever [181:28] you have zero, ignore the corresponding [181:31] weight. Wherever you have one, [181:33] you need to add the weight or the [181:35] corresponding weight to all the other [181:38] weights that are accounted for and that [181:40] is how you get the decimal equivalent. [181:42] Hopefully that is easy and hopefully you [181:44] are not bored. I promised you that it's [181:46] going to be simple and that's the [181:47] hardest it will get. So, don't worry [181:49] about it. [181:53] All right. So, let's do binary to [181:54] decimal practice. Let's do more examples [181:57] and these are going to be random and I [181:59] will show you the table of the weights, [182:01] so it will be much easier to decide on [182:03] this. [182:04] All right. So, what if I forget the [182:06] numbers? I forgot the bit positions. How [182:08] can I find it? The first one is one. [182:10] Remember that and then any other one is [182:13] two to the power one. [182:15] So, here two to the power [182:17] I'm sorry, N not one. And N is the the [182:20] bit position. [182:21] So, this is the second position. That [182:23] means two times one it's it's two. This [182:25] is the third position. So, you need to [182:27] multiply two twice. So, that is two to [182:30] the power two, which is four. This will [182:33] be two to the power three. Two so, two [182:35] times two times two. That's eight. And [182:37] then four 16 32 64 128. And we will [182:41] always deal with eight bits long [182:45] symbols or strings and that's what [182:47] relates to the IP addresses that you are [182:49] going to discuss. So, for networking, [182:51] for cyber security, for development, for [182:53] cloud, for anything, all you need to [182:55] know in binary is the eight-bit string [182:58] conversion and you will be good to go. [183:01] So, here is a practice. Find the [183:02] equivalent in decimal for the following [183:06] binary. [183:07] So, this is the right most. So, this is [183:09] position one and this is position eight. [183:12] So, the weight here is 128 [183:16] and then 64 32 16 and so on. So, let's [183:19] put it in a table. It will be easier for [183:20] us to remember it. [183:22] So, we need to map [183:24] this binary into [183:27] this weights and positions. So, this one [183:30] is going to map to the right most and [183:32] this one is going to map to the left [183:34] most. So, let's write it [183:35] in a cleaner way. [183:37] So, it is 00110011 [183:41] and then all zeros. We need to look at [183:43] the positions where the binary or the [183:47] bit is equivalent to one and we take the [183:51] corresponding weights, add them [183:54] together, and that will be the result. [183:56] So, here I only have two ones in the [183:58] fourth position and in the eighth [183:59] position. [184:00] So, 8 + 4 is 12. That's the equivalent [184:03] to this number. [184:06] Let's do another one. [184:08] Here is another one. 0110 [184:10] and 1100. [184:13] So, let's map that to our table [184:16] and that will be a one in the third [184:19] position, fourth position, and then [184:22] sixth and seventh positions. So, I have [184:24] one one and one and one. [184:28] So, what are the corresponding weights? [184:30] 4 8 [184:32] 32 and 64. Why I will not take the 128? [184:36] Because the corresponding bit is zero. [184:38] Zero times anything is zero. [184:40] Similarly, zero times anything is zero. [184:42] Zero times anything is zero. Zero times [184:44] anything is zero. That's why I just [184:46] ignored them. [184:47] So, I need to add 64 + 32 + 8 + 4. So, [184:52] these are 96 [184:53] and these are 12. 96 + 12 that will be [184:59] 108. [185:01] Another example. What if I have this [185:03] binary string 10011100? [185:07] Again, [185:09] this table should be implanted somehow [185:11] or it should be stored in your mind [185:14] after you practice a little bit. [185:16] So, here is what we have. We have 1 001 [185:20] and then 1100. So, what are the [185:23] corresponding weights that we need to [185:24] add? 8 and 4 [185:27] and 16 [185:30] and 128. [185:33] So, this is this does not count. This [185:35] does not count. And this does not count [185:37] and this does not count. [185:39] So, 128 + 16 that is 144. [185:43] + 4 that is 148 + 8 that is 156. [185:49] All right? [185:51] You can use the calculator if you would [185:52] like to make it easier for you. [185:54] I like to do the mind math, but it's up [185:56] to you. [185:57] Here is another one. 10100011. [186:01] So, here's our table and here is the [186:03] mapping. So, 1010. [186:06] So, this is [186:07] uh with us and this is with us as well. [186:10] And then 11 at the end and all the [186:12] others are ignored. So, we ignore these [186:15] completely. 128 + 32. So, that is going [186:18] to be 160 [186:19] + 3 that's 163. [186:25] Next one. [186:26] 11001100. [186:28] Although they look the same, but because [186:30] of the bit positions, they will have [186:31] different I like these four are going to [186:34] weigh much heavier than these four [186:36] because of their positions. [186:38] So, if you look at this and then we map [186:40] our table, then we have [186:43] this one is in, this one is in, and then [186:46] we have this one is in, and this one is [186:48] in. And you can see the weight of a one [186:50] here is four and the weight of a one [186:52] here is 64. The weight of the left left [186:54] most one here is 128, whereas this one [186:57] is only eight. [186:59] So, that is 12 and then we have 192. [187:02] That is 204. [187:04] So, hopefully that is easy to understand [187:07] and do. Always write down this table if [187:10] you are not sure about the weights. And [187:13] the rule is very very simple. Wherever [187:15] you have zero, ignore the corresponding [187:18] weight. Wherever you have one, [187:20] you need to add the weight or the [187:22] corresponding weight to all the other [187:25] weights that are accounted for and that [187:27] is how you get the decimal equivalent. [187:29] Hopefully that is easy and hopefully you [187:31] are not bored. I promised you that it's [187:33] going to be simple and that's the [187:35] hardest it will get. So, don't worry [187:36] about it. [187:40] All right. Let's now do the other way [187:41] around. What if I give you a decimal [187:43] number and I asked you what is the [187:45] corresponding binary? So, let's do some [187:47] practice and see if that is difficult or [187:49] easy. [187:51] So, here's a a question. What is the [187:53] binary equivalent and and we need eight [187:56] bits string that will be corresponding [187:59] to 191? [188:02] Now, how would we do this? [188:04] Let's go ahead with the bit positions [188:06] again. [188:07] Now, we'll do the reverse one. [188:09] Which of these weights I should write a [188:12] corresponding one to and which I should [188:15] ignore? [188:16] So, let's find out. [188:19] 191 is larger than 128, right? So, I'm [188:23] going to take the 128 with me. [188:26] Do I take the 64? [188:28] Well, if we put one here, that means it [188:30] will be 64 + 128, that is already 192. [188:35] That means I cannot take the 64 with me, [188:37] so it has to be a zero. [188:40] Do we take the 32? It all depends. If [188:42] you add this weight with the previous [188:45] ones that you accounted for, is it going [188:47] to be larger than 191? Then don't take [188:50] it. If it's going to be less than go [188:52] ahead and take it. [188:53] 128, we are going to ignore this one as [188:56] if it does not exist because we put a [188:58] zero in here. [188:59] 128 + 32, that is 160. Is it less than [189:04] 191? Yes, it is. Then take the 32 with [189:07] you. [189:08] Fine. [189:10] Do we take the 16 or not? All depends. [189:13] If you add 128 and 32 from before [189:16] and 16, is it less than 191? [189:20] And the answer is yes because we said [189:21] 128 + 32 is 160. [189:25] If we add to them 16, that will be 176. [189:28] So nothing stops me from taking this [189:30] one, that's why I'm going to mark it as [189:33] one to take the corresponding weight. [189:36] How about the eight? So we have Here we [189:39] have 176. [189:41] So we are If we compare 176 [189:46] to 191, [189:47] we are 15 short. So we need to represent [189:50] another 15 by ones and we should be good [189:52] to go. So do we take the eight? Of [189:54] course, that is less than 15. I will [189:56] take it. [189:58] So now it is 176 + 8, that is 184. [190:02] Do we take the four? If we take four [190:04] with 184, that will be 188. I will take [190:06] it. [190:08] We are still three short, so I will take [190:10] these two as well. [190:11] The corresponding binary [190:14] for that is going to be Let me just [190:16] erase this. [190:19] So what we decided is going to be 1 0 [190:21] and then all ones, and we are going to [190:23] compare it to what we have. [190:28] So if we write this, you'll find that [190:30] it's exactly what we have reached, which [190:32] is 1011 and then the rest is ones. All [190:35] right, so that's the corresponding [190:37] binary for 191. [190:41] Find the binary equivalent of 238. [190:44] Remember, if you are given [190:46] anything that is less or equal to 255, [190:50] you can represent by eight bits. [190:52] Otherwise, you'll have to go to nine or [190:54] 10 or more bits. And more than eight [190:56] bits is irrelevant to the IP address [190:59] study that we need to make. [191:01] So 238, do we take the 128? Yes. [191:06] Do we take the 164? Yes, because if you [191:08] add these two, it's 192. [191:10] Do we take the 32? Yes, because if you [191:12] add these three, it's going to be 224, [191:16] which is less than 238, so I will take [191:18] it. [191:19] Do we take the 16? No, I'm sorry, we [191:21] cannot because if we add 16 to 224, it [191:23] will become 240 and that is larger than [191:26] 238. [191:27] All right, we still have 224 and we are [191:29] 14 short to get to this number. Do we [191:32] take the eight? I would say yes because [191:34] 224 + 8 is 232 and that is less than [191:37] 238. [191:39] And we are only six short. So do we take [191:41] the four? Yes. 232 + 4 is 236 and we are [191:45] only two left and then I don't take the [191:47] one. [191:49] And if you look at the result, it's [191:51] exactly the same. 11101110. [191:55] So hopefully that was easy. Now I want [191:56] you to write any numbers less or equal [191:59] to 255 and you start the conversion. And [192:02] how would you find if the answer is [192:04] correct or not? You can go in ChatGPT, [192:06] for example. [192:08] Let's check if 238 maps to 1101110. [192:13] All right, so let me go here and open [192:14] ChatGPT. [192:17] And you can stay logged out if you want [192:19] and I'm going to ask, what is the binary [192:22] equivalent [192:25] of 238 [192:27] in decimal. [192:29] As you can see, you are just typing [192:30] exactly what you are looking for. There [192:32] is no science to it. And hit enter. [192:37] And not sure if you can see it clearly [192:39] or not. [192:42] So that gives you the math behind it, [192:44] what's going on, and then it will tell [192:46] you that the equivalent is 11101110, [192:49] exactly like what we did. [192:51] How about 191? What is the binary [192:55] equivalent [192:57] 191. [193:01] See, it gives you the process as well, [193:02] how you can do it. [193:12] Equivalent is going to be 1 0 and then [193:14] all ones, exactly like we did. So you [193:16] can just put any numbers and you can go [193:19] into ChatGPT and find out if what you [193:21] have [193:22] answered is correct or not correct. I'm [193:25] going to embed ChatGPT or AI in general. [193:28] If you want to use Copilot or you need [193:31] to use Gemini, that's up to you, but I'm [193:33] going to embed that into the learning, [193:35] so you would know how you can yourself [193:38] augment your learning using AI and find [193:41] answers quickly without doubting or [193:44] being uncertain about a specific answer. [193:46] All right, hopefully that's helpful and [193:48] we're going to use it a lot more as we [193:50] proceed. [193:55] All right, now looking at IPv4 addresses [193:58] and we are going to find out what why it [194:00] is V4. [194:01] Let's look at the hosts and networks. [194:05] Let's revisit what IP addresses are or [194:07] IPv4 is. [194:09] The IPv4 is the decimal representation [194:12] of IP addresses [194:14] and that's an IP address which is 32 [194:17] bits long, so that means [194:19] the length is 32 bits and they are [194:23] written as four bytes or octets. Every [194:26] eight-bit string is called a byte or an [194:28] octet. [194:30] So it is four numbers, decimal numbers [194:33] or fields separated by dots. [194:36] And here is a valid IP address example. [194:39] What do you mean by valid? Valid means [194:41] four fields and that's one field, two [194:43] field, three field, four fields. [194:45] Any one of them cannot be more than 255. [194:50] Why? Because this is eight bits long. [194:52] There is no way I can represent a number [194:56] in decimal that is more than 255 in [194:58] eight bits. [194:59] And we said the IP address is 32 bits [195:02] long and it's four fields, each one of [195:05] them is eight bits or one octet. [195:07] This is less than 255. This is less than [195:10] 255. This is less than 255. This is less [195:12] than 255. So if it is from zero to 255, [195:16] that's a valid field value. [195:20] On the other hand, if any given IP [195:24] address has more than 255 in one or more [195:28] fields, that's an invalid IP address. It [195:31] cannot exist, cannot be an IPv4 address. [195:34] This is something else. [195:36] So an IPv4 address in any one of the [195:38] fields, the maximum value you would see [195:40] is 255 and the minimum is zero. [195:45] Okay, let's get now [195:47] to find out what are the hosts and [195:49] networks. Given an IP address, how can I [195:51] find out [195:53] what is the network, the main network [195:55] and what is the host on that network? [195:57] For example, you have [195:59] ABC Street, Willow Street, for example. [196:03] So that is the street, that's the [196:05] network, but then you have different [196:07] building numbers, number one, number [196:09] five, number 20, number 255, [196:12] that maps in the analogy to a host on [196:14] the network. So if the street is the [196:16] network, the numbers in the street of [196:18] the buildings are the hosts. So we need [196:20] to identify that. So what is a host? [196:23] It's any device with an IP address on a [196:25] given network. That's what a host is. So [196:28] it can be a router, it can be a switch, [196:29] it can be a printer, it can be a laptop, [196:31] it can be an iPhone, it can be anything. [196:35] So exactly the analogy is street [196:36] addresses. So each one of these houses [196:39] will have a different street number, [196:41] although they are all on the same [196:42] street. So the host will have different [196:44] IP addresses, although they are on the [196:47] same network. [196:49] So the main street is the network and [196:50] the house number is the host. All right. [196:53] So given a host IP address like this, is [196:56] it a valid one? Let's see. 255, no, it's [196:58] less. 255, it's less. 255 is less, is [197:01] less. So that's a valid IP address. [197:05] We must be able to identify the network, [197:07] so we need to know the street from the [197:10] house number. So the network from the [197:11] host part. [197:15] Why do we need this? Because maybe we [197:17] can be told, but when it is in a [197:19] computing device, a server or a virtual [197:21] machine or a switch or a router, they [197:23] should be able themselves to find out [197:25] what is the network and what is the host [197:28] in order to be able to deliver it [197:30] properly. [197:31] Okay, so computing devices must be able [197:33] to identify that too, identify the [197:34] network part from the host part of an IP [197:37] address. [197:38] And this is achieved using what we call [197:40] subnet masks. So we have to discuss what [197:43] subnet masks are. [197:50] So let's look at what a subnet mask is. [197:54] And now we are focusing on IPv4. So IPv4 [197:57] is the one that is eight bits {dot} [197:59] eight bits {dot} eight bits {dot} eight [198:02] bits. [198:03] IPv6 is 16 bits {colon} 16 bits {colon} [198:10] 16 bits and it has eight fields. So each [198:13] one is double the size of the field and [198:16] they are separated by colons, not dots, [198:18] and they are eight fields and that is [198:20] what makes 16 * 8, which is 128 bits. [198:25] But, we are not going to discuss that [198:26] here. So, we are going to focus for the [198:29] rest of this course on IPv4. At some [198:31] point in your career, you will want you [198:34] would want to know about IPv6. And if [198:38] you specialize in the network field, [198:40] although I discourage that, you will [198:42] need to know it sooner than the other [198:44] fields. But, for now, let's skip the [198:47] IPv6 and the complexity. Let's focus on [198:50] the easier one, IPv4, and that is what [198:52] you will start learning, and that would [198:54] be more than enough for you to learn [198:56] almost all the technologies and in cloud [198:59] and in devops and automation and the [199:00] other fields as well. So, what's a [199:02] subnet mask? That's what we need to know [199:04] now. [199:05] The subnet mask tells the computer which [199:08] part of the IP address is the network [199:10] and which part is the host or the [199:11] device. All right, so the subnet mask is [199:14] nothing more than a means or a tool [199:17] through which computing devices can find [199:19] out what is the network part and what's [199:21] the host part of an IP address. It can [199:23] separate the two or it using subnet [199:26] mask, we can separate the two. [199:28] Subnet mask can be represented in [199:30] decimal or inside notation. Let's start [199:32] with the decimal one first. [199:36] If I have an IP address like this, [199:38] 192.168.1.10. [199:40] Is this a valid IP address? Yes, it is. [199:43] Why? Because all the four fields are [199:45] separated by dots, [199:47] and none of them is more than 255. So, [199:50] that's a valid IP address. [199:53] We are given the subnet mask in decimal [199:56] is 255.255.255.0. [200:00] The science behind the subnet mask is [200:04] whichever bits are in the network part, [200:07] please put a corresponding one bit in [200:10] the subnet mask. [200:12] And where it is the host part, then put [200:15] a zero in that part. [200:17] I didn't understand anything. Okay, to [200:19] understand, let me show you this. [200:24] The subnet mask, if we write this in [200:26] binary, [200:27] 255 means what? Means an eight-bit [200:29] string that is all ones. {dot} 255. So, [200:32] that's another eight-bit string that is [200:34] all ones. [200:35] And then I have a third one that is all [200:38] ones in an eight-bit string. [200:41] {dot} zero, that is all zeros in an [200:44] eight-bit string. [200:45] All right, so what do I understand from [200:47] that? [200:48] The what the computing device will [200:50] understand is the complete first 24 [200:54] bits, the first eight and the second [200:56] eight and the third eight, they are all [200:59] the network part. [201:01] So, this is completely the eight-bits [201:05] field and the eight-bits field and the [201:07] eight-bits field, this is completely [201:09] the network part. And what is left [201:12] is [201:13] 32 bits for the entire number length [201:20] minus 24, which is the first three. [201:22] These are 24, eight [201:24] and eight [201:26] and eight. [201:27] These are all network part. And wherever [201:29] there are zeros, that will be the host [201:31] part. [201:33] So, that means we have occupied 24 bits [201:36] for the network and only eight bits for [201:39] the hosts. [201:41] All right, that's fine. [201:44] So, the subnet mask binary equivalent [201:47] has ones in the network part and then [201:49] zeros in the host part. And that is how [201:52] computing devices can distinguish where [201:54] is the network part and where is the [201:56] host part. [201:57] So, now by looking into this, then [201:59] anything that falls within the first 24 [202:02] bits is the network itself. [202:04] And that's why the network here is [202:06] 192.168.1, [202:08] and then you can put zeros for [202:10] everything else, that becomes the [202:11] network itself, the street name itself. [202:15] And how about the host? That is the [202:17] {dot} 10 left. Anything that will be in [202:19] this eight bits will be the host, and [202:22] that is the {dot} 10. [202:24] Anything on the left side is network. [202:27] Now, one might ask, can I have a subnet [202:29] mask that will have zeros in between the [202:31] ones? And the the answer is absolutely [202:33] not. [202:34] It's always network part and then host [202:37] part. It cannot be network part and a [202:39] little bit of host in between and then a [202:41] little bit of network and a little bit. [202:42] So, it's contiguous network part and [202:44] then contiguous host part. It cannot be [202:47] broken or interweaved. [202:50] All right, so how did the subnet mask [202:52] help me? It helped me by telling me [202:55] which parts of this number [202:58] are [202:59] for the network and which parts are for [203:02] the host. [203:04] What if I wanted to do the same thing [203:06] but inside? Remember what we learned [203:08] from this subnet mask is that there are [203:11] 24 bits for the network. The remaining [203:14] eight, because the total is 32, there [203:16] can't be more than eight left. [203:19] So, the remaining is for the hosts. That [203:21] means I can put different combinations [203:24] here, and these there will be the street [203:25] numbers or the hosts on the network. And [203:28] as long as this part did not change, the [203:30] 192.168.1, it's the same network, and [203:33] anything on the right of that is going [203:35] to be a host on the network. So, {dot} [203:37] one, {dot} 50, {dot} 100, {dot} 200, [203:39] {dot} 254, {dot} 238, they are all hosts [203:43] on the same network as long as the [203:45] network part is common. [203:47] So, now if the computing device is given [203:50] that 192.168 [203:54] {dot} one {dot} 10 would like to speak [203:57] to communicate with 192.168.1.20, [204:01] and both have the same subnet mask, that [204:03] means [204:05] these are two devices probably on the [204:07] same network, on the same switch, and [204:09] they would like to communicate with one [204:10] another. So, even if I had a router [204:13] connected to this switch, the router [204:14] will not intervene because it's the same [204:16] network. That's not my business. [204:18] So, let's look at the cider notation. [204:20] Since the subnet mask gave us the number [204:23] of bits for the network, [204:25] then why don't we write it in an easier [204:27] format? [204:28] So, it's a shorter way to write the [204:29] subnet mask. Instead of writing [204:31] 255.255.255.0, [204:34] why don't I just write it like this? [204:36] 192.168.1.10, [204:39] and then we put a forward slash, and how [204:41] many bits are there for the network? [204:44] So, obviously, the remaining of the 32 [204:47] will be for the hosts. [204:50] So, the number after the slash tells how [204:52] many bits are used for the network [204:54] portion of the IP address. And the only [204:56] reason for the subnet mask was to tell [204:59] the device or to tell me or to tell you [205:02] which portion of the IP address is the [205:04] network and which portion is for the [205:06] host. So, 32 is the total number of bits [205:09] in the IP address minus 24 in our case, [205:12] which is the network part, that leaves [205:14] us with eight bits for the host. Exactly [205:17] the same that we have learned in the [205:18] previous slide. This way or that way are [205:21] the same. AWS chose to use the subnet [205:24] mask this way with the cider notation, [205:27] not with the decimal notation. It's much [205:29] easier to understand. So, now if I give [205:31] you an IP address and tell you it's [205:32] {slash} 16, what does that mean? That [205:35] means the first two fields are for the [205:38] network, [205:39] and the next two fields are going to be [205:42] for hosts. So, I can allocate different [205:44] hosts on the same network by changing [205:47] the zeros and ones on the 16 bits on the [205:50] right side. If I tell you it's a {slash} [205:52] eight, what does that mean? That means [205:54] the first field only is for the network, [205:56] and then everything else is going to be [205:59] for the host. So, I can put different [206:01] bits and bytes, different combinations [206:03] here, and these will be different hosts [206:05] on the same network. So, hopefully you [206:07] understand it now, and it's easier. [206:11] So, the meaning is the same. The first [206:13] 24 bits are for the network, and then [206:15] the rest will be for the hosts. [206:19] And the result is the same. The network [206:21] part is 192.168.1.0, [206:24] whereas the host is the {dot} 10. [206:29] And here is a table that it can be handy [206:32] if you want to use it, or I can just, [206:34] you know what, go to my friend [206:36] to the chat GPT, and and I'm going to [206:38] say, "Okay, fine. What is the binary [206:41] equivalent if I'm confused of [206:45] 255.255.0.0, [206:47] for example?" [206:50] So, now it will give me the binary [206:52] equivalent for that. [206:54] This is how it will look like. [206:56] 255.255.0.0. [207:00] Which means this is the network part [207:03] in any IP address that uses this subnet [207:05] mask, and this will be the host part. [207:08] What is [207:09] the binary equivalent [207:14] of 255.255.255.0? [207:17] That's a {slash} 24. [207:22] And it will give me the same. So, the [207:24] the first three octets are going to be [207:26] like this. And now, [207:28] what is the binary [207:31] equivalent [207:34] of [207:34] the cider [207:36] {slash} 24? [207:42] See, the first 24 bits are for the IP of [207:46] the IP address [207:48] the for the network, and then eight bits [207:50] for the hosts. And if you compare this, [207:53] all ones and then zeros, that's exactly [207:55] the same 255.255.255.0, [207:58] which is exactly the same when I asked [208:01] it, "What's the equivalent of this?" So, [208:03] whether you write it this way or write [208:05] it as {slash} 24, it's exactly the same. [208:08] All right, so this is handy if you would [208:09] like to use it, or if you can do it on [208:11] chat GPT, that's also perfectly fine. [208:13] And this starts from {slash} eight all [208:16] the way to {slash} 32. [208:18] And it gives you all the numbers. So, [208:20] for example, a /9, what would it be? [208:22] That will be [208:23] all eight that are going to be ones, and [208:26] then only one more is going to be one, [208:29] and the rest will be for the host. [208:31] So, if you want to write that in [208:32] decimal, it's going to be 255, and if we [208:35] have one and all zeros, that is 128. [208:39] If we have [208:41] /10, so that will be one more bit taken [208:44] into the network, and the equivalent of [208:47] the second octet now is 11000000, [208:52] which is 192. [208:54] If you take three bits, that will be [208:55] what? 224, and then 240, and so on, [208:58] until you reach this one where you take [209:01] the first two octets completely. So, if [209:04] you are at the boundaries, if you take [209:05] eight into the network only, or 16, or [209:09] 24, that's easy, because that will be [209:12] 255 [209:13] .0.0.0 for /8, like here. [209:17] Or it will be 255.255.0.0 [209:20] if you do /16, or it's going to be [209:22] 255.255.255.0 [209:25] if you go for a /24. Hopefully, that's [209:28] easy, and I'm sure with practice, and if [209:30] you use your best friend ChatGPT or [209:33] Copilot or Gemini, it's very easy to [209:36] train on this and to get it. And if you [209:38] have any questions, definitely let me [209:39] know. [209:45] All right, so let's do some subnet mask [209:48] practicing so we get [209:49] whatever we have understood and grasped [209:52] clear or clearer, and if there is [209:54] anything missing or ambiguous, then [209:56] hopefully that will make it more [209:59] comprehendible. [210:03] So, example number one. [210:05] Given the below IP and CIDR. [210:08] So, here is an IP address, [210:10] and that's forward /24. So, that's a [210:13] CIDR notation, and that's the [210:15] representation of how long the network [210:17] part is. So, this is your subnet mask in [210:20] CIDR notation. [210:22] And if it is 24, we mentioned that each [210:25] one of these fields is eight bits long. [210:28] So, that means I have eight bits, and [210:31] then {dot} eight bits long, and then [210:32] {dot} {dot} eight bits long field, and [210:34] then {dot} eight bits long field. [210:38] So, /24 means the first three octets or [210:40] the first three bytes are for the [210:43] network, and the remaining one is for [210:45] the host. [210:46] One might ask me now, um this is {dot}1, [210:50] how come this is eight bits? [210:52] Remember that you can write the one as [210:55] 0000, [210:57] and then 0001. [211:00] So, the one is represented in binary in [211:03] eight bits long strings like this. [211:06] Similarly for the two, but it's going to [211:08] be 0000, [211:11] then 0010. [211:15] All right. So, this is what we have. [211:17] What is the required now? We need to [211:19] find the network ID, what's the network, [211:22] what's the host, and what's the subnet [211:24] mask in decimal. [211:26] That's what we need to find out right [211:28] now. [211:28] All right. [211:30] So, let's find out. [211:31] So, let's write the binary equivalent of [211:34] this IP address, [211:36] and that would be 192. 192 is very easy. [211:38] That is 128 + 64, and then everything is [211:42] zero. So, 128 + 64, and then six zeros. [211:47] Remember, this is eight bits long. It [211:49] has to be eight bits long. [211:52] 168, that is 128 + 32, that is 160, and [211:59] then we have eight with us. [212:01] So, we will take the 128, we will ignore [212:03] the 64, so that will be one, and then [212:06] zero. We will take the 32, because these [212:09] two together make 160, [212:12] and then we'll ignore the 16, and we'll [212:14] take the eight with us. So, that will be [212:16] 168, and everything else is zeros. [212:21] And then {dot}1, 0000, and then 0001. [212:25] {dot}2, that is all zeros, and then [212:29] 0010. We put the color of the network [212:33] bits in purple, and the rest is in blue [212:37] to signify that we have 24 bits for the [212:40] network, and then only eight for the [212:43] host. Okay. What do we need? We need to [212:46] find out the network ID. Very simple. [212:49] Zero everything in the host part, [212:55] and that becomes the network ID. So, [212:57] take this as is, [212:59] copy it, and then {dot} 0000 0000. So, [213:03] that is 192.168.1.0. [213:07] That becomes your network ID. [213:10] Okay, so the host part is eight, and /24 [213:13] is the [213:14] network part. [213:16] Here is the network ID, 192.168.1.0, [213:19] by placing zeros in the host part, and [213:22] {dot}2 is the host, and then the decimal [213:26] CIDR block is [213:28] 24 all ones, so that is 255.255.255.0. [213:34] All right. And of course, I can go to my [213:36] friend, which is ChatGPT, and I can ask [213:39] ChatGPT, what is the network ID, what's [213:42] the host, and what's the subnet mask in [213:43] decimal for this range? Let's go ahead [213:45] and try it. [213:47] So, what is the network ID, [213:50] host, and the subnet mask [213:55] in decimal [213:57] for 192.168. [214:00] 1.2/24. [214:10] So, here is the subnet mask, as you can [214:12] see, 255.255.255.0, [214:15] and it explains that /24 means the first [214:17] 22 bits are for the subnet or the [214:19] network. [214:20] So, the network ID becomes the [214:22] 192.168.1.0, [214:27] and then the host portion is going to be [214:29] the {dot}2, [214:31] or here they write it as 0002, but [214:34] preferably write it as {dot}2. [214:37] Oh, uh here you go. The host is two, and [214:39] here is the subnet mask, 255. 255.255.0, [214:43] and this is the network ID. So, very [214:45] easy to come up with any IP address, do [214:49] it your own hands, write it down, and [214:51] find out what is the network ID as you [214:54] think, what's the host, what's the [214:55] subnet mask in decimal, and come here to [214:57] verify it or validate it. [215:03] Okay, let's look at another example, and [215:05] we are still going to look to do the [215:06] same. Find the network ID, the host, and [215:08] the subnet mask in decimal. We're going [215:10] to repeat exactly the same. [215:12] This is exactly the same like before, [215:14] but here it's {dot}12, and it's /26. [215:18] So, if you look at the binary [215:19] equivalent, that's the binary [215:21] equivalent, [215:22] and then if you notice that we took two [215:25] more bits from here, [215:27] and these are in purple as well, because [215:30] of the 26. So, that's eight [215:33] + 8 + 8 + 2, that makes 26. And the blue [215:38] ones are the host, and 8 + 4 is 12. [215:43] So, where is the network part? All of [215:44] this. Where is the host part? The [215:46] remainder. [215:48] And the network ID, you can calculate it [215:50] by putting the host part as all zeros. [215:56] So, as if these two ones don't exist, so [215:59] this will become a full zero, [216:02] and this will not change, 192.168.1. [216:05] 192.168.1.0, [216:07] and the host part is going to be [216:11] the 12, the blue one, the value, [216:13] {dot}12. [216:16] And the subnet mask, if you want to [216:17] write the subnet mask for a /26, [216:20] you guys are the best now. So, it is [216:23] eight ones, [216:25] {dot} eight ones, [216:27] and then another eight ones. This is [216:30] six, so seven, eight. [216:32] And then another eight ones. [216:34] So, that is [216:36] 255.255.255, [216:38] and then for the first two bits, I have [216:40] to put ones, and then zero everything [216:43] else. So, everything else is zero. So, [216:45] that's 255. [216:47] {dot}255.255. [216:51] This is a bit or an octet that has only [216:54] two ones at the left, and then [216:56] everything else is zero. So, the first [216:57] one is 128 and 64. If you add them, [217:01] that's 192. That's how we we got to the [217:04] decimal representation of the subnet [217:06] mask. [217:08] Here is another example, exactly the [217:09] same, but {dot}80 and /26. [217:13] If you look at it, same thing. The [217:15] subnet mask is going to be exactly the [217:16] same, because it's /26. So, [217:18] 255.255.255.192. [217:22] If you look at the host, the host here [217:24] is {dot}80. 80 means 64 + 16. [217:30] So, this is the host part, and this is [217:32] the network part. Okay, so what's the [217:34] host part in the subnet mask? The / [217:37] 26 or 26 bits, and this is the host [217:40] part. [217:41] Put zeros for the host part, and then [217:44] you will be able to get the [217:46] subnet or the network ID. [217:50] So, here, if you put all zeros, and you [217:52] leave this as is, that becomes 128 is [217:55] not with us, and then one and all zeros [217:57] afterwards, so that becomes 64. And [218:00] that's why the network ID is 64, the [218:01] host is {dot}80, and the subnet mask is [218:04] the same like before. [218:06] The same thing, but {dot}138/26. [218:10] One might be bored by now, and I say [218:13] okay, why is the same network? There is [218:14] no change. We are not tricking us. You [218:17] should give us other networks. There is [218:19] a reason why I am using this network [218:21] now, but we'll do more practice with [218:22] different networks later on. [218:25] So the equivalent [218:26] 138 that is 128 + 10. So 128 + 8 + 2 [218:31] that is 138. And this are the host part [218:36] and this is the network part. So what's [218:38] the network ID? Put zeros in the host [218:41] part and you will end up with the [218:43] network ID. So that's 192.168.1 [218:47] and that will be 128. [218:51] Okay, because we have all zeros. Forget [218:53] as if this does not exist and this does [218:55] not exist, that becomes the network ID. [218:57] And the 138 is the host and the subnet [219:00] mask is the same like before. Last but [219:02] not least, let's look at another one, [219:05] but the range here is 217 same subnet [219:07] mask. [219:10] So 217 that is 128 + 64 that is 192 [219:16] + 16 that is 208 [219:19] + 8 so that's 216 [219:22] + 1 that's 217. [219:26] Network part, host part. So put all [219:29] zeros in here. [219:31] You end up with the network ID. So [219:34] 192.168.1.192. [219:40] And the host part is .17 and the subnet [219:43] mask is the same. Now why did I use the [219:45] same network all the time? Now let's put [219:47] them all side by side with the very [219:49] original one that we have done. [219:51] So the very original one we have done is [219:53] 192.168.1.2 [219:56] /24 and the network ID was .0. [220:00] Then we looked at .12 [220:03] and that was the network ID. [220:07] Again, same network ID but [220:11] the subnet mask is different so they are [220:13] not the same. This is actually part of [220:16] this. [220:18] This covers the IP addresses until we [220:21] get to the next subnet which is 64. So [220:24] this covers from 0 to 63 [220:27] and this one starts at 64. We're going [220:29] to explain that further later on. And [220:31] this one ends before the 128 so at 127. [220:36] This one starts at 128 and ends at 191 [220:40] and this one starts at 192 and ends at [220:42] 255. [220:44] So as if what I'm trying to say here is [220:46] if we look at this IP address and the [220:49] network ID [220:50] we find 192.168.1 [220:54] and this is the .2. [220:57] And this is the subnet mask. [220:59] If we look at the next ones, we'll find [221:01] that this was all the hosts, but now the [221:04] host part has shrunk into six bits only. [221:09] The network part has been expanded by [221:11] two bits. [221:16] And the subnet mask has also been [221:17] extended by two bits. [221:19] If you combine these four into one [221:22] network, believe it or not, you will end [221:25] up with this one. [221:26] But this is just to let you know that as [221:30] if we have divided this into four and we [221:33] had to borrow two more bits from the [221:36] host and make it a network in order to [221:39] have one network divided into four. This [221:41] is called subnetting, but don't worry [221:43] about it. Just keep it in your mind [221:45] because we are going to use it later on. [221:52] All right, let's now find out what IP [221:55] address classes are. Actually the IP [221:57] addresses, whoever invented that, they [222:00] divided them into classes. And they have [222:03] class A, the class B and class C. We [222:05] have also class D and E, but we are not [222:06] going to discuss that because it's [222:08] beyond the fundamentals of networking. [222:11] It has to do with multicast and other [222:12] stuff. [222:13] So IP address classes are created to [222:15] help effectively assign IP addresses to [222:17] big, medium and small networks without [222:20] wasting too many addresses. So when they [222:22] thought about them, they thought about [222:24] the best and efficient use of these [222:26] networks. [222:27] And they started with A, B and C. So A, [222:30] this is for big corporates. Okay, the [222:33] CIDR block or the subnet mask, the [222:34] default is /8. [222:36] And it starts from 1.0.0.0 [222:39] all the way and inclusive of everything [222:42] in between to 126.255.255.255. [222:47] This has 126 usable networks [222:52] and 16 million hosts in each. So that's [222:56] extremely large corporates. [222:58] An example, 11.0.0.0/8. [223:03] So notice that the leftmost byte [223:07] starts at one and ends at 126. [223:10] What about 127? This is reserved for [223:12] local hosts and other stuff on the [223:14] servers. We are going to learn about [223:16] them as we learn more IT. [223:19] What about class B? Class B is the [223:21] default subnet mask in CIDR block is 16. [223:24] So the first two octets are for the [223:26] network, the second two are for the [223:29] hosts. [223:30] And it starts at 128 on the leftmost [223:33] decimal value of the octet to 191. [223:37] And that has 16,384 [223:41] 384 possible networks. In each one of [223:44] them we have more than 65,000 hosts to [223:47] be allocated. An example, 148.12.0.0/16. [223:54] Class C is for small networks. [223:59] So B is for medium networks, this is for [224:01] large networks. [224:03] C is for small networks. The default [224:05] subnet mask is /24. It starts from 192 [224:08] and ends at 223. [224:11] The leftmost byte. [224:13] It has 2 million plus networks, [224:15] but each one of them has only 256 [224:20] IP addresses, but usable are 254. We are [224:22] going to discuss that later on. So [224:24] consider that as 256 for now or 254, [224:27] that's fine. An example is [224:28] 196.12.108.0/24. [224:32] So IP address classes, by the look of [224:35] the leftmost byte, you can tell whether [224:38] that's a class A or a class B or a class [224:40] C. [224:41] So if it is from 1 to 126, that's a [224:43] class A definitely. [224:45] 128 to 191, that's a B and 192 to 223, [224:49] that is a C for sure. [224:53] So each class has a default subnet mask [224:56] as we mentioned, /8, /16 and then /24. [225:00] And there are other specialized classes, [225:01] but out of scope. [225:07] All right, so let's now figure out how [225:08] we can [225:11] break an IP address block, an IP address [225:13] range into multiple subnets we call it [225:17] or multiple segments, multiple chunks. [225:19] Why do we do this? We do it because if I [225:22] have, let's say I have a campus building [225:24] and I have a one big chunk of IP [225:27] addresses, one block. [225:28] And now I need to build separate LANs in [225:32] each one of the buildings and then I [225:33] will connect them to the data center for [225:35] example. [225:37] So how can I do this? I have only one [225:39] range and I cannot It's not recommended [225:41] to use the same range across a lot of [225:43] buildings because it has a lot of [225:44] technical implications way over our [225:47] heads now and we shouldn't get into the [225:49] details why we should avoid that, but [225:50] it's recommended that you segment or [225:53] distribute that into multiple subnets [225:56] and then use one in each building. I'll [225:58] give you another example. Let's say it's [226:01] a corporate and it has [226:03] one office in each one of the 50 states [226:06] in the United States. [226:08] And the headquarters is, let's say in [226:10] India for example. [226:12] And now they need to connect this. So [226:13] they have to go across one. We said if [226:15] the it's not in a close vicinity, it has [226:17] to be a wide area network. [226:19] And we talked about that before. [226:21] So in that case [226:23] if you want to break it down, the one [226:25] big range, you will have you must break [226:28] it down because otherwise you cannot use [226:30] the one [226:32] the the right way without breaking that [226:35] down and isolating a block of IP [226:37] addresses for each one of these offices. [226:39] They cannot be in one office. They can't [226:41] live in one office. Period. [226:43] So they have to be [226:45] different or separate IP address ranges, [226:49] smaller ones, chunks from the big block [226:52] that you have. And that is called [226:54] subnetting. So that is why we are going [226:56] to discuss subnetting, but we will start [226:58] doing it the easy way without a lot of [227:01] math and without confusing you with a [227:03] lot of binaries and all that stuff. If [227:05] you have understood everything before [227:07] this and you are good with that, then [227:09] you can use the easy way and you are [227:11] good to go. [227:12] If you want to know more details or if [227:14] you are planning to be in the [227:16] engineering side where you are going [227:19] to do a lot of troubleshooting and you [227:21] want to minimize your dependence on [227:24] calculators and online tools, then you [227:27] can learn the details which will follow [227:29] this one. But now it's the easy way. [227:32] So this is for the people who want the [227:34] easy stuff, the easy way, the faster way [227:36] to do things, but hopefully also they [227:38] understand what they will see and what [227:41] they will get. This is very important to [227:43] know. All right, so let's see what [227:45] subnetting is. [227:47] Subnetting allows us to take one IP [227:49] address block and then divide it into [227:52] smaller blocks to be used on different [227:54] networks. [227:56] Think of subnetting an IP address range [227:57] as slicing a pizza. Exactly when you [228:00] have a pizza and you will have let's say [228:02] it's a small pizza and you would like to [228:04] cut it into four slices. So that's [228:06] exactly the subnetting. So, this will be [228:08] the block IP address range, the actual [228:10] pizza, and then the slices, each one of [228:13] them is being is going to be called a [228:15] subnet. [228:16] When we do subnetting, [228:18] we don't have the liberty to decide how [228:20] to cut it as we do with the pizza. For [228:22] example, with the pizza, you may decide [228:24] to cut it into six pieces or three [228:27] pieces or 12 pieces. In subnetting, you [228:31] can't do that. You either divide it into [228:33] two, [228:35] or four, [228:37] or eight, [228:38] or 16, [228:40] or 32, or 64. Does this [228:44] seem familiar to you? [228:46] Yes, these are the weights of the [228:49] binaries. So, it's either two or four or [228:52] eight or 16 or 32 or 64. What if I need [228:54] five only? Then you have to go for [228:56] eight, and then you keep three as spare. [228:59] What if I need 12? Then you have to go [229:01] for 16, and you keep four as spare. [229:05] But if you want 20, then you go for 32. [229:09] So, you divide it by 32, and then you'll [229:12] use 20, and then 12 are going to be [229:14] spare. [229:15] So, this is very important to remember. [229:16] You cannot divide an IP address block by [229:19] three or by five or by seven or by 11 or [229:23] by nine. [229:24] Given an IP address range to subnet, we [229:27] need to know What do we need to know? We [229:28] need to know how many subnets are [229:30] needed, and how many hosts are needed [229:33] per subnet. [229:35] So, if you are given an IP address [229:37] block, and you are giving the scenario [229:39] of the 50 offices in the 50 states in [229:42] the USA, [229:44] and you are told that we need to break [229:46] it down, that big block, into enough [229:49] subnets that we can use in each one of [229:51] these offices. [229:53] The very first question that you would [229:56] want to ask is how many hosts do you [229:58] need per subnet? [230:00] So, in each office, how many machines [230:02] are going to connect to the network? [230:04] If they are 50, then go for 64. So, [230:07] maybe go for 128. So, you need to go for [230:10] a higher number [230:12] of IP addresses, not exactly 64 if they [230:15] are 64, because what if a new employee [230:18] is added tomorrow? [230:19] So, you always need to design for a [230:22] little bit bigger than the requirements. [230:24] Or maybe you can ask, "Okay, how many [230:26] users are going to connect How many [230:27] devices are going to connect? How many [230:28] hosts?" [230:30] If you are told 64, then you can have a [230:33] subsequent question is, "What is your [230:35] anticipated growth rate per year or [230:38] every couple of years?" Is it going to [230:40] be 10%? 20%? 30%? And that will help you [230:44] decide what size you are going to make [230:46] the subnet. [230:48] So, this is very important. The second [230:50] question is, "How many subnets?" So, we [230:51] have 50 offices in the United States, in [230:54] each one of the states. Is there a [230:56] chance you are going to open satellite [230:58] offices from these offices? [231:00] If the answer is yes, how many do you [231:02] anticipate per year? Per two? Per five? [231:05] Per 10 years? [231:06] If they know the answer, then you need [231:08] also to design not 50 subnets. Now, I [231:10] will go for 128 subnets or maybe 256 [231:14] subnets. So, I'll have a room to scale, [231:17] to grow. I don't need to design it and [231:19] then start using it, and 1 year down the [231:22] road, I would say, "Oops, okay, I didn't [231:24] account for that." So, now we have to [231:27] redo everything and re-address [231:29] everything, which will be a nightmare. [231:31] Okay? So, this is very important. The [231:32] two questions, how many subnets and how [231:34] many users per subnet. And the third [231:36] question that will be, and will show [231:38] that you understand what you are doing, [231:39] is what is the growth rate for hosts and [231:43] for subnets as well. [231:45] So, let's look at how we can have an IP [231:47] address range and break it down, and [231:49] we'll do it the easy way. [231:51] The easy way we mean, we are going to do [231:54] it using online calculators. [231:57] So, what we need to identify using the [231:59] online calculators, the network ID [232:02] of the IP address range that we have, [232:04] the usable IP addresses in the range, [232:07] and also the broadcast address of the [232:09] subnet. [232:11] The broadcast address, by the way, is [232:13] the last IP address in any subnet. So, [232:16] when you put in the host bits all ones, [232:19] that is your broadcast address in the [232:20] subnet. [232:23] So, we have a range, 192.168.1.0/24 [232:27] inside the format, and this means we [232:29] have 24 bits for the network. [232:33] I'm sorry, 24 bits, so all three bytes. [232:36] So, this one included, this one [232:37] included, this one included. And this is [232:39] going to be for the host. So, this is [232:42] the network, and this is the host. Okay, [232:45] we need to divide the range into four [232:47] equal-sized subnets. So, we're going to [232:50] do a subnetting exercise using online [232:51] calculators. [232:53] And for each subnet, we need [232:56] the subnet mask, [232:58] the network ID, the broadcast IP [233:00] address, and the number of usable IP [233:03] addresses, [233:04] and the first and last usable IP [233:07] addresses. So, that's what we need to [233:08] know, and online calculators, we have [233:11] two famous ones and easy ones that I [233:13] would recommend. This one is very easy, [233:15] and there is another one from SolarWinds [233:17] Subnet Calculator. I'm going to use this [233:19] one, so when you practice, please use [233:21] that one as well, so we are going to be [233:23] in line. [233:24] If you want to use the other one, if you [233:27] want to try the other one, please feel [233:28] free to do so. One online tool is more [233:31] than enough for you to do that, and [233:32] Calculate Quick is the recommended one [233:35] or the highest recommended one on the [233:36] internet. And if you want other [233:38] calculators, you can go to your friend [233:40] ChatGPT and ask, "What are the popular [233:44] IP subnet calculators or IP [233:46] calculators?" It will give you a list of [233:49] available ones. All right. So, what do [233:51] we need to do now? I need to take this [233:52] one, 192.168.1.0/24, [233:55] and I'm going to click on this link, and [233:59] we need to divide it into four [234:00] equal-sized subnets. [234:02] And we're going to find this information [234:04] for each one. [234:05] Before we go and do anything, [234:07] equal-sized subnets. One small pizza, [234:09] you need to cut it into four equal [234:11] slices, 100% equal. [234:13] If you think about it, how many IP [234:15] addresses we have here? [234:18] How many hosts in this network? So, [234:21] network ID can tell you the the major [234:23] one the main one. Network ID is 192. [234:27] 168. [234:30] 1.0. [234:32] That's the network ID. [234:34] How many bits do I have for the host [234:37] here? We have 24 for the network, that [234:39] means we have eight left for the hosts. [234:42] So, if you if that's the case, we can [234:44] have up to two to the power eight [234:48] different combinations in the eight [234:49] bits. So, that's 256 [234:53] host IP addresses that are available. [234:56] A rule, [234:58] the first one and the last one, you [235:00] can't use them. They are not usable. So, [235:02] the 192. [235:05] 168. [235:07] 1.0, [235:09] that's the network ID, so we cannot use [235:12] it on a host. [235:13] And the last one is going to be 192. [235:16] 168. [235:18] 1. [235:20] Can you guess what would be the last [235:21] number? [235:23] Put all ones in the host field. So, that [235:26] will be eight ones, which is 255. That's [235:29] the maximum you can get from eight bits. [235:32] So, this is the broadcast IP. This is [235:35] for the original subnet. [235:38] So, what's the number of usable IP [235:40] addresses? It will be the total number [235:42] minus the network ID minus the [235:45] broadcast. So, minus two, that will give [235:47] me 254 [235:50] actual usable IP that I can allocate on [235:53] hosts on this network. [235:55] What if this network grows more than [235:57] 254? Unfortunately, you cannot use the [236:01] same subnet. [236:02] So, what do we do? We have other hosts [236:04] that need to sit on the same subnet. You [236:06] will have to re-address your subnet and [236:08] provide for a bigger one. That's That's [236:10] what you have to do. That's why it is [236:11] very important to ask the question, the [236:13] size of the subnet, how many hosts, and [236:15] the growth. [236:16] All right, let's go ahead to the online [236:18] calculator. I'm going to take this [236:20] range, and I need to divide it into four [236:23] equal pieces four equal pizza slices. [236:25] [clears throat] [236:26] So, let me go ahead and click on this [236:27] link. [236:29] And this is how it looks like, [236:31] IP Subnet Calculator. Here, I'm going to [236:34] write the range that we have, 168. [236:38] 1.0, [236:40] and it is /24. [236:43] And I would say, "Calculate." [236:46] If you scroll down, [236:47] you'll find here Let me just [236:49] make it a little bit bigger. [236:51] So, this is a class C, [236:54] and the IP address, [236:57] the network ID, [236:58] and you can always copy the information. [237:00] The broadcast address, as we calculated [237:02] it, 192.168.1. [237:05] 255. [237:06] The first usable IP, it will be the one [237:08] after the network ID, which is .1. [237:11] The last usable IP is the one right [237:14] before the broadcast address, so that is [237:16] 254. [237:18] Here is the CIDR notation, and the total [237:20] hosts is 256, but the usable ones are [237:23] 254. [237:24] And the mask bits are 24, and the subnet [237:28] mask and all the details that you need [237:30] to know about this. [237:31] And here, they give you the binary [237:33] representation for the IP address, [237:35] for the subnet mask, [237:37] and the network ID, and the broadcast [237:40] address. Everything is included. So, if [237:41] you look at the network ID [237:44] and the broadcast address, the only [237:46] difference is here, it will be zeros in [237:49] the host field, and here, it will be all [237:51] ones in the host field. [237:53] So, they are exactly the same, but the [237:55] network ID, all zeros, uh the broadcast [237:57] IP is all ones. [237:59] Okay, that's all cool. I need to subnet [238:02] it. So, we have a tool called subnet [238:04] division tool. [238:07] Here it will ask you, "How many subnets [238:09] do you need?" So, I need four subnets. [238:13] You can here add and [238:15] So, it allows you to add any number, but [238:18] at the end if you go for five, if I go [238:20] for three for example, [238:24] calculate subnets, it will do four of [238:25] them. It will do four of them. Yeah, but [238:28] I asked only for three because you can't [238:30] divide a block by three. You can divide [238:32] it by two or four or eight or 16. So, [238:35] let's say if I tried to do five. Let's [238:39] see. Calculate subnets. You will find [238:40] that it has divided that by eight [238:42] because four is not enough. It goes to [238:44] the next one. It's up to you to use five [238:46] of them and then three will be spare. [238:49] So, let's go back to our example. Four. [238:52] Let's look at what is done here. [238:54] So, here you have [238:57] the first subnet. It was It's going to [238:58] be 192.168.1.0 [239:00] and /26. [239:02] Please note that the subnet mask when [239:05] you divide [239:07] a block [239:09] by a number, so two or four or eight and [239:11] so on, if you divide by two, you'll find [239:13] that the subnet mask will be extended by [239:16] one bit. [239:17] If you divide by two to get four [239:19] subnets, then it will be extended by two [239:21] bits and that's what we have here. So, [239:23] this is a /26 although the original one [239:26] was a /24. So, when you have a /24 and [239:30] you divide it into four subnets, then [239:33] the resulting subnet mask or the new [239:34] subnet mask is going to be extended by [239:36] two. Why? Because two to the power two [239:39] is four. That's what gives you the four [239:40] subnets. [239:41] What if [239:43] I want to divide by eight? [239:47] What will happen? [239:49] So, look at this. This is by four, 26. [239:51] By eight, it will be 27. Why? Because [239:54] three bits are needed to distinguish [239:56] between the eight subnets and that is [239:58] how it has been converted from /24 into [240:03] a /27. So, when you do subnetting, the [240:05] subnet mask or the network part gets [240:07] extended into the host. [240:10] How many bits into the host? If you [240:11] divide by two, it will be only one bit. [240:13] Let's Let's prove it. [240:17] So, it's going to be 25. From 24 to 25, [240:20] that gives you two subnets. [240:22] From 24 to 26 gives you up to four [240:25] subnets. From 24 to 27 gives you up to [240:29] eight subnets. [240:31] From 24 to 28 gives you up to 16 [240:34] subnets. Let's prove it. [240:37] So, let's say I want 16 subnets. [240:40] You'll find that it has extended by [240:43] four bits the subnet mask and [240:46] it is very good that we are having more [240:48] subnets, more networks you can use [240:50] separately, [240:51] but the downside is you are getting less [240:54] hosts in each one of the networks. [240:56] That's why it is important to ask how [240:58] many hosts per subnet and how many [241:01] subnets do I need? [241:03] You divide it by 16 and you have a [241:05] resulting /28. The /28 will only leave [241:09] 32 minus 28, which is four bits only for [241:13] the hosts. So, that you can give you a [241:15] maximum of 16 hosts. [241:17] And that doesn't help me because I need [241:19] 60 64. So, if you need 64, you have to [241:22] divide maximum by four. [241:25] Why? Because this is /26. [241:29] /26 for the subnet, that will leave me [241:31] with six bits for the host and two to [241:34] the power six, two times two times two [241:36] times two six times is 64. So, that's [241:39] exactly the number of hosts [241:42] that are available in a subnet. You put [241:44] the subnet, it will give you the details [241:46] about it and it will give you the first, [241:49] last and on so on. And if you would like [241:51] the binary, here it is. And if you would [241:53] like to go ahead and look at the [241:57] subnetting, then you can go into the [241:59] subnetting tool and you can ask for how [242:02] many subnets and then you can you can do [242:04] it. If you are not subnetting, it will [242:06] tell you that the usable host addresses [242:08] here are 192.168.1.1. [242:11] You can't take the network ID the .0 and [242:15] the last one will be .254 and the [242:17] broadcast IP is here. So, it's very easy [242:20] to use. It doesn't need magic. It [242:22] doesn't need a lot of knowledge and you [242:23] can play with it. And if you do only two [242:25] exercises, you will be the master of [242:28] using this tool. All right? So, [242:30] hopefully that was easy and that is what [242:32] we needed to do it when you subnet the [242:34] easy way. [242:37] Let's do one example on IP address [242:40] breakdown or IP address range breakdown. [242:43] We are going to use the calculator, but [242:44] I also will explain to you how you can [242:46] do it. [242:47] Given an IP address range and a subnet [242:50] mask for a subnet, how can we identify [242:52] the following? [242:54] The network ID or the network address [242:56] and the usable IP addresses in the [242:58] range. How many are they? What's the [243:00] first one and what's the last one and [243:03] what is the broadcast address of that [243:06] subnet? [243:08] So, here's an example. 112.168.2.0/24. [243:13] So, let's go ahead and go to the IP [243:16] calculator first. So, 112.168. [243:21] two [243:22] .0 and / 24. [243:26] So, if you click on [243:28] analyze basically or calculate, [243:30] you'll find that the network address is [243:32] 112.168.2.0. [243:35] Here's the one. Let me just [243:37] make it bigger. [243:39] And the network address is the same, the [243:41] network ID. [243:43] Broadcast address. This is /24. So, in [243:46] the last octet, I'll put all the bits as [243:48] one. [243:49] Eight ones. [243:51] And where did I get the eight from? [243:52] Because it is /24. The first 24 bits are [243:56] for the network [243:57] and the entire size is 32 bits. So, 32 [244:00] minus 24 leaves us with eight for the [244:03] hosts. [244:05] So, if you put eight ones, that is 255. [244:07] So, this is your broadcast address. [244:10] The first host IP address, the the very [244:13] first one you can use. You cannot use [244:14] the broadcast and you cannot use the [244:16] network ID, the very first IP address. [244:19] So, .1 will be the first one and .254 [244:23] will be the last one because it is one [244:26] before [244:27] the broadcast. [244:30] So, this is everything we need to know [244:31] about the subnet and here is the binary [244:33] equivalent. The subnet mask for 24, so [244:36] 24 ones and then zeros for the hosts. [244:39] Here is the network address. Put all [244:41] zeros in the host field and put all ones [244:44] to get the broadcast address. Very easy. [244:47] To find the broadcast broadcast address [244:49] of a given range, all you need to do is [244:52] find out what's the length of the subnet [244:54] mask, [244:55] decide where the host field bits are and [244:57] fill them with ones. That will be your [244:59] broadcast address. [245:01] So, in our example, here is the host [245:05] field. Fill it with ones [245:09] and translate that into decimal and it [245:12] becomes the broadcast address. So, that [245:14] is going to be 112.168.2.255. [245:21] If you want the usable IP addresses, the [245:23] very first one in which is the network [245:25] ID and the broadcast ID, they are not [245:27] usable. They have They are reserved for [245:29] special purposes and that's why you can [245:32] have all the hosts [245:35] in that subnet minus two, which is the [245:38] network ID and the broadcast IP and that [245:41] would be the number of usable ones. [245:43] So, if I have this network and we said [245:46] that the network ID is .0, that is not [245:49] usable. And the broadcast IP is .255, so [245:52] that's not usable. So, I have the ones [245:55] that are usable, the number of IP [245:58] addresses is two to the power and the [246:00] number of host bits. So, that means two [246:02] times two times two times two eight [246:04] times or that is 256. [246:07] Minus two for the network ID and the [246:10] broadcast IP, that is 254. So, this is [246:13] These are the usable IP addresses and [246:14] the very first one to use is going to be [246:17] .1 and the last one is going to be .254 [246:20] as we have seen in the calculator IP. [246:22] So, what I'm trying to show you here is [246:24] how you can do it yourself or if you [246:26] understand it well, then just go with [246:28] the calculator. It will be much faster [246:30] and much easier. And of course, you can [246:31] go to our friend ChatGPT and you can get [246:34] the same results. Let's go ahead and [246:36] give it a try. [246:37] And I'm going to ask, "Analyze [246:41] the subnet [246:43] 112.168. [246:45] Let me just make this bigger so you can [246:47] see what I'm typing. [246:49] .2.0/24. [246:52] I need to know [246:55] the network ID, [246:57] broadcast [246:59] IP, [247:02] first usable IP, last usable [247:06] IP and number of usable [247:10] IP addresses." [247:15] And of course, you can narrate that [247:17] using voice. So, you can click on voice [247:19] and instead of chatting, you can just [247:21] say what you want to do. [247:23] So, here's the subnet. [247:25] And that's the IP address. That's the [247:26] side annotation, subnet mask, [247:28] first address in the subnet or the [247:30] network ID, [247:32] then the broadcast address, [247:34] and then the first usable IP, [247:37] the last usable IP, [247:40] and then how many IPs are usable and it [247:44] gives you the math on how that was [247:45] reached. [247:47] So, in a /24, we have eight host bits, [247:49] 32 minus 24. [247:51] And then here is a summary of what you [247:53] need. So, if you would like to do it on [247:54] the calculator, that's fine. If you'd [247:56] like to do it in ChatGPT by narration, [247:59] that's fine. If you would like to do it [248:00] to your own hands and verify, that is [248:02] also fine. [248:04] All right. [248:05] Now, let's do a cheat table for you to [248:08] remember the number of hosts and also [248:12] the usable IP addresses. [248:14] If you have a subnet or a network with a [248:16] /24, [248:18] that will leave you with eight host [248:20] bits. [248:22] Host IP address, the total number [248:24] including the network ID and the [248:26] broadcast is going to be 2 to the power [248:28] n, where n is the number of host bits. [248:32] It's 32 minus the subnet mask length. [248:38] If the subnet mask is longer, [248:40] then you get less hosts and the net [248:43] usable ones is minus two, so that will [248:45] be less as well. [248:46] If you make it longer again, then you [248:49] get less hosts and less net usable ones [248:52] and so on [248:53] until /30, [248:55] where you'll have four IPs of which two [248:58] only are usable. So, this is very small. [249:00] Why would I use this? [249:02] If you have two routers in a LAN [249:05] and you would like to connect between [249:07] them, you have to enable or to provide [249:11] an IP address to this side of the link [249:13] and this side of the link from a LAN [249:16] and they have to be in the same subnet. [249:20] So, you want only two IP addresses. So, [249:22] why waste more IP addresses? Allocate a [249:25] /30 subnet [249:27] that will have only two usable IP [249:29] addresses. Allocate one on this side and [249:31] allocate the other on the other side and [249:33] that's it. We're going to talk about [249:34] that later on when we get to IP routing. [249:37] All right? [249:40] Now, let's do another practice example [249:42] for the IP breakdown. But this time we [249:44] are going to do it ourselves. We're not [249:46] going to use the calculator. Just to [249:47] make sure that you understood it right [249:49] and you are capable of doing it before [249:52] you standardize on using calculators or [249:54] ChatGPT all the time. [249:56] So, here's another example. [249:57] 112.168.209.33/20. [250:02] So, now we did not give you one that is [250:04] eight bits or 16 bits or 24 bits. No. [250:08] Now, we are giving you one that will end [250:10] exactly at the half of this octet. The [250:12] left half is going to be bits for the [250:14] network [250:16] and the right half is going to be bits [250:18] for the host. [250:20] So, you are more familiar with any [250:22] subnet mask. It doesn't have to be /24 [250:24] all the time. [250:25] So, for this one, if we translate that [250:28] into [250:29] a binary equivalent, that is going to be [250:31] the first octet, second octet, and then [250:33] 209. Can I take the 128? Yes, you can. [250:37] That's why we're going to have a one in [250:39] the 128. And now I'm talking I'm sorry, [250:41] this one. [250:42] I'm talking about this one. [250:45] I'm going to take the 128 with me. All [250:47] right, can I take the 64? [250:49] Let's see. 64 + 128 is 192. Is that less [250:53] than 209? Yes, it is. Then I can take [250:56] that as well. So, a one and a one. That [250:59] is 192. We are still 17 short of the [251:03] 209. [251:04] Can I take the 32? No, you cannot. So, [251:06] make it a zero. [251:08] Can I take the 16? 192 + 16 that is 208. [251:13] Yes, I can take it. So, that's why we [251:15] place a one. And then all zeros. We need [251:18] We are still one short. 208 to 209 is [251:21] only one. That's why we put one here. [251:24] So, since it is /20, that is 8 + 8, [251:27] that's 16 and 4 is 20. [251:30] So, this is the network part [251:33] and then the host will be the remainder. [251:35] So, here we have 12 bits for the host. [251:39] We have four here plus eight here. So, [251:42] we have 12 bits for the host. All right. [251:44] Okay, what do we need? [251:45] We need to know the network ID. Easy. In [251:48] the host part, put all zeros. So, put [251:52] this to zero and put this to zero and [251:54] put this to zero as well. [251:57] All right, if I do this, what do I end [251:59] up with? I end up only with the purple [252:01] ones and then zeros and here all zeros. [252:04] So, all zeros is easy. But the purple [252:06] ones [252:08] and this is going to be a zero. [252:10] So, 192 [252:12] + 16, that is 208. So, 208 [252:17] + 0 and the 168 will be the same, 168. [252:22] And the 112 is going to be the same. [252:26] So, the network ID is 112.168.208.0. [252:29] Easy. [252:31] All right. Okay, what do we need? We [252:33] need the broadcast IP. So, to get the [252:36] broadcast IP, you have to put all the [252:38] host bits ones. [252:41] So, if this is all ones, easy. That is [252:43] 255. So, where is the tricky part? The [252:46] tricky part is here. [252:47] This is 208. Now, if you put four ones [252:51] here, the four ones are 8 + 4 + 2 + 1. [252:56] So, 8 + 7, that is 15. 15 added to the [253:00] 208, that is 223. [253:03] So, 223 [253:05] + 255 is the broadcast IP. So, let's [253:08] look at that. [253:11] So, that's [253:13] how it would look like and that [253:14] translates into 223.255. [253:18] Now, we know the network ID and we know [253:21] the broadcast IP. [253:23] How many usable IP addresses do I have [253:25] here? [253:29] Let's find out. [253:30] We have the host bits 32, which is the [253:33] total length of an IP address minus 20, [253:36] which is the network part in the subnet [253:38] mask as they indicated here. That means [253:41] I'm left with 12 bits for the host. [253:45] So, 2 to the power 12, 2 * 2 * 2 * 2 12 [253:49] times, that is 4,096. [253:52] Remove from that. Now, we're talking [253:54] about the usable IPs. Remove from that [253:56] the network ID and the broadcast IP. So, [253:58] remove two, that leaves you with 4,094. [254:04] First usable IP, [254:06] we put one and all zeros in the host [254:09] part. That will be the first one. [254:13] Last usable IP, broadcast IP minus one. [254:16] So, if the broadcast IP was 223.255, [254:20] the one before, the 254, that is going [254:22] to be the last usable IP address. And we [254:25] have 4,094 IP addresses. So, hopefully [254:28] the concept is clear and I want you to [254:30] come up with IP addresses, any IP [254:33] addresses, any subnet mask length and [254:36] then try to do it yourself. Try to [254:37] analyze it [254:38] and try to find out the host bits, the [254:40] number of usable IP addresses, the first [254:43] usable IP, the last usable IP, the [254:45] broadcast IP, the network ID. I would [254:47] like you to train and you can validate [254:49] on ChatGPT or on the calculator and [254:51] you'll find if your answers are spot-on [254:54] or if you have missed something. If you [254:55] missed something, go back and try to [254:57] find out what did you do wrong, fix it [254:59] and that's how we cement the knowledge [255:01] and that's how we retain the [255:03] understanding and the information we [255:04] learn as well. All right, thank you. [255:09] So, let's now discuss the subnetting [255:12] topic in details. So, we are going to [255:14] take ranges and we're going to break [255:16] them down based on requirements and [255:18] during the process you will understand [255:20] how subnetting is done in real world. [255:24] So, why do we do subnetting? Subnetting [255:26] will allow us to take an IP address [255:29] block and then divide it into smaller [255:31] chunks. And why do we do this? Because [255:35] when we build an infrastructure, usually [255:37] we have different offices, different [255:39] networks, different LANs, wide area [255:42] network, wireless LAN requirements. We [255:43] have different requirements. [255:45] Also, when we come to the data center, [255:48] when we build it, we want to have [255:50] databases separate from the application, [255:52] separate from the monitoring, separate [255:54] from the other tools, separate from the [255:55] active directory domain where the users [255:58] log into a Microsoft domain and the [256:00] corporate network and be able to use the [256:03] different applications, separate from [256:04] accounting, separate from finance. So, [256:06] there are requirements to separate data [256:10] in your data centers and to build [256:12] different LANs and to to build wide area [256:15] network and all of that requires IP [256:16] addressing and it cannot be one range. [256:19] It has to be broken down into smaller [256:22] networks that have boundaries and you [256:24] don't intermix between the different [256:27] networks. So, that's why subnetting is a [256:29] must. It's not a luxury and it's not an [256:31] option when we have a sizeable network [256:33] infrastructure that we need to build. [256:37] Also, the fact that when you build [256:38] different networks, you can start to put [256:40] security in between. You can do [256:42] filtering. Subnetting is a critical [256:45] component of any network infrastructure. [256:49] That is given. [256:50] Even if it is a small company that has [256:52] two, three offices, they will need to [256:55] have different networks in each one of [256:56] these offices. [257:00] So, let's do a subnetting practice and [257:03] through the practice I'm going to [257:04] explain how that is done. [257:07] So, we have an IP range below, [257:09] 112.168.240.0 [257:12] /24. [257:14] So, from what we know, that means the [257:16] first 24 bits, because of this 24, is [257:20] the network part and the last eight bits [257:24] is the host part. How did we know that? [257:26] Because it's 32 bits long minus 24, I'm [257:29] left with eight only. [257:31] So, what do we need? We need four [257:33] subnets. We need to divide that into [257:35] four subnets. [257:38] And each subnet must have 64 total hosts [257:41] or total IP addresses. [257:45] And if we do the analysis, it's easy [257:47] because how can I get to the network ID? [257:50] Put zeros in the host part and it's [257:53] already done. It's already a zero in the [257:54] host part. So, that's the network ID. [257:57] The same thing is the network ID and we [257:59] don't write the subnet mask next to it. [258:02] If I convert that into binary, it [258:05] becomes 0111 and then four zeros {dot} [258:10] 1010 1000 [258:13] {dot} [258:14] 1111 0000 and this is the host part. [258:20] What is the broadcast IP? The process is [258:22] easy. Put ones in all the host bits and [258:27] convert that into decimal and that [258:28] becomes your broadcast IP, [258:30] which is the last IP in the network. So, [258:33] put 1 1 1 1 1 1 1 1 and that becomes [258:38] 255. [258:42] Total number of IP addresses in the [258:45] original network. We still did not do [258:47] any subnetting. We are analyzing the [258:49] original network. [258:51] So, how many [258:53] host IP addresses do I have total? Not [258:55] the net not the usable ones. So, two to [258:58] the power n and n is the number of host [259:01] bits. The number of host bits in our [259:03] case is eight. [259:04] So, that's 256 IP addresses including [259:08] the network ID and the broadcast IP. So, [259:10] if you want the usable IP addresses, it [259:13] is [259:14] 256 minus two, which is 254 and they [259:16] start at {dot} one and they finish at [259:19] {dot} 254. The one before the broadcast [259:22] IP and the one after the network ID are [259:25] the first and the last ones to be used. [259:28] All right. So, now let's go ahead and [259:30] think about what we need to do. We need [259:32] to divide this into four equal subnets. [259:36] So, if I have 256 [259:41] total host IP addresses. [259:44] Now, if I divide this by four, how much [259:46] do I get? [259:48] That will be 64. You can use your [259:50] calculator if you would like to check. [259:52] Okay? So, 64 [259:55] in each one of the subnets. So, each one [259:57] of the subnets will have a total number [259:59] of hosts of 64. Why? Because we need [260:02] four equal in size subnets. [260:06] All right, that's fine. So, let's try to [260:08] define the four chunks that we are [260:11] talking about. So, we'll start from zero [260:14] to 63. That will be the first one. [260:17] What's my evidence? [260:19] If I tell you that, please divide eight [260:23] by four. Let's say you have eight IP [260:25] addresses. [260:27] Divide eight by four and you will start [260:29] counting from zero. So, that is what 01 [260:33] 23 [260:34] 45 67, right? [260:38] So, although the result is two, the [260:41] first one will be zero and one because I [260:43] start counting from zero. Zero and one [260:46] are two numbers. That's it. [260:48] So, if you have a total of 64 and you [260:51] would like to count from zero, so it [260:53] will start the first range will start [260:54] from zero and it will end at 63, not 64. [260:59] If it ends at 64, that will be 65 in [261:02] total. [261:03] What's my evidence? Here, when we do the [261:06] counting, the eight numbers, they start [261:08] from zero and they end at seven. [261:11] And total hosts that we have in the [261:13] subnet, they start at zero, which is the [261:15] network ID, and they end at {dot} 255, [261:19] which is the broadcast IP, right? So, [261:21] these are 256. So, exactly the same. The [261:24] first one will be from zero to 63. You [261:26] can count them on your hand or you can [261:28] write them down if you want or you can [261:29] ask ChatGPT if you don't believe me. [261:33] Okay? So, if we are from zero to 255, [261:36] the first range, the first 64 is going [261:39] to be starting from zero and it ends at [261:42] 63. [261:43] The next one is going to start from 64 [261:47] and it will end at 127. [261:50] The third one is going to start at 128 [261:54] and it's going to end at 191. The fourth [261:56] one is going to start from 192 and it [261:58] will end at 255. If you would [snorts] [262:00] like to count, you will find that these [262:02] are 64. These are 64. These are 64. [262:05] These are 64. And the starting is {dot} [262:08] zero and the end is {dot} 255, which is [262:11] exactly what we have here. So, that is [262:14] the equal four chunks or four subnets [262:18] that we need. Done. It's solved. [262:22] Yeah, but how can we allow the computer [262:25] to understand this? [262:26] What is the subnet mask? [262:29] And the subnet mask that we are going to [262:31] come up with must start the first subnet [262:35] at zero and end it at 63. [262:39] So, the host bits, the iterations, the [262:42] different combinations in the host bits [262:44] must not exceed 63. [262:47] Because when we exceed 63, we're going [262:50] to transition to the next range, which [262:52] is starting at 64. [262:54] Same thing. This should end the subnet [262:57] mask should end at 127 [262:59] because when I switch to 128, I'm going [263:02] to get to the third subnet. So, the new [263:04] subnet mask can never be the same subnet [263:07] mask. You cannot claim that you're going [263:09] to cut a pizza into four equal slices [263:12] and the result is going to be a full [263:15] pizza and a full pizza and a full pizza [263:17] and a full pizza. It's going to be a [263:18] quarter and a quarter and a quarter and [263:20] a quarter. So, that means the subnet [263:22] mask must change. That is not an option. [263:25] It has to change. [263:29] So, let's think about the subnet masks [263:31] now. [263:33] If the number of IP addresses is 64 [263:36] and we mentioned that the subnet mask [263:39] must be able to reach the limit, the [263:42] maximum, the broadcast IP. It will be [263:44] the last one. It will be the 64th [263:46] host and then it has to switch. How many [263:49] bits do I need to get to 64 [263:53] IP addresses? [263:55] Think about it. 2 * 2 * 2 * 2, how many [263:58] times? So, 2 2 * 2 is 4. * 2 is 8. So, [264:02] that's three. [264:04] * 2 is 16. * 2 is 32. * 2 is 64. So, I [264:10] need six bits for the host in order to [264:14] switch subnets every 64 IP addresses or [264:17] every 64 hosts. So, that means I need [264:21] six bits [264:23] for the host and that leaves me with 32 [264:27] minus six, which is 26. That is going to [264:30] be for the new subnets or the new [264:33] networks. [264:34] So, the new subnet mask is going to be a [264:36] {slash} 26. [264:38] How can I verify? So, let's proceed and [264:40] find out. So, this is going to be the [264:42] new subnet mask a {slash} 26. [264:45] {slash} 26 means eight bits {dot} eight [264:48] bits {dot} eight bits {dot} two [264:52] and all of them are going to be ones. [264:54] So, 255 [264:56] {dot} 255 [264:59] {dot} 255 [265:01] and the last one has only two bits that [265:03] are one [265:04] and that is 128 plus 64. So, 192. That's [265:09] how we came up with this one. [265:13] So, what are the resulting subnets? They [265:15] are going to be {dot} zero {slash} 26, [265:18] which will cover the first range. [265:21] Then {dot} 64 {slash} 26. [265:24] Then 128 {slash} 26. [265:27] Then 192 {slash} 26. If you notice here, [265:31] the difference is 64. [265:34] The difference is 64 and the difference [265:36] is 64. [265:38] And why is that? Because each subnet has [265:40] 64 IPs, right? So, every 64, I'm going [265:43] to switch subnet. And what will confirm [265:45] this is the new subnet mask. Simply [265:47] because in any one of these, it's going [265:50] to be [265:52] network [265:53] eight bits, network eight bits, network [265:55] eight bits. Then I have network. So, [265:58] here I have two bits, eight [266:01] eight and eight and I have six left for [266:05] host. [266:06] What is the maximum number I can put in [266:09] six bits? So, let's try. 1 2 3 4 5 6. [266:14] Let's count them. [266:16] So, this is one. [266:18] This is two. The weight [266:20] This is four. [266:22] And this is eight. So, these are 15 and [266:26] this is 16. [266:28] And 15 is 31. 31 plus 32, that is 63. [266:33] So, you start from all zeros and you go [266:36] to 63. [266:37] If you add one more, you will switch to [266:40] the next one. The next one is going to [266:41] be 1000 [266:44] 000, which is 64. So, that means I have [266:48] switched to another subnet and that's [266:50] exactly what happens here. [266:51] In the first subnet, because of the [266:53] subnet mask, six bits only for the host, [266:55] I'm going to switch at 63 will be the [266:57] max, the broadcast IP and the next one [267:00] is going to be a different subnet. [267:01] So, now we are satisfying that and the [267:03] new subnet mask seems to be working. [267:07] Let's analyze the first subnet. [267:09] So, it is 240 {dot} zero {slash} 26. [267:13] Remember, the original one was 24. [267:17] So, that's the subnet ID. Okay, fine. [267:20] Binary equivalent is [267:22] the same 112 [267:24] 168 240, but then we take two bits for [267:29] the subnet [267:31] and these six will be for the host. So, [267:33] what will be the first and last IP? This [267:35] is the subnet mask [267:37] in decimal. [267:38] The first IP is zero and the last one is [267:41] 63. So, 63 is the broadcast and this is [267:44] the network ID. So, the usable IP [267:47] addresses are not 64, they are 64 minus [267:49] two. They start at dot one and they end [267:52] at dot 62. [267:56] All right? So, these are the usable IP [267:57] addresses. [268:00] And the broadcast IP is the last one. [268:02] So, that's easy, right? [268:04] And what's the subnet mask? As we [268:05] mentioned, it's going to be [268:07] 255.255.255.192. [268:10] Okay. So, the first subnet, all of the [268:13] numbers from zero from dot zero to dot [268:16] 63, these two bits are going to be fixed [268:19] at zero zero. [268:23] Let's analyze the second subnet. So, [268:26] that will be 112.168.240 [268:27] and starts at 64 and the subnet mask is [268:30] {slash} 26. [268:33] So, what's the subnet ID? [268:34] Again, put zeros in the host and you [268:36] will be good to go, 64. [268:39] And here is a confirmation that if you [268:41] put zeros here, [268:43] then we're going to end up with 64. [268:46] Now, notice that this is going to be [268:49] fixed [268:50] for all the IP addresses from 64 to 127. [268:55] And it will switch at 128. So, all the [268:58] IP addresses or the hosts in this subnet [269:01] are going to have zero one here and the [269:03] range is from 64 to 127. [269:07] And here's the subnet mask and it starts [269:09] at 64, ends at 127. [269:12] And the usable IP addresses, they will [269:14] start from 65 to 126. [269:17] And the last or the broadcast IP is 127. [269:21] If we go to the next one, 128, then [269:24] similarly, we can do the same analysis [269:26] and you will figure out that the ID is [269:28] 128. Please note that this has switched. [269:32] So, in the first subnet, the two bits [269:33] were zero zero. In the second subnet, [269:35] they were zero one. In the third subnet, [269:38] they are one zero. [269:39] And then here, we start from 128 and we [269:42] end at 191. [269:44] Subnet mask is the same. The IP [269:47] addresses or the range is 128 to 191. [269:50] The usable ones are the next one, 129 [269:53] and the one before the broadcast, 190. [269:56] And the broadcast IP is 191. [269:59] The fourth one is 192 and the ID is the [270:02] same. [270:04] And please note that this has switched [270:06] to a different subnet. So, that's how we [270:08] distinguish the four subnets from one [270:09] another. And the first IP is 192, the [270:12] last is 255. The usable ones is 193 and [270:16] the last is 254. And the broadcast IP is [270:19] dot 255. [270:21] So, now it's very clear that [270:24] in order to move from the original [270:26] subnet [270:27] to get to the entire subnets, so the the [270:30] original subnet mask was 255.255.255.0, [270:34] I had eight bits for the host. [270:37] In order to divide that pizza into four [270:40] equal slices, I ended up [270:43] taking up two bits from the host. Why [270:47] two? Why not three? Because we needed [270:48] four, four subnets, right? [270:51] The two bits can give me zero zero, zero [270:53] one, one zero and one one. So, four [270:56] different combinations, each one of them [270:58] will distinguish one subnet from the [270:59] others. [271:00] So, that's more than enough for four [271:01] subnets. If I needed five or six or [271:04] seven or eight subnets, I would have to [271:06] take three bits. [271:08] And the second thing to note is [271:10] the more subnets you create, the less [271:14] host bits compared to the original you [271:16] will end up with. [271:18] So, the more subnets, the less bits for [271:20] the host. So, that means less hosts per [271:22] subnet. So, that's one thing you should [271:24] keep in mind. [271:26] The third subnet took the the zero one [271:28] and that's the 64 subnet. [271:30] And then the third subnet took one zero [271:33] and the fourth subnet took the one one. [271:35] So, as if the rule is [271:38] if you would like to divide a subnet, a [271:41] block into two subnets, you will take [271:43] one bit. [271:45] If you want to divide it into [271:47] three or four, [271:49] then you will take two bits. [271:51] If you would like to divide it or if you [271:53] need five or six or seven or eight [271:55] subnets, then you have to take three [271:57] bits. Shift into the host side by three [272:00] bits. If you want anything from nine [272:03] subnets to 16, you have to take four [272:05] bits from the host field. And that's how [272:08] it works. [272:11] Okay, so at the end, the given IP range [272:13] into four subnets, the resulting subnets [272:15] will be {slash} 26, which is two bits [272:17] longer than the original one. So, we [272:19] have borrowed two bits from the host [272:22] field in order to create the four [272:24] subnets. [272:27] And each new subnet will only have six [272:30] host bits, which means 64 IP addresses [272:33] only. Whereas the original one had 256. [272:37] One golden rule, please stick that, [272:39] engrave it in your brain, [272:41] is once you subnet an IP address range, [272:46] you can use these as you wish, but you [272:49] cannot use this anymore. [272:53] And here is a rule [272:55] to summarize what we discussed. If you [272:57] started from {slash} 24, [272:59] and if you need one subnet, then don't [273:02] don't do subnetting. If you need two [273:03] subnets, then you have to borrow one [273:05] bit. So, the resulting subnet mask is [273:07] going to be {slash} 25. [273:09] That will give you two subnets [273:11] and it will leave you instead of {slash} [273:14] 24 gives you eight bits for the host, [273:16] this will leave you with seven because [273:18] you have already borrowed one. [273:20] And that will leave you with a total of [273:22] 128 [273:24] hosts in each resulting subnet and the [273:27] usable ones will be 126. [273:30] So, please notice, the original one, you [273:32] had 256 and the usable were 254. [273:36] Here, you have two subnets, each one of [273:39] them has 128. [273:41] The usable in each one of them is 126. [273:43] So, you waste two in the first subnet [273:46] and you waste another two in the second [273:47] subnet. So, the total usable hosts are [273:50] not going to be 254, they are going to [273:52] be 252. [273:54] So, subnetting wastes some hosts in the [273:57] original subnet, but we have to do it [273:59] because that is best practices for [274:01] building infrastructures and networks [274:04] and different lands and different [274:05] offices and different wide area network [274:07] links and so on. [274:09] If you want to subnet to three or four [274:11] subnets, you have to borrow two bits. [274:13] If you want to subnet five, six, seven [274:16] or eight, up to eight, then you have to [274:17] borrow three bits. And the subnet mask [274:19] is going to be longer in each one of [274:22] them. And that means the remaining host [274:24] bits are going to be lesser and the [274:27] total number of hosts and the usable [274:29] ones are going to be lesser as well. So, [274:31] the more subnets you make, as you notice [274:34] here, [274:35] for example, [274:36] I have more subnets and it's {slash} 30, [274:40] it only has two usable IP addresses. [274:42] So, the more subnets, the lesser hosts [274:45] per subnet. So, you have to ask the [274:46] questions, how many hosts per subnet, [274:48] how many subnets do you need and then [274:49] you can assess and see if the block [274:52] given to you is enough or not. All [274:53] right? Hopefully, that was clear. [274:57] Now, let's cover and identify the public [275:01] IP addresses. We're going to talk about [275:02] public IP addresses and then private IP [275:05] addresses and we're going to distinguish [275:07] between them. Very important to [275:08] understand. [275:09] So, what's a public IP address? A public [275:11] IP address is an IP address that can be [275:13] accessed over the internet. [275:15] Are you saying that there are IP [275:17] addresses that cannot be accessed over [275:19] the internet? Yes, and these are the [275:21] private IP addresses. In your home, [275:24] internally inside your network, [275:27] you will have private IP addresses. [275:30] So, the internet cannot get directly [275:33] into your machines. They cannot. [275:37] They have to go through a public IP [275:39] address [275:41] and that will be how they get to you and [275:44] then this router needs to do some magic [275:46] to send you [275:48] the traffic. So, if you go on your [275:50] browser and then you type cnn.com, [275:53] when you type cnn.com, you are using a [275:55] private IP address. We're going to talk [275:57] about this next. [275:58] And the router is going to convert that [276:00] into a public IP address before sending [276:03] that out to the internet. As if it is [276:05] masking a different identity, telling [276:08] the internet, "Hey internet, I am [276:10] defined on the internet. I have an [276:12] internet approved IP address, a public [276:15] IP address, and if you want to come back [276:18] to me with the response, please use this [276:20] IP address." [276:22] Any device or network that wants to [276:24] communicate directly with the internet [276:26] must use a public IP address. Even if it [276:29] is your home router, yes, your home [276:31] router does have a public IP address. [276:34] And same thing, the router at your [276:36] office or your company. And the same [276:38] thing when you go to an airport and you [276:40] connect to the wireless LAN at the [276:41] airport, then the airport must have [276:44] public IP address on the internet. [276:47] If we reciprocate, that means if I need [276:50] to get into amazon.com on the internet, [276:52] amazon.com must have a public IP [276:54] address. Yes, that's correct. If I want [276:57] to get into cnn.com, into [276:58] britishtelecom.com, anything that is [277:01] available on the internet, that entity [277:03] must have a public IP address. [277:06] So, what's the public IP address? Think [277:08] about the postal system. [277:10] If you don't have an address registered [277:12] on the postal system, that means nobody [277:14] can get to you. If you are living in the [277:16] middle of the jungle and there is no [277:18] address and there are no streets and [277:20] post doesn't deliver into your location, [277:23] that means you are off the grid. Nobody [277:25] knows about you. You must have an [277:27] address in order to be able to send and [277:30] receive mail. [277:32] The analogy in the networking is if you [277:34] would like to be on the internet and [277:36] known and addressable on the internet, [277:38] you can send and receive, you You have a [277:40] public IP address. It doesn't have to be [277:42] you, but the place where you are in must [277:44] be connected to the internet. Where [277:46] would you get that? At your home. The [277:48] one company or service provider or [277:51] telecom company that is providing you [277:54] the internet connection will provide [277:56] your router with a public IP address. [277:58] So, that's how it works and there is no [278:00] deviation from this. [278:03] Public IP addresses, they are visible on [278:05] the internet. So, anyone online on the [278:07] internet can reach it unless you put [278:10] some security measures to block incoming [278:12] traffic. [278:14] There is no two persons or two homes or [278:17] two entities globally on the internet [278:20] that would be using the same IP address. [278:22] So, it is globally unique. [278:25] So, no two public IPs are the same [278:27] anywhere in the globe. [278:29] And it is used for communication, for [278:31] websites, for servers, for emails. All [278:33] your computer use on the internet or [278:36] laptop or iPhone use on the internet [278:39] needs public IP addresses. [278:41] And it is routable. The internet [278:44] wherever you are, as long as you have a [278:46] unique public IP address, they will be [278:49] able to get to you and they will be able [278:51] to send your traffic wherever you want [278:52] to send it on the internet. [278:57] The IP addresses, now it's not random. [278:59] What you are telling me is the service [279:01] provider, the Telco companies, the [279:02] governments are the ones that have the [279:05] blocks of IP addresses and they are in [279:08] control. Otherwise, it's going to be a [279:10] mess. So, IP addresses must be assigned [279:12] and managed globally by official [279:14] organizations and this is called the IP [279:17] address hierarchy. And these are [279:19] existing in the different continents and [279:22] in different countries as well. So, IP [279:24] address must be unique. Otherwise, if [279:25] two entities had the same IP, the [279:27] internet wouldn't know where to send the [279:29] data. [279:31] And this is how the hierarchy looks [279:33] like. So, IANA and then in Africa, in [279:37] Europe, in Asia Pacific, in Latin [279:40] America. [279:41] And then we have resource allocation [279:43] hierarchy and then we have the service [279:44] provider and then the national IP [279:47] registries in each country. So, in each [279:49] country, the continent responsible ones [279:52] are going to deliver blocks to the [279:53] countries and then the countries are [279:55] going to deliver deliver the blocks to [279:56] the ISPs and each one has a record of [280:00] what is used and what is not used. And [280:02] that's exactly the analogy with plate [280:04] numbers. When you go into a country [280:07] and you get a plate number, the plate [280:08] number may have the city name or the [280:10] city code and then a number. The phone [280:13] system, same thing. You have the country [280:15] code, area code, and a unique number. [280:17] The exact same thing happens on the [280:18] internet. [280:20] So, IANA is the Internet Assigned [280:22] Numbers Authority, the top-level body [280:24] and that's in the US. And then you have [280:26] the regional internet registries which [280:30] will manage the different parts of the [280:32] world. [280:33] And these are ARIN, North America, RIPE [280:36] for Europe and Middle East, APNIC for [280:38] Asia Pacific, LACNIC for Latin America, [280:41] and AFRINIC in Africa. [280:43] And then we have the national internet [280:45] registries inside each country and then [280:47] the internet service provider. What do [280:49] you get out of all of this lecture? The [280:51] message is to be on the internet [280:54] either you yourself, if you're using [280:55] your phone in the street, or the place [280:58] where you are must be connected to the [280:59] internet. To be connected to the [281:01] internet, that means you have public IP [281:03] addresses that are registered and they [281:06] are assigned to you legally and you are [281:08] authorized to use them and these are [281:10] unique. They are They will not exist [281:12] anywhere else on the globe. [281:16] What are the private IP addresses if you [281:19] have already discussed what are the [281:20] public IP addresses? [281:22] Private IP address ranges are IP [281:24] addresses that you can use without [281:27] having to go and ask for assignment or [281:30] authorization from anyone. [281:32] And these are called the RFC 1918, the [281:35] request for comment. There are private [281:37] IP address ranges and these IP addresses [281:40] are not routable on the internet. So, [281:43] you cannot have your wireless router at [281:46] home be connected to the ISP using a [281:48] private IP address. That's how it works. [281:51] Or that's how the norm is. [281:53] If you have your home router or your [281:56] phone configured with a private IP [281:58] address and you try to connect to the [282:00] internet, it will not work. [282:02] So, they are not routable. The private [282:03] IP ranges, they are not routable on the [282:05] internet. They are not visible on the [282:07] internet. So, they have to be hidden [282:09] behind public IPs. [282:11] So, they won't work directly on the [282:13] internet. They have to be using a means [282:15] that is connected to the public internet [282:17] to be able to access the internet. [282:20] They can be used freely within private [282:22] networks. So, the reason why they came [282:24] up with the private IP address ranges [282:26] is because they were afraid they will [282:29] run out of the available IPv4 public IP [282:33] address ranges. [282:35] So, because they were afraid of that, [282:37] they said, "Okay, we're not We cannot [282:38] assign an IPv4 public IP for each [282:42] device." At my home, for example, let's [282:44] say I have four family members. [282:47] And each of us has an IP phone and each [282:49] of us has a laptop. And my younger kids, [282:53] maybe they have iPads. And then I have [282:55] the smart TV and maybe my [282:57] fridge is a smart fridge, IoT, that also [283:00] has an IP address. So, I need in my home [283:02] easily about maybe 12, 15 IP addresses. [283:06] If each one of them would have been [283:09] requiring a public IP, that means we [283:11] would have been done with all the [283:15] available IPv4 public addresses long [283:17] time ago. [283:19] They said, "Okay, fine. Let's now assign [283:21] private IPs. Anyone can use it inside [283:24] their homes, inside their offices, for [283:26] printers, for fridges, for smart TV, for [283:29] whatever." [283:30] And that is for networking within the [283:32] place. You don't need the internet. [283:34] If you need the internet, then you have [283:36] to put a gateway that will have a public [283:39] IP and that will be the bridge to the [283:41] internet. [283:43] So, here's the example. [283:45] In my home, I have these devices [283:47] and these are going to take private IP [283:50] addresses. [283:51] One would tell me, "Mm, okay. Can we [283:54] prove it?" Yes, I can prove it, but just [283:55] hold on. [283:57] And the Wi-Fi router coming from the [283:59] Telcom provider, [284:01] it will have a public IP and that's how [284:04] it works on the internet. How does the [284:06] conversion happen from private to public [284:09] on the way out? [284:11] And when the response comes back to the [284:13] router, this will be addressed to the [284:15] router public IP. [284:17] How does that get converted back to the [284:20] correct IP address, the private IP [284:22] address? Who does the conversion? That [284:24] will be your Wi-Fi router in this case. [284:28] Private ranges, 10.0.0.0/8 [284:33] and that's a class A. [284:34] 172.16.0.0/12. [284:37] So, 10 172.16 [284:39] and 17 all the way 18, 19, 20, all the [284:43] way to 31, they are included in this [284:46] range. [284:48] This one will give me 16 million IP [284:50] addresses. [284:52] This one will give me 1 million IP [284:54] addresses in each one of these networks. [284:56] So, I have 172.16.0.0/16 [284:59] all the way to 172.31.0.0/16. [285:03] This is for large, medium networks and [285:05] then this is for homes and small [285:07] offices, 192.168.0.0/16. [285:11] Here is the interface IP address that I [285:14] have on my computer, on my Mac right [285:17] now, 192.168.68.108. [285:20] Let's compare that. [285:22] Contrast this to this and you'll find [285:23] that I have been assigned through Wi-Fi [285:26] from my home router, the Wi-Fi router at [285:29] home, I have been assigned this IP [285:31] address. [285:33] And that belongs to RFC 1918. And if you [285:36] check with IP config or this command, if [285:38] you have Mac or Linux, try this. [285:41] Or IPA if you're on on Linux. [285:44] And then in my case, [285:47] this is the IP address. Check in your [285:49] case. If you have Windows, go to CMD [285:52] and type IP config and hit enter. Of [285:56] course, here it's not complete because I [285:57] have to do IP config get interface [285:59] address and that's how the IP address. [286:01] So, that proves my theory that I am [286:03] getting a private IP address, but on the [286:06] internet I am seen as if I am the IP [286:09] address on the router. And that's how I [286:11] communicate with the internet. [286:16] So, what's the conversion process that [286:17] happens on the router? This is called [286:20] network address translation and [286:22] sometimes it's more specific, it's [286:24] called port address translation. When we [286:26] discuss the IP ports later on, we'll [286:29] come back and revisit and I will explain [286:31] to you what PAT is. [286:33] But for now, [286:35] the IP address that is on my machine, [286:37] which is a private IP address, [286:40] when the message which is going, let's [286:42] say, to cnn.com, [286:44] when this message reaches the router, [286:46] the router will will say, "Okay, now. I [286:49] know it is coming from this IP address." [286:52] Let's say that's the IP on my machine, [286:54] 192.168.68.108. [286:57] I'm going now to remove that as the [287:00] source, basically, and I'm going to [287:02] claim that I am the source. Why? Because [287:05] your IP address cannot go to the [287:07] internet and the internet will never be [287:09] able to deliver the response, but my [287:11] public IP address is a registered one on [287:14] the internet and the internet knows how [287:17] to take my traffic forward to cnn.com [287:20] and knows how to get the response back [287:22] all the way to here. And I promise you, [287:24] when I get the response, I'm going to do [287:26] the opposite and I'm going to deliver [287:27] the message to you. We're going to talk [287:29] about this more later on. [287:33] If a device with a private IP address [287:34] inside the private networks needs to [287:36] communicate to the internet, then the [287:38] router will use network address [287:40] translation and swaps the device private [287:43] IP address for the public IP on the [287:47] router. That's the only way this can [287:49] work on the internet. [287:53] Let's do a quick demo using a Windows [287:56] client or a Windows PC in order to show [287:59] you how to start the command prompt in [288:01] Windows and also to see the private IP [288:04] address that we will have in that [288:07] machine. So, I'm using a Windows machine [288:09] in AWS to simulate the client. So, this [288:12] is the public IP address as you can see [288:14] here and this is the private IP address. [288:17] So, this is as if it is your laptop. [288:21] First of all, [288:22] how can I get to the command prompt? [288:25] If I go here [288:26] and I do a search, [288:29] and then here in the search criteria, I [288:31] just type CMD. [288:36] So, that's the command prompt window [288:37] that we need to open. So, when you open [288:40] the command prompt, what you will see is [288:43] this prompt and we can do from here IP [288:46] config. [288:48] That will show what configuration we [288:49] have and as you can see here, this is [288:51] the IP address, the private IP address [288:54] which exists right here. [288:56] So, that shows you that it is the same. [289:04] Now, it's time to talk about how do [289:07] routers actually work? [289:10] What we have not done yet is configuring [289:13] or at least understanding [289:15] how should the router be configured? How [289:18] should the router [289:19] be told how to use or find out the best [289:23] path to a destination. That's what we [289:25] are going to do [289:26] in this module. [289:29] So, we'll know the AWS infrastructure, [289:31] we'll know what is an AWS VPC or virtual [289:33] private cloud or virtual data center. [289:36] We'll know how to create subnets and [289:39] route tables or configure routing inside [289:42] a VPC. [289:43] We'll also know how to connect a virtual [289:46] private cloud or a virtual data center [289:49] that you build in the cloud to the [289:51] internet. And then you can launch [289:53] applications or websites and it will be [289:55] accessible from the internet. [289:58] We will learn what is the difference [290:01] between a public subnet and a private [290:03] subnet from the AWS viewpoint. [290:06] We learned before about public IPs and [290:08] private IPs. Now, we are going to learn [290:10] about how to apply that into the AWS [290:13] cloud inside your virtual data center. [290:17] We will learn how the address [290:19] translation happens. So, we're going to [290:21] discuss network address translation as [290:24] well. [290:25] We also we are going to learn more about [290:27] the IP packet headers and that would be [290:31] a lot of topics that we are going to [290:33] look at. The most beautiful thing is [290:35] it's not going to be designing an IP [290:37] scheme on a piece of paper. We are going [290:40] to go on the AWS cloud and we are going [290:43] to implement that and you are going to [290:44] build your own virtual data center in [290:47] the AWS cloud by the end of this module. [290:49] All right? So, hopefully that makes you [290:51] excited and let's go ahead and get [290:53] straight into it. Okay, so IP routing. [290:56] How does IP routing work? Very important [290:59] to understand. From what we have learned [291:01] before, devices on a local area network, [291:04] if they need to communicate among [291:06] themselves, [291:08] and as long as they are in the same [291:10] VLAN, they don't need a router. [291:14] But if any device would like to [291:16] communicate externally with other sites [291:19] that don't belong to the same IP [291:22] network, [291:23] they have to use a router for that. Only [291:26] routers are capable of [291:30] forwarding traffic between networks. [291:32] Also, we learned that if we had two [291:34] VLANs, red VLAN and a blue VLAN for [291:38] instance, and we would like to route [291:40] between them, so in that case also I [291:42] need to have a router that connects [291:45] between them. It will have one leg in [291:47] the red VLAN, one leg in the blue VLAN, [291:50] and that router will route between them. [291:54] If the switch has a router or a router [291:57] functionality, if it is an intelligent [291:58] switch, sometimes they call it a [292:00] multi-layer switch, so the intelligent [292:02] switch will have a built-in router [292:05] and it can do that internally. But [292:08] anyways, going from one subnet to [292:11] another subnet, if they are in the same [292:14] LAN but on different networks or if it [292:18] is from a local network to a remote [292:20] network through wide area network, there [292:22] has to be a router used. [292:24] There is no way around this. All right? [292:28] When one device tries to talk to a [292:29] different network or subnet, it can't go [292:32] there on its own, it needs a router. And [292:35] the routing is done or the routing is [292:37] done by devices called routers. All [292:39] right. [292:41] Routing is the process of selecting [292:45] paths inside a network to forward [292:47] traffic between hosts. So, if this [292:51] camera is trying to send a video footage [292:55] to be saved somewhere in storage in the [292:57] data center, for example, then it has to [293:00] forward that traffic to the router [293:02] because now it's going outside the LAN, [293:05] it will cross a subnet in the LAN and [293:08] another subnet to get here until it [293:11] makes it to the storage. So, it will [293:13] cross multiple subnets, so it needs a [293:16] routing decision to be made here. What [293:18] is the best path to forward this? [293:21] When it gets to this router, this router [293:23] can send it in or can send it to the [293:25] internet. How would it decide? Based on [293:27] the routing, it will send it inside to [293:30] the data center because it knows [293:32] that the storage IP address is [293:35] towards the data center switch. [293:38] The data center switch will know where [293:40] to send it and it will send it in. So, I [293:42] have a routing done here, routing done [293:44] here and a routing done here. Each one [293:46] of them will do [293:48] a a decision or will will make a [293:51] decision based on its knowledge of where [293:54] that destination could be and the best [293:56] path to get to that destination. [293:58] In order to do that decision, the [294:00] routers will use what we call routing [294:02] tables. Sometimes they are called [294:04] forwarding database, forwarding tables, [294:07] and algorithms [294:09] in order to determine the most efficient [294:11] path to forward traffic. [294:14] So, if it has if the router has multiple [294:17] ways to get to the data center on the [294:19] other side, then which one to use? Then [294:21] there has to be an algorithm that will [294:23] enable the router to find the best path. [294:25] When thinking about the routing tables [294:29] or the forwarding database, the best [294:31] analogy is think as if we are now [294:34] configuring a GPS [294:36] on the router to define directions to [294:39] destinations. So, the routing table is [294:41] exactly like a map or a GPS on the [294:44] router. [294:47] Each router needs to build a routing [294:49] table or a database of known [294:51] destinations and how to reach them. [294:55] When a router receives an IP packet, it [294:57] will follow the process below. Based on [294:59] the existing routing table or the [295:01] forwarding database on the router, [295:05] when the packet is received into one of [295:07] the router ports, one of the router [295:09] interface, let's say this one is [295:10] connected to a switch. [295:13] All right? And then we have a PC on the [295:15] switch or a laptop that is trying to [295:18] send something outside the network, so [295:20] it gets to the router. [295:21] So, that message is called a packet. [295:24] That message from the laptop to the [295:26] router, each one is called a packet. So, [295:28] packet is received. [295:29] The router will receive the packet. It [295:31] will check who is the sender and where [295:34] is the destination. [295:36] Now, it would look at the destination [295:38] and then check the GPS, check the [295:40] routing table that it has. [295:42] Do I know where that destination is? If [295:45] the answer is yes, [295:48] then [295:49] where should I forward it? And then it [295:51] will send it to the IP address or the [295:54] interface. [295:55] So, here for example, destination [295:57] 10.0.0.0/24, [296:00] if you want to get to it, send it to the [296:02] IP address 100.2.1.1, [296:05] which is a connected router or a [296:07] connected network. [296:11] If you don't know where it is, then [296:13] by all means, drop it. Don't guess. The [296:16] router will never guess. [296:18] If it knows how to get to the [296:19] destination, it will send it towards the [296:22] destination. If it doesn't, it will just [296:24] drop it. And that's it. And you will not [296:26] get an error telling you that I have [296:27] dropped it because of such and such. [296:29] You will be waiting on your browser [296:31] trying to get to that website that is [296:34] hosted and things are not working [296:36] because you haven't configured your [296:37] router properly. [296:42] Routing tables, who's going to be [296:44] building them? Who is responsible to [296:46] populate that database or the GPS? Who [296:49] is responsible to put the data inside [296:51] it? [296:52] So, the routing table or the following [296:54] database can be configured manually and [296:56] this is called static routing. [296:59] If your infrastructure is simple, small, [297:02] you can do static routing and that means [297:05] you are configuring the routing manually [297:07] and you are building the router database [297:09] manually. [297:11] That is an option when you are talking [297:12] about a small scale infrastructure. And [297:15] we are going to do manual [297:17] configurations, by the way, in our demos [297:20] in AWS. [297:22] If it is larger than that, I have two [297:24] routers. [297:26] All right? And let's say this router [297:28] knows about other five route or three [297:31] routers. And this one knows about [297:34] another four routers. [297:36] And each one of these routers knows [297:38] about multiple routers. I have so many [297:41] networks now. I mean, this could be like [297:42] a mini internet. [297:44] It doesn't make sense to go ahead and [297:47] build the information in each one of [297:49] these routers to let it know the [297:52] possible destinations and how to get to [297:55] them. It doesn't make sense. You will [297:56] not be able to maintain it from an [297:58] operational perspective, it will be a [297:59] nightmare. [298:01] And also it will be prone to mistakes. [298:02] So, what do we do then? [298:04] There is something called routing [298:06] protocols, dynamic routing protocols. [298:09] For example, Border Gateway Protocol is [298:12] the dynamic routing protocol used on the [298:14] internet. Any routers on the internet, [298:16] they communicate especially the big [298:19] ones, the backbone ones, they they [298:20] communicate using BGP because the [298:23] internet table size could be in the [298:26] multiple gigabytes if not more than [298:28] that. [298:30] So, what do they do? We enable BGP here, [298:32] we enable BGP here, we enable BGP on the [298:34] routers, and then the routers, each one [298:37] of them will start to share the networks [298:40] that it knows about with all the [298:41] neighbors. [298:43] So, this will will also share the [298:45] information and that's how they start to [298:47] populate their GPS, the routing [298:49] database, the routing table, their [298:51] forwarding database dynamically. Either [298:53] way, a router must have a forwarding [298:56] database, an accurate one, either manual [298:59] or dynamic in order to be able to [299:01] forward traffic properly. The router [299:03] does not come pre-configured with a [299:05] route table. [299:07] The router comes from the manufacturer [299:10] and then you place it in your [299:11] infrastructure and you have to configure [299:13] it and customize it according to your [299:15] infrastructure needs. So, this is [299:17] something that you will need to do. [299:19] So, it requires dynamic routing [299:20] protocols to be configured. Open [299:22] shortest path first is an example and [299:24] Border Gateway Protocol is another [299:26] example. When you work with AWS, you [299:29] will need to know about BGP if you'd [299:32] like to scale connectivity and configure [299:35] wide area network and enable dynamic [299:37] routing protocols and all that. But you [299:39] can live with a static if that is [299:42] sufficient. [299:44] All right. So, the routing table will be [299:46] populated either dynamically or [299:48] statically, manually. [299:50] And then the flowchart or the [299:53] decision-making process will work. [299:55] Okay, there is a concept called default [299:58] route or default [snorts] route. What is [300:00] that? [300:02] In the previous examples, we looked at [300:05] this [300:06] forwarding table and the decision was [300:10] either I know where the destination is [300:12] so I can forward it. That's the router [300:15] decision based on its forwarding table [300:18] or route table. And if it doesn't know, [300:20] it will drop it. This is not practical. [300:24] Let me tell you why. [300:26] Let's say for example, this router is [300:28] the one connected to the big eye, to the [300:31] internet. [300:34] And this is the LAN that will send the [300:37] traffic or maybe the wireless LAN in [300:39] your office that is connected to the [300:41] router. [300:42] And then the router has this table. [300:46] And based on that, it will forward to [300:48] the internet. [300:49] So, when it receives your message, it [300:51] will look at where it is supposed to go [300:54] and then will check if it has an entry [300:56] for that destination [300:58] and then it will send it out. But this [301:00] is not practical. [301:02] On the internet, we have millions and [301:05] millions and millions of networks and [301:07] websites. Who is going to configure all [301:10] of this here? I mean, it's my home [301:12] office. [301:13] I'm not going to run BGP as the dynamic [301:17] routing protocol in my small router [301:19] because it doesn't support it. It cannot [301:20] process it. It cannot maintain the full [301:23] internet table that requires gigs and [301:25] gigs and gigs of storage on the router. [301:28] So, this mini router cannot store it, [301:30] the wireless router. [301:33] And at the same time, I'm not going to [301:35] go on the [301:38] router and start configuring the 10 [301:41] million websites that I may [301:44] reach out to or try to connect to [301:47] throughout my life. [301:48] Nobody does that. [301:49] So, what's the alternative to avoid [301:51] having to fill manually a large routing [301:54] table and even if you try, you will not [301:57] be able to make it because there are [301:58] millions and millions of networks. [302:01] And if you want to run that dynamically, [302:05] the router does not support the dynamic [302:07] routing protocols. And even your ISP [302:10] will not provide you any BGP information [302:12] because you are just a home user. [302:15] They would do that if they are [302:16] connecting to a university, if they are [302:18] connecting to a corporate like IBM or [302:20] one of the big companies, they would [302:22] give you the full internet table. [302:24] But for you as a home user, of course [302:26] not and your router cannot support it. [302:29] Way out of this is we use something [302:32] called the default route and we are [302:34] going to stretch the flowchart a little [302:37] bit. [302:40] A default route is basically to tell the [302:42] router, if you don't have a specific [302:44] entry for this destination, please send [302:47] it this way. [302:48] So, it defines a path to the router in [302:51] case if it doesn't have an explicit [302:53] entry in its route table for a specific [302:56] destination, how to deal with it. Don't [302:58] drop it, please do this instead. [303:01] So, the default route is a special route [303:03] table entry that can be used as a last [303:06] resort, a last choice to forward a [303:09] packet [303:10] only if only if there is no other [303:13] specific entry in the route table to be [303:16] used. [303:17] So, this is like your plan B. If you [303:19] can't find a matching entry in the route [303:22] table, please go for plan B and use this [303:24] path. [303:26] So, how would that look like? So, in a [303:29] route table, there will be an entry like [303:31] this and sometimes it's written as /0. [303:34] And that means to the router, [303:37] here are the specific entries. If you [303:39] get anything going to an IP address [303:41] within this range, please use this [303:43] entry. [303:45] If you have anything headed into this [303:48] range as a destination, then use this [303:50] entry. [303:52] If you get a destination IP address in a [303:54] packet, so it is going to an IP address [303:57] that does not belong here and does not [303:59] belong here, do not drop it. [304:02] Instead, forward it to this IP address. [304:07] And the flowchart would be, a packet is [304:09] now received. [304:11] Is the destination known through a [304:12] specific entry? If yes, go ahead and [304:15] forward it according to the entry. [304:17] If no, do not drop it. [304:20] Is there a default route, a gateway of [304:22] last resort in the table? [304:25] If the answer is no, then go ahead and [304:27] drop it. There is nothing you can do. [304:29] But if yes, then please forward it [304:31] according to the details in the entry. [304:34] So, this is very important and it helps [304:37] save effort and minimize the size of the [304:39] route table immensely. [304:42] In your home office, you have your own [304:44] local network that doesn't need the [304:46] router. But then, if you would like to [304:48] go to the internet, [304:51] then the router should send it to the [304:53] ISP through the link and the ISP should [304:55] deal with it, right? So, you have only [304:57] way out to any destination. So, in that [305:00] case, on that router, it's enough to [305:01] have only the default route. [305:04] 0.0.0.0, [305:05] send it on this interface to the ISP and [305:08] let them deal with it. [305:09] Hopefully this is understood. We are [305:11] going to look at an example of how we [305:13] populate that and we include the default [305:15] routes as well in order to cement the [305:18] knowledge and clarify any ambiguities. [305:26] Let's have a look at an example, a [305:28] practice on how routers should be [305:31] configured and we'll assume we are going [305:33] to do that manually. [305:34] How we can configure that or what [305:36] information we need to prepare in order [305:38] to configure on the router when given [305:40] access to that route. [305:44] So, have we have this example. We have a [305:46] local area network somewhere. [305:48] And then we have a data center [305:51] remote, it's not nearby. [305:53] And we have already installed router A [305:56] and router B [305:59] in the LAN side and in the data center [306:01] side respectively. And we also work with [306:04] the telco provider to have a wide area [306:07] network connection between the two. [306:10] So, this router, router B, has now a WAN [306:14] connection [306:15] to router A and has an internet [306:18] connection here. [306:20] Also, [306:22] we have here [306:24] a subnet configured, routing subnet [306:27] configured between the data center [306:29] switch, the intelligent switch and the [306:32] router. [306:33] And this is going to be the [306:35] 10.0.255.0/30 [306:40] subnet. [306:41] Has four usable IP addresses. .1 is on [306:44] the switch [306:45] and .2 is on the router. [306:48] So, this is the IP here and this is the [306:51] IP here. All right. [306:54] The cider block on this side is [306:56] 10.0.0.0/16 [306:58] out of which we are cutting subnets. [307:01] So, we're going to provide the [307:02] application segment, the subnet [307:04] 10.0.2.0/24. [307:07] And the database is going to be [307:08] 10.0.1.0/24. [307:12] And you have this subnet as well. [307:14] All right. [307:16] For the WAN side, [307:18] we have worked with the telco provider [307:19] to use the subnet 172.18.0.0/30. [307:23] .1 is on router A, so this is the IP [307:26] address right here. [307:28] And two is the IP address right here. [307:32] On the LAN side, the cider block is [307:35] completely different. So, this is [307:37] 172.18, this is 10.0, and this is [307:40] 192.168. [307:43] The 192.168, [307:44] we are going to allocate one to the [307:46] router and other IPs for the other [307:49] devices. [307:50] So, what's needed now? [307:51] We need to prepare [307:54] the routing table. [307:56] We need to include all the required [307:58] details on router A and on router B. [308:02] And that should include all local [308:05] routing within the data center, [308:08] from the data center to the LAN, from [308:10] the LAN to the data center, within the [308:13] LAN, [308:14] and from the LAN to the internet, and [308:16] from the data center to the internet. Oh [308:18] my goodness. [308:20] How can I prepare all of this [308:21] information? Looks tricky. [308:23] It's not. [308:25] So, let's look at the router A side [308:27] first. [308:30] What do we need to configure on router [308:32] A? What does router A need to do? What [308:35] are the possible destinations that it [308:37] will have to forward traffic to? This is [308:39] exactly what we need to configure in its [308:42] routing table. [308:44] So, router A knows about the local area [308:46] network, right? So, this is number one. [308:50] It also knows about the wide area [308:52] network. [308:55] And it should know how to get to the [308:58] data center. [309:01] Also, it is required that we need to [309:03] know through the router how we can get [309:05] to the big eye, to the internet. So, let [309:07] me just write it as an eye here. [309:10] So, here we have four entries, or four [309:13] decisions, or four possible destinations [309:16] from the local area network [309:19] to the outside, or from the outside to [309:22] the local area network. [309:24] So, how do we define that on the routing [309:27] table? [309:28] The routing table usually have at least [309:30] two entries. One is to define which [309:33] destination [309:34] and how to deal with it. Where to send [309:36] it next? Next hop means what is my [309:38] target to get to that destination, or [309:40] what's my next hop? What's the next [309:42] device, or next IP address uh that I [309:46] should send it to in order to get closer [309:49] to the destination? [309:51] So, first of all, let's do number one. [309:53] It knows about the local LAN. [309:55] Through what? Through the LAN interface. [309:57] So, the interface which is configured [309:59] here, and it's on the switch. [310:02] This interface, depending on the router [310:04] type and model and all that, will have a [310:05] name. Could be LAN zero, it could be [310:07] gigabit ethernet zero, it could be [310:09] gigabit ethernet zero {slash} one [310:11] {slash} two. Whatever the name is, this [310:14] is irrelevant now. [310:15] The LAN interface is how the router A [310:18] can get to the LAN. Is that right? Yes. [310:22] So, 192.168.1.0 [310:24] {slash} 24, which is the LAN IP address [310:27] range, [310:28] and that is reachable through the local [310:30] area interface [310:32] on the router. [310:34] All right. So, that's number one. Number [310:36] two, 172.18.0.0 [310:39] {slash} 30. How can the router A get to [310:42] this [310:43] subnet? [310:45] This is through the local WAN interface. [310:49] And this will also have a name. It could [310:51] be also gigabit ethernet, it could be [310:52] something else. Whatever the name is, [310:54] you can get to it through this [310:56] interface. [310:57] All right. So, these are the local [310:59] networks that it's directly connected. [311:00] How about getting to the data center, [311:03] and how about getting to the internet? [311:07] So, getting to the data center, [311:09] that has to go through the wide area [311:11] network to router B, right? [311:13] So, my target, my enabler, my helper to [311:16] get to 10.0 has to be router B. [311:20] How can I talk about router B here? I [311:22] know its IP address on a shared subnet. [311:26] I have one and [311:28] the router has two. [311:31] So, to get to this network, I need to go [311:32] through 172.18.0.2, [311:34] which is router B interface. [311:37] How about if I want to go to cnn.com, or [311:40] dolphinedacademy.com? [311:41] How am I going to do that? How can I get [311:43] to it? [311:44] Again, through the WAN, through router [311:46] B, because we don't have a direct [311:48] connection to the internet from the LAN. [311:51] So, we have to hop through the wide area [311:53] network to router B, and then we can go [311:55] to the internet, right? [311:57] So, how can I write that? The internet [311:59] has so many websites and so many IP [312:02] addresses, and I'm not going to list all [312:04] of them. [312:05] Then we can take advantage of the [312:07] default route. [312:09] And I can tell the router, "Hey, if [312:11] there's anything else other than the [312:14] ones specified, [312:16] any other destination other than the [312:18] ones specified, please send it to [312:22] same thing, to router B." [312:25] So, now we have everything identified on [312:28] router A side based on the requirements [312:30] we have right now. [312:33] All right. [312:35] Let's go ahead to the other side, to [312:36] router B. [312:38] So, in router B, what do I need to [312:40] define? I need to define this subnet, [312:45] which is between the data center switch [312:47] and the router. That's number one. [312:50] I need to define the local [312:52] area range [312:54] in the data center, the 10.0.0.0 {slash} [312:56] 16, which is behind the data center [312:59] switch. So, I have to come through the [313:01] data center switch in order to reach any [313:03] one of these subnets. [313:04] That's number two. So, number two is the [313:07] range, or let's let's me just write it [313:09] here. Number two. [313:11] Number three, I can get to the internet, [313:14] to the big eye. [313:17] Through router B, through this [313:19] interface. [313:20] And let's assume that the opposite [313:22] router interface in the ISP, so this is [313:25] one. Let's assume that it is also [313:28] 122.54.2 [313:30] on the other side. [313:33] What else? The WAN connection, the WAN [313:36] interface. I know about this subnet, [313:38] right? How? Through this. So, this is [313:41] number four. [313:42] So, we have [313:45] So, this is three, number four. And [313:47] also, I need to respond to any requests [313:49] coming from the local area network. So, [313:51] this is number five. So, I need to [313:53] define all of these here. So, we'll have [313:55] five entries, not four. [313:56] Let's do it one by one. How can I get [313:59] into the 10.0.0.0 {slash} 16, which is [314:02] this cider range? [314:04] I can get to it through the data center [314:06] switch IP address that shares with me a [314:09] subnet. [314:11] So, I can get to it through 10.0.255.1. [314:16] All right. How can I know about the [314:18] 10.0.255.0 [314:20] subnet {slash} 30, which includes one [314:22] and two? [314:24] Well, that is directly connected through [314:26] my LAN interface. [314:29] How can I get to the 172.18.0.0 [314:32] {slash} 30? That's easy. That's through [314:34] my WAN interface. [314:36] How can I get to the other side, to the [314:38] LAN? Oh, okay. In that case, if you [314:41] would like to get to the LAN, [314:43] then I have to go through my colleague [314:45] router A. And by the way, I share with [314:47] router A a subnet, and he is one, or it [314:51] is one on that subnet. [314:54] How can I get to the internet? Okay. [314:56] Anything else [314:57] not explicitly defined, then I can get [315:01] to it through 122.54.2, [315:05] which is the IP address we assumed that [315:06] it is on the router at the ISP [315:08] connecting to our router. [315:11] So, this needs to be configured manually [315:13] on the two routers. And here, manually [315:15] is enough because it's a small network. [315:18] Or maybe I will enable BGP configuration [315:22] between the two routers and just enable [315:24] that, or OSPF, or any dynamic routing [315:25] protocol. Either way, this is the [315:28] minimum that I need to see on router A, [315:30] and this is the minimum that I need to [315:32] see on router B. All right? Hopefully, [315:34] this is clear, and it clarifies how do [315:37] routers take decisions. [315:39] So, in this case, if there is anything [315:41] unknown destination on router A, [315:44] when the traffic comes from the LAN, it [315:46] will be sent to router B. Router B, [315:48] please deal with it. [315:50] If it gets to router B, and if it is not [315:52] part of these entries, then it will say, [315:54] "Okay, this is the right entry to use [315:56] the default route, and I'm going to send [315:58] it to the internet, and let the ISP deal [316:00] with it." So, we have two default [316:02] routes, one in each routing table, and [316:04] the use is clear. [316:08] Let's talk about what an IP packet is. [316:11] Let's get deeper into an IP packet, and [316:14] understand what information does it [316:16] carry with it. In order to understand [316:19] that, the message in IP networks, or [316:22] networks that use TCP IP, [316:25] is called a packet. [316:27] So, let's take a step back and do an [316:29] analogy first. [316:31] If [316:32] John Smith, who lives in 32 University [316:35] Street in Boston, Massachusetts, in this [316:37] zip code in the US, [316:40] would like to send a mail through an [316:43] envelope and a stamp, like a legacy [316:45] mail, [316:46] to Sarah, who lives in this address in [316:49] Egypt. What would John do? John would [316:52] write [316:53] on the envelope, of course, after a [316:55] stamp is [316:56] used, [316:58] John will say, "From my name, my [317:01] address," as John, "and it's going to" [317:04] and the details for Sarah. And that's [317:06] how [317:07] it gets correctly to the right address, [317:09] through United States Postal Service, [317:11] and then through the Egyptian Post. [317:14] The response will be the other way [317:15] around. [317:17] It will be from Sarah, going to John [317:19] Smith, and this will allow it to be [317:21] delivered properly. [317:23] So, this is in [317:25] postal systems. [317:27] Now, what about in networks? [317:29] So, the IP packet is like a sealed [317:31] envelope as well, carrying the digital [317:33] mail or the digital message from one [317:36] end to another, one computer to another. [317:40] So, if I have [317:42] a user [317:44] connecting to the internet, the user's [317:46] IP address or the user's home router [317:50] public IP address is [317:52] 100.2.55.3. [317:55] It is not 10. [317:57] And it is not 172.16.31 [318:00] and it's not 192.168. [318:02] So, this is a public IP address and this [318:05] is not a private IP address. [318:07] So, whether it is on the home wireless [318:09] router or on on the user's phone and the [318:12] user is connected to data [318:15] to the internet, [318:17] the user would like to get to a website [318:18] and the website IP address or the server [318:21] IP address is 205.111.37.86. [318:24] Again, this is a public IP address. [318:28] Of course, I'm not allowed to use this [318:30] these IP addresses because they must [318:32] have been assigned somewhere on the [318:33] internet. [318:34] But, I'm just showing you an example of [318:37] what might be a public IP address just [318:39] for the use case. All right? So, I have [318:41] no right to use these IP addresses in [318:44] any network that I build because these [318:46] are public IP addresses and they have to [318:48] be allocated [318:50] according to the registry, to the [318:51] hierarchy of the public IP address [318:55] control system organization or [318:58] organization across the globe. What am I [319:00] trying to get to? [319:01] Comparing from the postal office [319:03] example, what if we need to send a [319:05] digital message from this IP to this IP? [319:08] What happens? [319:09] Then an IP packet has to be created and [319:13] the IP address of the source must be [319:15] included as a from [319:18] field and then the destination or two [319:21] field will carry the destination IP [319:23] address. [319:24] So, it will look something like this. [319:26] I'm just trying to show it as an [319:28] envelope. It's not an envelope. [319:31] So, it has to show the source, where it [319:33] came from, which is this IP address. [319:36] And it has to show the two or the [319:38] destination address, which is the other [319:40] side's address. [319:42] And since both are public, that means [319:44] the internet will be able [319:45] router by router to carry that message [319:48] until it gets to the server. [319:50] Great. [319:51] What about the response? The response, [319:53] like in the postal and mail system, it's [319:56] going to be reversed. [319:57] So, now it's going to be a message from [319:59] this as the source [320:02] to this as the destination. And that's [320:04] why it will be shifted the other way [320:06] around. So, the from is now the server [320:09] going back to the user. [320:12] So, it's exactly the same. Well, this is [320:15] source IP and and the destination IP. [320:18] This is not the message. The message is [320:21] inside the envelope and we call it the [320:23] payload [320:24] or the data within the message. So, what [320:26] is this then? These are like the stamp [320:29] and the envelope. At the end, when I [320:32] receive the message, I'm going to [320:33] discard the envelope. I don't need it. [320:35] It's not anything [320:37] that I need except for John's address or [320:40] the other party's address. And as soon [320:42] as I write the new envelope, I can [320:44] discard the old one. [320:48] So, these are called headers. The IP [320:50] packet includes the actual message data [320:52] being sent and which is called the [320:54] payload inside the the envelope. [320:58] And the IP packet also includes the IP [321:00] addresses and other details and these [321:02] are called the headers. So, the message [321:03] sent is not only the data you want to [321:05] send, but also other required [321:08] information in order for the message to [321:10] be delivered properly. These are called [321:12] headers. [321:15] So, when you hear the term headers, [321:18] please know that we are talking now [321:19] about IP addresses and other details [321:22] necessary in order to deliver the [321:24] message from node A or host A to host B [321:28] on an IP network. All right? [321:33] Since we are going to apply all our [321:35] hands-on in the AWS cloud, let's find [321:38] out what is the AWS global [321:40] infrastructure and what does it consist [321:42] of. [321:45] The AWS cloud globally [321:48] consists of a number of what they call [321:50] geographic regions. A region is an AWS [321:54] presence, a group of data centers that [321:57] are in one country. In some countries, [321:59] they have more than one region, like the [322:01] US for example, it has four regions. [322:04] And a lot of other countries, they have [322:06] only a single region. When the AWS [322:08] business grows in one country, they may [322:11] consider building other regions. [322:13] At the moment, they have 38 plus [322:16] geographic regions. How can you find out [322:18] the details about this? [322:20] You have this link, [322:22] aws.amazon.com/about/aws/global-infrastructure/regions-and-availability-zones. [322:27] And if we go to that link, as you can [322:29] see here, this one lists the up-to-date [322:31] information about the AWS regions. So, [322:33] this is 38 at the moment and 120 [322:37] availability zones. And you can go [322:39] continent by continent and then you will [322:41] be presented with this globe view that [322:44] will show you the regions in the area or [322:47] the country or the continent that you [322:49] have chosen. [322:50] All right. So, you can acquaint yourself [322:52] with this, play with it a little bit to [322:54] find out more information that is not [322:56] important to memorize because it only [322:59] shows that AWS globally has multiple [323:02] regions. [323:03] As we mentioned, [323:05] 38 plus geographic regions [323:08] and each region has three or more [323:10] availability zones. The availability [323:12] zone is one or more data centers [323:15] clustered together and interconnected [323:17] with very high-speed links. [323:19] The region may have three availability [323:22] zones and some regions has six regions [323:25] like the one in North Virginia. [323:28] We have 120 availability zones at the [323:31] moment and increasing. [323:34] And as I mentioned, the availability [323:36] zones in one region are interconnected [323:38] via high-speed links. So, region one for [323:40] example, availability zone one, two, [323:42] three and they have high-speed links [323:44] among them. [323:46] Same for region two, same for region N. [323:48] And now we need to understand what is [323:50] the availability zone. So, an [323:52] availability zone consists of one or [323:55] more interconnected data centers. [323:59] Like this. So, if we look at one of the [324:01] availability zones and zoom in into it, [324:04] you'll find that one or more data [324:06] centers, now we're talking about the [324:07] data centers that we know, [324:10] and they are interconnected with very [324:12] high-speed links. And these data [324:14] centers, they could be, [324:16] I don't know, 10 km, 20 km, 50 km away [324:19] from each other. And the point about [324:22] having more than one data center in an [324:24] availability zone and then more than one [324:26] availability zone in a region, the whole [324:29] point is high availability. [324:32] So, now if I create three virtual [324:34] machines in the same availability zone, [324:36] chances are they're going to be created [324:39] in different data centers. So, if one of [324:41] them gets busted, the other two will be [324:44] alive. [324:45] And that's why it's always recommended [324:47] when you create workloads, applications, [324:50] databases in AWS, it is recommended by [324:52] AWS to establish it in multiple [324:55] availability zones. [324:57] Not in a single availability zone. [324:59] If you do this, if you have your [325:01] workload or application or virtual [325:03] machines distributed across more than [325:06] one availability zone, then in the eyes [325:08] of AWS, you are highly available. Your [325:11] workload is highly available. All right. [325:13] So, that's enough about the AWS global [325:15] infrastructure. Next, we're going to [325:16] introduce what is an AWS VPC, the [325:19] virtual private cloud in an AWS region. [325:26] So, let's now go ahead and discuss what [325:28] is an AWS VPC, a virtual private cloud. [325:30] That is your virtual data center that [325:33] you can create in a minute in cloud [325:36] computing or in a AWS cloud to be more [325:38] specific. [325:42] So, a virtual private cloud, [325:45] building your own isolated virtual data [325:48] center in the cloud. [325:49] So, the VPC is a virtual data center in [325:52] the cloud, which is isolated from other [325:54] VPCs by default. [325:57] The VPC client or the customer who owns [326:01] the VPC, who created the VPC, has full [326:04] control over the VPC or the VPCs. You [326:07] can create more than one if you want. [326:09] And a VPC is confined to a single AWS [326:12] region. You will never see a VPC [326:15] stretching between two regions. It's [326:17] either in region A or B or C, [326:20] but it's not going to be half in here [326:22] and the other half in another region. [326:28] A default VPC is created automatically [326:31] in each AWS region when an AWS account [326:34] is created. [326:37] And the VPC [326:39] spans all the availability zones in a [326:42] region. What does that mean? What does [326:44] it mean when I say that a VPC stretches [326:46] across availability zone? That means [326:48] in that VPC or virtual data center, you [326:51] can have virtual machines and workloads. [326:54] We call the applications and the data [326:56] that you add and all that a workload or [326:58] an application or a database, whatever [327:00] that is, [327:01] you can host it in any of the [327:03] availability zones in that region. As if [327:05] we are saying [327:07] that you can control where in the region [327:10] to place your workload inside the VPC. [327:13] It's up to you. You can have a virtual [327:16] machine for application A in [327:18] availability zone A and in availability [327:21] zone two or B and in availability zone [327:23] C. [327:24] You can have databases in availability [327:26] zone A only. [327:28] That's up to you. You can have [327:31] some security virtual machines also [327:34] available in availability zone two and [327:36] three only but not in one. It's up to [327:39] you. [327:40] Creating a VPC means you have the [327:42] permission to create a workload a [327:45] virtual machine anywhere in the region [327:47] in any of the availability zones. [327:50] Why is that an advantage? Because it [327:52] allows you to have more availability of [327:55] your applications. I can now have them [327:58] or have my e-commerce website in two [328:01] availability zones in the region. If one [328:03] gets busted for whatever reason, I have [328:05] the other one. And remember, we [328:06] mentioned that the availability zones [328:08] are far away from each other and each [328:10] availability zone is a cluster of one or [328:13] more data centers [328:15] interconnected with very high speed. The [328:17] availability zones themselves are also [328:19] interconnected with very high speed. So, [328:22] hosting your application or data or [328:25] website in more than one availability [328:27] zone gives you an advantage of being [328:30] more available and the uptime will be [328:32] higher and your customers are going to [328:35] be happier. [328:38] So, what are the components of a VPC? [328:40] When I build a virtual data center that [328:43] takes me a minute or less as you will [328:44] see. [328:45] What are the components that I can [328:48] create in a VPC? [328:49] First of all, you can't have a VPC [328:51] without a CIDR block. There has to be an [328:53] IP address block of which you can divide [328:57] subnets [328:59] for the VPC. [329:00] And there is a router configured [329:03] automatically [329:04] and it connects to all the subnets that [329:07] you create it within a VPC and it [329:09] guarantees that they can all talk to [329:11] each other. [329:13] Then you have the route tables which [329:15] will tell the implied router for each [329:17] subnet what to do with the traffic [329:18] coming into the subnet or going out of [329:20] the subnet. We're going to discuss that [329:21] in detail. [329:23] If the VPC needs to connect to the [329:25] internet, that only happens through the [329:27] internet gateway or abbreviated the IGW. [329:31] Now, for security, we are going to [329:33] discuss that in subsequent modules. We [329:35] have security groups and network access [329:37] control lists which are virtual [329:39] firewalls, but we'll discuss them when [329:41] we get to them. [329:44] So, let's start with a CIDR block. [329:48] You cannot have a VPC without a CIDR [329:51] block. It's all IP communication inside [329:53] the VPC, so there has to be an IP [329:55] address range. [329:58] And the VPC subnets are created from [330:00] that [330:01] CIDR block. So, that's the extra large [330:03] pizza out of which you can break down [330:05] slices which are going to be your [330:07] subnets. [330:09] And the CIDR block size can be anywhere [330:12] from as small as /28 [330:15] to as big as /16. So, this one gives you [330:19] a total hosts of 65,000 plus [330:24] and this one gives you only 16 hosts. Of [330:27] course, this is not something that you [330:29] would want to do unless if you are [330:31] testing something for 5 minutes, 10 [330:32] minutes, half an hour and then you will [330:34] switch it off. [330:35] Default size for CIDR blocks in AWS are [330:39] /16. Can I have /15, /14? No, that's not [330:43] allowed. All right. So, the VPC [330:45] stretches across all availability zones [330:47] in one region and the VPC is confined [330:50] within one region, cannot stretch beyond [330:52] the region and I can have one or more [330:55] CIDR blocks actually, but at least one [330:57] and the subnets [331:00] are chunks out of that CIDR block and [331:03] they can be in different availability [331:05] zones. [331:09] Let's now discuss subnets and route [331:11] tables as far as a VPC goes. [331:15] So, let's start with subnets. [331:18] We can configure multiple subnets per [331:21] VPC. [331:22] As big as your original size block of IP [331:26] addresses, the CIDR block, you can [331:28] create as many subnets as you want. [331:33] So, I can have one subnet in [331:36] availability zone one, one subnet in [331:38] availability zone two, and I can have [331:40] more than one subnet per availability [331:41] zone if I want. [331:44] As we mentioned that the VPC is confined [331:46] within a region, cannot stretch beyond a [331:48] region boundary [331:50] similarly, a subnet cannot stretch [331:53] outside of an availability zone. So, the [331:56] subnet and all its hosts must be within [331:59] the same availability zone. [332:02] So, the VPC is confined to a region, the [332:04] subnet is confined to an an availability [332:05] zone. So, can I configure a virtual [332:08] machine here and assign an IP address on [332:10] sub- subnet one in availability zone [332:12] two? The answer is no. [332:14] If subnet one is in availability zone [332:16] one, all the hosts in that subnet must [332:19] be in availability zone one as well. [332:22] Can I have more than one subnet per [332:24] availability zone? By all means, yes. [332:28] So, now we have the subnets, but we need [332:30] the implied router. You don't need to [332:32] configure it. It will be created [332:33] automatically and it will connect to [332:35] every single subnet that you created or [332:38] will create in the future in your VPC. [332:41] So, nothing needs to be done on that [332:44] implied router except for if you want, [332:47] create route tables. The implied router [332:50] will forward traffic among the subnets [332:52] in a VPC, but it also will have the [332:56] traffic or will help the traffic forward [332:58] the traffic that is going outside the [333:00] VPC [333:01] or traffic coming from the outside to [333:03] one of the subnets in the VPC. So, [333:05] basically, this is where traffic can [333:08] roam around within the VPC, go out or [333:12] traffic can be received through the [333:14] implied router. [333:18] Routing between subnets within a VPC is [333:20] enabled by default and you cannot [333:22] disable it. We are going to look at [333:23] that. [333:26] The implied router by default will have [333:28] one routing table and the routing table [333:30] would say all the subnets within the [333:33] CIDR block are local. I know how to get [333:36] to them all. [333:37] So, all the routing among the subnets is [333:39] enabled by default and you don't need to [333:41] do anything about it. [333:44] This router is fully managed by AWS. You [333:47] cannot access it. You cannot log into [333:49] the router and you cannot change [333:50] configuration in the router. All you can [333:52] do is you can play with the route tables [333:54] that are available to you. [334:00] Route tables as I mentioned, each VPC [334:03] has a default route table. It's called [334:04] the main route table. [334:06] That route table can be used by more [334:08] than one subnet at the same time. So, if [334:10] I decide to keep only one route table in [334:12] the VPC, all the subnets in the VPC are [334:15] going to use it. [334:17] The router can hold a separate route [334:20] table if required for each subnet. [334:24] So, I can have RT1, RT2, RT3. [334:27] Or you can have one route table and all [334:29] the subnets are going to use it, so the [334:31] router will use the same route table for [334:32] all the subnets. [334:34] Is that in your control? 100%. You can [334:36] create custom route tables as required [334:39] and you can assign them to the subnets [334:41] that you want and we are going to do [334:42] this. [334:45] The subnet can attach to only one route [334:48] table at a time. So, you can switch the [334:51] association of a route table from one [334:53] subnet to another. So, let's say this [334:55] subnet, now I have it with the green [334:58] route table. I can decide to switch it [335:00] to the gray route table or to the blue [335:02] route table. But at any given moment, it [335:05] will have only one one route table. That [335:07] means when traffic is going into the [335:09] router from the subnet [335:11] the router will consult the route table [335:14] for that subnet and find out how to [335:16] forward it. And we're going to do that [335:18] in the demo as well. [335:23] All right. So, how can we provide [335:25] internet access to the VPC? Through what [335:28] we call an internet gateway. So, the [335:30] internet gateway is how a VPC can [335:33] communicate with the internet. [335:35] So, I have a VPC with subnets and [335:37] implied router. I have to add [335:40] the internet gateway, otherwise the [335:42] subnet cannot get out to the internet. [335:45] And I can have only one internet gateway [335:48] per VPC. [335:49] So, it is fully managed service. You [335:51] cannot access it and log on to it and [335:53] there is only one that you can create [335:55] and attach to the VPC at a time. I can [335:57] remove it and attach another one, but [336:00] this is a fully managed, scalable, [336:02] highly available service from AWS. You [336:05] don't need to worry about that. [336:08] In order for a subnet to use the [336:10] internet gateway, its routing table must [336:13] have an entry pointing to the internet [336:15] gateway like this for example. Any IP [336:18] address not specifically listed in the [336:21] route table, please send it to the IGW. [336:23] So, now it's a good time for us to have [336:26] a look at all these components in the [336:28] AWS console. [336:33] So, now it's a good time to stop and [336:36] start to show you the different things [336:38] that we have discussed in a VPC. The [336:41] VPC, the subnets, how it stretches [336:43] across availability zones, the route [336:45] tables, the internet gateway. And the [336:48] best way to do this is to go ahead and [336:50] create [336:51] a custom VPC [336:53] and create subnets [336:55] and create the internet gateway, attach [336:58] it to the [336:59] uh VPC and look at how we can do all of [337:03] the stuff that we have talked about, how [337:05] we can create different route tables and [337:07] so on. [337:08] So, first we're going to do a [337:09] walk-through. I'm going to show you an [337:11] AWS VPC that is created by default by [337:13] AWS. [337:15] And this is true for anyone anywhere in [337:18] the world when you create an account in [337:20] AWS, they will voluntarily create a VPC [337:25] for you with the same specs in all the [337:28] enabled regions in your account. Usually [337:30] there are 16 or more regions. [337:33] So here is what we need to create. So [337:36] this is going to be a custom AWS VPC. A [337:38] custom one means that is [337:41] a VPC that we are going to decide how it [337:44] will look like. [337:46] So what do we need to do? We need to [337:47] create the VPC and the name of the VPC [337:49] is going to be custom_vpc. [337:53] As we mentioned before, a VPC must be [337:56] confined to a region. So here they are [337:59] requesting that we create it in Ohio in [338:01] US East 2. [338:04] This is the code name or the nickname of [338:07] that region. [338:09] We need to create four subnets in the [338:11] designated availability zones as shown [338:13] below. [338:17] So we are going to create subnet one [338:19] in US East 2A. US East 2 is the name of [338:24] the region and A is availability zone A. [338:29] The CIDR block provided for the VPC is [338:31] 172.31.0.0/16. [338:35] So we are going to use that as well. [338:38] Subnet one that we are going to create [338:40] in availability zone A in US East 2 is [338:44] going to have the block range or the IP [338:47] address range 172.31.0.0/20. [338:50] Please note that this is 20 and this is [338:52] 16, which means this is a subnet from [338:55] this block. [338:58] Then we are going to create subnet two [339:00] in availability zone B in the same [339:02] region and the IP address range for that [339:05] is going to be 172.31.16 [339:08] .0/20. [339:12] Subnet three and four are going to be [339:14] .32.0 [339:16] and .48.0 and both of them are /20 as [339:19] well. [339:23] Then we are going to create and [339:24] associate the route tables as shown. [339:27] So we have a route table one, [339:32] the green colored one, [339:34] and then the gray colored one is going [339:36] to be route table two, and then route [339:38] table three four, [339:40] which is the blue one. [339:42] Route table one will be associated with [339:44] subnet one. So subnet one must be [339:47] associated with route table one. [339:49] Subnet two will be associated with route [339:51] table two. Subnet three and four, both [339:54] of them at the same time, will be [339:56] associated with table three four. [339:57] Remember, [339:59] we mentioned that at any given time a [340:01] subnet can be associated with only one [340:03] route table, [340:04] but nothing stops me from [340:07] associating two subnets with the same [340:10] route table at the same time. [340:11] We are going to reference this again, [340:13] but let's go ahead and do the walk [340:14] through in the AWS console for the VPC. [340:17] We are going to look at a default [340:19] created one and then we are going to [340:21] move on and create our own. The AWS [340:23] management console and I'm in the VPC [340:26] dashboard. [340:28] So if I go to console, console home, [340:32] this is the page that you will see when [340:34] you log in to the AWS account that you [340:37] have. [340:38] Then I'm going to type VPC [340:41] and click on this. [340:44] So this is going to take me to the VPC [340:47] dashboard. Let me maximize that a little [340:49] bit. [340:50] And as you can see here, [340:52] you can select the region that you are [340:54] going to be in. So if you would like to [340:56] travel from North Virginia in the US [340:59] to Mumbai in India in 1 second, all you [341:02] need to do is to click here. [341:05] So you are now traveling faster than the [341:07] speed of light to India from the US. [341:11] Now, if you are done with what you are [341:12] doing here and you'd like to go to [341:13] Germany, why not? There are no airfare [341:16] tickets [341:19] and there is no time delays and there [341:21] are no airports involved. [341:23] And this is this is the beauty of the [341:25] cloud that you have a management [341:26] console, you have a portal, you have an [341:29] orchestration and management account [341:32] that can allow you to control your [341:34] infrastructure and deploy your [341:35] infrastructure across the globe from one [341:38] central location, from your office, [341:40] maybe with your pajamas, [341:42] and you can monitor all that centrally [341:44] as well. [341:46] All right. So Europe Frankfurt, let me [341:50] use one region that I think I have never [341:53] used before. So let's try Ireland for [341:56] example. This is a relatively new [341:58] account, [341:59] so I'm sure many of the regions I have [342:01] not used before. So this is the [342:03] navigation pane for all the VPC feature [342:06] and configurations and all that and here [342:07] you can see that we have VPCs, subnets, [342:10] route tables, internet gateways and so [342:12] on. [342:14] And here you have a summary of what you [342:16] currently have configured. [342:18] So VPCs I have one. I have never touched [342:23] this region before. So where did this [342:25] come from? This is the automatic VPC [342:27] that is created on your behalf when you [342:30] create the account and you get one in [342:32] every region. [342:36] Subnets, I have three subnets. [342:40] And again, [342:41] because Ireland has three availability [342:43] zones [342:44] and that's why it is showing three [342:47] subnets. If you click here on this side, [342:50] zones, [342:54] here you will find the availability [342:56] zones in each one of the regions. So for [342:58] example, [342:59] I am in Ireland, [343:02] this one, and it shows me that I have [343:04] three availability zones. If I click on [343:05] this, [343:06] it will tell me this is what I have. So [343:09] I have EU West 1 AZ1, EU West 1 AZ3, EU [343:14] West 1 AZ2. [343:17] And opt-in not required, so you are [343:19] already into that region. You don't need [343:21] to opt-in to use the region. It's [343:23] already enabled. [343:25] Okay, the one that has the most [343:28] availability zones is the North Virginia [343:30] one and as you can see it has six. Some [343:33] have four [343:34] and this one United States California [343:36] has two. This is the least I think among [343:39] all. [343:41] Yeah, it's the least. The rest as you [343:43] can see they have [343:45] So now I understand why I have three [343:48] subnets. This is because [343:50] I have three availability zones and what [343:52] AWS does is it creates the VPC by [343:55] default automatically and then it will [343:57] create for you one subnet in each of the [343:59] availability zones. So let's go ahead [344:01] and look at this [344:03] VPC. So what's the name of the VPC? [344:05] There is no given name. I can click here [344:08] and I can add a name if I want. So for [344:10] example, I'm going to call this default. [344:12] I didn't create it. [344:15] This is the VPC ID and this is a unique [344:18] ID allocated for each VPC when it is [344:21] created and this allocated by AWS. You [344:23] don't need to worry about it. [344:25] The VPC is available [344:27] and if we switch here, you will find [344:29] that this is the CIDR block [344:32] 172.31.0.0/16. [344:35] And if you click to the right, we have a [344:38] main routing table created by default. I [344:40] have network ACL [344:42] and here it shows you that this is a [344:44] default default VPC. And this is the [344:46] account [344:47] that I have. [344:50] So resource map, if you click on this, [344:54] it will show you that, let me just drag [344:56] this a little bit to the to the top. [345:00] I have the VPC and I have three subnets [345:04] and all three subnets are attached [345:06] attached to the same route table [345:08] and they are connected to the internet [345:10] gateway. So these subnets are [345:13] accessible from the internet and the [345:15] internet can access them. [345:17] But right now I don't have any virtual [345:19] machines or anything and that's why I [345:20] cannot access the internet and nothing [345:23] can access me as well because there is [345:25] nothing to connect to. There is nothing [345:27] to respond to queries or connections [345:30] coming from the internet. [345:33] All right, so this is the VPC. How about [345:35] the subnets? I can click on the subnets. [345:38] Let me also make that a little bit [345:39] bigger. [345:41] So I have three subnets as you can see [345:43] here and they all belong to the same [345:45] VPC. How do I know? VPC ID is the same [345:48] and the name that we assigned. [345:50] And here are the subnets that have been [345:53] provided. 172.31.0.0/20, [345:55] 16, 32 and so on. [345:58] And these are the usable IP addresses in [346:00] each subnet. You will find that there is [346:02] a discrepancy. [346:03] A /20 should give me 4,096 [346:08] IP addresses. [346:10] The first one is the network ID we [346:11] cannot use. The last one is the [346:13] broadcast ID we cannot use. So that [346:15] should have left me with 4,094. [346:19] The other three are reserved by AWS. So [346:22] the first IP address, not the network [346:24] ID, the one after that, the first usable [346:27] IP address and the second and third are [346:29] reserved by AWS. You cannot use them. So [346:31] you can start from the fourth if you [346:33] want. [346:35] And here it's showing that this is in [346:37] 1A, 1B and 1C. [346:40] And here it shows that all of them are [346:43] allocated to the same route table. [346:46] And I think this is the important [346:48] information about the route tables. All [346:51] right. What about the VPC itself? What's [346:53] the CIDR block of the VPC? The CIDR [346:55] block as we mentioned is here and the [346:57] subnets we have seen are carved from the [347:01] same CIDR block. [347:03] What if I move to, [347:05] let me see, Sydney, Australia. [347:13] So, as you can see here, if you click [347:16] Sydney, this is AP Southeast 2. [347:19] This is [347:20] the code for it, and this is the name of [347:23] the region. [347:24] I have a different VPC ID, [347:28] a different one, but the same range. [347:31] And if we scroll to the right, there you [347:34] have a main route table. It's a [347:35] different route table ID, [347:37] and it's the default, and it's in the [347:39] same account. [347:40] And if I do a resource map [347:43] to find out what resources we have in [347:45] this VPC, [347:51] let me drag this a little bit up. You [347:53] have the VPC, the new one, [347:56] and then I have three subnets [347:58] connected to one route table and [348:01] internet gateway. [348:02] So, as if AWS is creating the same VPC [348:05] configuration for you everywhere [348:08] in all the regions, one per region, but [348:11] if you are not happy with it, go ahead [348:12] and create whatever you like. [348:14] So, if you're not happy with this, you [348:16] can decide, "No, I don't like it. I'm [348:18] going to use something else. I'm going [348:20] to create something else." And that's [348:21] why there is an ability to create a VPC, [348:24] a custom VPC, basically. All right? So, [348:26] now let's check the route table. What [348:29] route tables do we have? So, we have [348:30] only one route table available. And if I [348:33] select it, I will know the configuration [348:35] in that route table. [348:37] So, here I have two routes. One is [348:39] saying that the destination [348:42] here, as you can see, the destination [348:43] 172.31.0.0/16 [348:47] local. Local means what? [348:49] That means the implied router who holds [348:52] this route table knows about anything [348:55] within this range. [348:58] Now, what if I need to get to the [348:59] internet? Internet is anything else. As [349:01] we mentioned before, there is no way [349:03] anyone would set and write the millions [349:05] and millions of internet IP ranges in a [349:09] route table. This is the default route, [349:11] which is saying anything else not [349:14] belonging to any of the entries that are [349:17] explicitly configured, please forward it [349:20] to the IGW, to the internet gateway. [349:25] And if we click here on the internet [349:26] gateway, [349:28] you will see that we have one internet [349:30] gateway, [349:31] and it is attached to our VPC. So, it is [349:34] attached to this VPC. [349:37] If we go back to the route tables, that [349:39] is fine. Here is the route table. These [349:40] are the routes in the route table. Which [349:43] subnets is this route table applied to? [349:46] So, we look at the subnet associations, [349:49] and we find out we have subnets without [349:51] explicit associations. So, basically, [349:52] these are using the route table right [349:55] now. [349:56] If you want to change association, you [349:58] can edit, and you can take one subnet [350:00] and assign it to another route table if [350:02] you would like to. [350:03] So, that's how we switch. We're going to [350:05] see all of that. So, for now, this is [350:07] the walk-through for the automatic VPCs [350:10] that have been created. Let's switch [350:11] back to US East 2 in Ohio. [350:15] And this is where we are going to create [350:17] our stuff. [350:18] So, if I switch to Ohio, I will find [350:20] that we have the same VPC, but a [350:22] different ID. And if I click on that and [350:24] I do route resource map, you are going [350:27] to find the same thing. I have three [350:28] subnets [350:33] Let me move this one a little bit up. [350:35] Three subnets in 2A, 2B, and 2C, and [350:38] then they are associated with a route [350:40] table, and the route table is associated [350:42] with an IGW. So, it's exactly the same, [350:44] but the task we have at hand is to [350:47] create a new one. [350:50] All right. So, let's now create the VPC [350:53] that we have discussed before, the one [350:55] with the four subnets and the details [350:57] and the route tables given and so on. [350:59] So, let's go ahead and create that now, [351:01] and it will be a custom VPC in US East [351:04] 2, and these are the subnets. Subnet 1 [351:07] 31.0.0, subnet 2 16.0, and then I have 3 [351:12] 32.0, and 4 48.0. And we're going to [351:15] create route table 1, route table 2, and [351:17] route table [351:18] 3 4. [351:19] And these labels, we're going to use [351:21] them, and this is going to be in [351:23] availability zone A, availability zone [351:25] B, and availability zone C. All right. [351:28] Let's go ahead and create the VPC, [351:30] allocate the CIDR block, [351:33] and then move on to creating the subnets [351:36] and the route tables and do the [351:37] association. All right? So, let's go [351:39] ahead and do this. [351:41] Here we are in the console, and I have [351:44] switched the region to United States [351:46] Ohio. And if you look here, you will [351:48] find out that this is US East 2. [351:52] What do we need to do? I need to create [351:53] a new VPC. [351:55] And I can do VPC only, or I can have AWS [351:58] help me create subnets and create route [352:02] tables and network connections and so [352:05] on. That is if you need help from AWS. [352:07] In my case, I want to show you how you [352:09] can do it from scratch, so I'm going to [352:11] choose VPC only. [352:13] And the name was custom_vpc. [352:17] The CIDR block given was 172.31.0.0/16. [352:25] And, and believe it or not, by clicking [352:27] create VPC, you have now successfully [352:30] created a virtual data center in AWS. [352:35] And it's isolated by default from [352:37] anything else. And let's see what else [352:39] was created. [352:40] So, when you look, these are the details [352:42] of your VPC. [352:44] So, there is a main routing table that [352:46] ends the ID of which ends with 833. This [352:49] is created by default for you. [352:52] There is a network ACL. We're going to [352:55] talk about this later on when we get to [352:56] security. [352:57] And [352:59] we don't have any subnets, [353:02] and we have only one route table. If I [353:04] look at the CIDRs, I have only one CIDR, [353:06] and it's associated. [353:09] And that's it. [353:11] So, if we want to know the details of [353:13] the route table, let's go and figure it [353:14] out by clicking on this link, or I can [353:17] go here, [353:19] and from route tables, [353:21] let me just refresh this page to show [353:23] the new one. [353:24] This is the new one. So, I'm going to [353:26] here give it a tag or a name, custom [353:30] VPC [353:33] def, for default. [353:37] All right. [353:38] So, what do we have inside this route [353:40] table? I can scroll up, [353:42] click on routes, [353:44] and then we have the range that we have [353:45] allocated. [353:47] And [353:48] if I want to edit the routes, I can [353:50] always click on edit routes, [353:54] and I can add, but this one, the default [353:56] one, I cannot remove it. [353:58] So, if I click for add a route, for [354:00] example, and I add a route 0.0.0.0, [354:04] send it to Let's say local for now. It's [354:07] meaningless. Don't worry about what I'm [354:09] trying to to do, but here, as you can [354:11] see, you can remove the customized ones, [354:13] but you cannot remove this. [354:15] So, what does this one mean? It means [354:17] any subnet [354:19] within the CIDR block of the VPC, [354:22] current subnet or future subnet, I know [354:24] how to get to it locally through the [354:27] implied route. [354:28] That is what it means, and you cannot [354:29] edit that. So, let me go back. I don't [354:31] need to do any changes now. [354:33] So, these are the routes available. What [354:35] subnets are associated? I don't have any [354:36] subnets in the VPC yet. That's why there [354:39] is no association. So, this route table [354:41] is not applied to anything, but it has [354:43] been created. [354:44] What do we need to do now? We need to [354:46] start creating the subnets. [354:48] So, let's go ahead. Here is the subnets [354:51] that I have. These are the default ones, [354:54] and how would I know? [354:55] They all belong to the same [354:58] VPC that ends with DE2, but if I check [355:02] my VPC, [355:03] DE2 is the default, and I can always [355:06] highlight it as the default, so it [355:08] becomes easier when I see it in the [355:10] different screens. [355:13] And I have the custom VPC, which is [355:15] mine. So, let's go ahead and create the [355:18] subnets now. So, I have three, and [355:20] they're all in the default VPC. These [355:22] are the automatically created ones. I'm [355:24] going to click on create subnet, [355:26] and which VPC? I'm going to create it in [355:29] the custom VPC. If by mistake you go and [355:31] create it here, now you are creating a [355:34] subnet [355:35] in a completely different data center, [355:37] which is not the right one. [355:39] So, you have to be very careful when you [355:40] have multiple VPCs, which one are you [355:42] choosing? [355:43] So, I'm going to choose the custom VPC. [355:46] And what is the subnet setting? What's [355:48] the name? So, this is going to be [355:50] subnet. We can do _1. [355:53] You can do it _-1, _ space 1, whatever [355:57] you like. [355:58] Which availability zone? If you [356:00] remember, the assignment was subnet 1 in [356:04] availability zone A, [356:06] subnet 2 in availability zone B, and [356:08] subnet 3 and 4 in availability zone C. [356:12] And the ranges are 31 0 0 [356:15] for one, for subnet 1, 31 16 0 for [356:18] subnet 2, and then 48 and 32.0/20 [356:22] for 3 and 4. [356:26] So, I'm going to create this one in US [356:28] East 2A. [356:31] And the range, the CIDR block for the [356:33] subnet, and I'm going to have 172. [356:37] 31.0.0/20 [356:41] as the subnet, as given. I I don't need [356:43] to change anything. [356:46] And [356:47] I can create a new subnet, another one, [356:50] subnet 2. [356:52] So, this is going to be subnet _2. [356:56] The [356:57] availability zone is going to be 2B, [357:00] and the CIDR of block is going to be [357:02] 172.31.16.0/20. [357:10] And we have already put the name and [357:12] then we have three and four. [357:16] So this is going to be subnet_3. [357:20] Availability zone is going to be C. [357:24] And the range is going to be 172. [357:28] 31. [357:31] 32.0/20. [357:36] And last but not least, I need to have [357:39] the last one which is subnet four. [357:41] So subnet_4. [357:46] And this is going to be in C as well. [357:50] And the range is 172.31. [357:54] 48.0/20. [357:58] Let's say you make a mistake. So for [358:00] example, let me here go back and say [358:04] 30 only for example. [358:08] And I try to create, what will happen? [358:11] Side is not within the side address from [358:14] VPC. So they are telling you now you are [358:16] trying to create a subnet that does not [358:18] belong to the pizza. [358:20] You cannot have a pepperoni pizza and [358:22] you try to get a slice that has seafood. [358:25] It won't happen. So here they are [358:27] telling you what we are watching you. [358:29] Now you are trying to configure a subnet [358:30] in a range that does not belong to you [358:32] and to this VPC. So please fix it. [358:35] When I fix it and create subnets, now as [358:38] you can see it is creating subnet one, [358:39] subnet two, subnet three, subnet four. [358:42] This is the beauty of the cloud. From [358:45] the dashboard, did some clicks and if [358:47] you are familiar with this, it wouldn't [358:49] even take 1/10 of the time that is [358:51] taking me. [358:52] And if you know infrastructure as code [358:54] tools like Terraform, you can have a [358:56] script ready and it will do it [358:58] everything that we have done in 1 [359:00] minute. [359:02] So the point I'm trying to make is the [359:04] orchestration and management is now [359:07] doing things, doing stuff in different [359:09] data centers, in the AWS different [359:12] availability zones, in an AWS region, in [359:15] Ohio and I'm sitting in Dubai right now. [359:18] And this is all happening without me [359:21] knowing which devices, which equipment [359:24] that this will be configured on, is it [359:26] software or is it hardware, what is the [359:28] switch, what's the router? I have no [359:30] clue. [359:31] So this is the management and [359:33] orchestration that sits on top of the [359:36] physical infrastructure of the data [359:37] center and that is what makes a cloud [359:40] called a cloud. So let's check the [359:42] subnets and see if we have what we [359:44] needed. [359:45] So now let me just minimize this so we [359:47] have more working space. [359:51] Okay. So I have subnet one. [359:55] All right? And subnet one is assigned a [359:58] range 00/20. [360:01] Then 16 is [360:04] subnet two and each one has an ID that [360:06] was allocated by AWS. I did not [360:08] intervene in the selection of the ID. [360:11] And for the availability zone, [360:15] the first one [360:17] is in 2A which is [360:20] subnet one. [360:22] Subnet two [360:23] is in 2B as you can see here. Then I [360:27] have two other subnets in 2C. [360:30] So looks like I've done it the right [360:31] way. [360:34] Three and four. [360:36] And as you can see here, they are all [360:38] attached to a route table. But I haven't [360:40] created any. Remember that there was a [360:42] default route table. [360:44] So this is the custom VPC default. This [360:47] is the route table that has been [360:48] assigned to all of them. [360:51] What do we need to do now? I need to [360:53] create three route tables. [360:56] RT_1 will be assigned to subnet one. [361:00] RT_2 will be assigned to subnet two. And [361:03] then RT_3 and four assigned to subnet [361:07] three and four. So let's have a look. [361:10] RT_1 for subnet one, RT_2 for subnet [361:14] two, RT_3 for four, three and four. So [361:17] let's go ahead and do this. [361:19] See, this is going to teach us how we [361:21] can create different route tables and [361:23] how we can associate or change [361:25] association for a subnet that I can have [361:28] a new route table as opposed to the old [361:30] one. For now, all of them associate with [361:33] the same route table which we need to [361:34] change now. But we need to create the [361:36] route tables first. [361:38] So let's click on route tables. [361:41] And we have the default one. This is the [361:43] default for the custom VPC. So if you [361:45] look at the subnets again, [361:48] subnet two, three and four, they are [361:50] attached to the route table. So as you [361:52] can see here, they are all attached to [361:53] the route table for the custom VPC [361:56] default. [361:59] Which is this one. [362:01] So what is the this route table? This is [362:03] the one for the default VPC. How can I [362:06] confirm? [362:08] So this is the default VPC. If I select [362:10] it, [362:12] you'll find that it has a route table [362:14] that ends with 037. [362:17] And if I go to these route tables, [362:19] you'll have that it ends with 037. To [362:22] avoid confusion, I can say that this is [362:24] default [362:26] VPC. [362:28] So what do I need to do now? I need to [362:29] create three more route tables as [362:32] instructed. So create route table. [362:34] And this will be RT_1. [362:37] In which VPC? It's very important to pay [362:39] attention when you are allocating VPCs. [362:41] You could create a resource in a [362:43] completely different VPC. Then you go [362:45] and check in your VPC and you don't find [362:47] it. This is because you allocated it to [362:49] a different VPC. So I need to work with [362:50] the custom VPC. [362:52] And this is the route table. Okay, [362:54] create route table. Oh, hold on, hold [362:56] on. We didn't configure any routes. [362:58] Let's check what happened. [363:00] So any route table created by default [363:03] will have this entry. Anything in this [363:05] VPC, I know how to get to and this is [363:08] local to the router. I don't need the [363:09] help of anyone. [363:12] So this is RT1. This is the route table [363:15] that we just created, RT_1. Let me [363:17] associate it with the right subnet. So [363:19] I'm going to click on edit subnet [363:21] associations and I'm going to take [363:23] subnet one [363:24] and I will shift it from the main route [363:27] table and it will go to the RT_1. Save [363:30] association. [363:32] Now if I look at subnet associations [363:34] again, let's see what we are we are [363:35] going to find. This RT1 has an explicit [363:39] subnet association now to subnet one. [363:42] Whereas two and three and four are still [363:44] having fun with the other route table [363:48] which is the default route table. So [363:50] there's there are available subnets [363:52] without explicit associations. I don't [363:55] want to associate any other one with [363:56] RT1. [363:58] So now we have three route tables [364:00] and some association is adjusted. Now we [364:03] need another one. RT_2. [364:07] Again, it's going to be in the custom [364:09] VPC. [364:12] And I'm going to create it. Believe it [364:14] or not, same entry has been created [364:17] automatically and you cannot delete it. [364:19] Subnet association, this one needs to go [364:21] with subnet two. [364:24] So now I have save associations. [364:27] If I look at subnet associations again, [364:29] you will see that subnet two is [364:31] associated with the route table that in [364:33] question right now which is RT2. And [364:36] then I have only two that are not [364:37] associated explicit and available if you [364:39] want to change association. [364:41] All right. I need a third route table. [364:45] And this will be called RT_34. [364:49] And it's going to be in the custom VPC [364:52] again. Don't make any mistakes. [364:54] Create the table. As you can see here, [364:57] the same entry again. Subnet [364:59] associations, I'm going to edit and I'm [365:02] going to select subnet three and subnet [365:05] four to be [365:07] connected to this table. And when you [365:09] click it again to verify, you'll find [365:12] that three and four are associated [365:13] explicitly and there are no available [365:16] subnets without explicit association. [365:18] Basically, it's it's telling me all [365:20] subnets have been associated with custom [365:22] route tables and none is with the main [365:25] route table. [365:26] So let's check again route table. Let me [365:29] look at the default in the main. [365:31] Click on subnet associations and you'll [365:33] find that zero is associated with this [365:35] route table. We have taken them with a [365:37] different route table. So this confirms [365:39] that you can switch route tables [365:42] association to a subnet. But at any [365:45] given time, a subnet can only be [365:47] associated with one route table. [365:50] All right? So by doing this, we have [365:53] created everything that we needed. [365:56] Let's do one extra step that was not [365:58] required. Let's create an internet [366:00] gateway and attach it to the VPC. [366:03] So internet gateways, [366:05] I'm going I have one here, but as you [366:07] can see, this has been attached to the [366:09] default VPC. [366:10] I need one for my custom VPC. So I'm [366:13] going to call it custom [366:16] VPC [366:18] _IGW internet gateway. [366:21] And believe it or not, now you are [366:22] assigning a router to a VPC by these two [366:25] clicks. VPC router is available now, the [366:28] internet gateway is available now and I [366:31] can attach it to a VPC or I can click on [366:33] here and [366:36] select attach to a VPC. Which VPC? I [366:38] need to attach it to the custom VPC. [366:41] And I'm going to do a attach internet [366:43] gateway. [366:44] So what you have done now is you have [366:46] created a virtual data center, you have [366:48] created four subnets, three route [366:50] tables, associated the route tables with [366:52] the right subnets, and you have also [366:54] created an internet router and you [366:57] attached that, connected that into the [366:58] VPC. So you have built a full virtual [367:01] data center right now in AWS. And by the [367:05] way, this is not chargeable resources. [367:07] The VPC, the subnets, the route table, [367:10] the internet gateway, they are all free. [367:12] Doesn't mean that all the resources in a [367:14] VPC are free, but these ones are free. [367:17] So even if now you are going to go have [367:19] lunch or have a break and do complete [367:22] later on the work, you are not being [367:24] charged anything. [367:25] That is not the case for every single [367:28] resource. [367:30] As we go, I'm going to tell you what is [367:32] chargeable and what is not chargeable. [367:34] When you finish work with a chargeable [367:36] resource, either you stop it or you [367:39] terminate it and you can always recreate [367:41] it again when you come back and you'd [367:42] like to work more. [367:44] So please keep that in mind if you want [367:46] to avoid surprise charges while working [367:48] on AWS. All right? Remember that we can [367:51] switch the region from here. Now all [367:53] what I have created is a virtual data [367:55] center with all its requirements so far [367:59] given to me [368:00] in Ohio in the US while I'm completely [368:04] in a different country. [368:09] in AWS. Let's see how we can apply the [368:12] concept of public and private subnets in [368:15] AWS VPCs. Remember we mentioned that a [368:18] public IP address is something routable [368:21] or an IP address routable from the [368:22] internet, reachable from the internet [368:24] directly without mediators. [368:26] And private IP addresses are the ones [368:29] like that we use at our homes and the [368:31] internet cannot see us from the outside, [368:34] cannot reach us from the outside. [368:36] One might ask, okay, so how come [368:39] I can connect from my home, from my [368:41] private IP address through Wi-Fi, can [368:44] get to the internet and internet can get [368:45] back to me. Remember there was something [368:48] called network address translation that [368:50] is done on the Wi-Fi router and we're [368:52] going to discuss that shortly. So let's [368:54] go ahead and see how in AWS we can do [368:56] public subnets reachable from the [368:58] internet and private subnets that are [369:00] not directly reachable from the [369:02] internet. [369:06] So a subnet in AWS is considered a [369:08] public subnet if it satisfies two [369:11] conditions. [369:12] Condition number one, [369:14] the subnet is created in a VPC that has [369:17] an internet gateway attached. [369:20] So for example, if you have a subnet [369:22] 172.31.0.0/20, [369:24] there's nothing when you are subnet drop [369:27] down menu to select whether it's public [369:29] or private. How you configure it makes [369:32] it public or private. [369:34] So now we have this public subnet. [369:36] And implied router is there by default [369:39] in this VPC with this cider block. [369:42] The first condition, the VPC must have [369:45] an internet gateway attached and we have [369:47] seen in the last demo that the internet [369:50] gateway in a custom VPC is an option. [369:52] It's not something that is there by [369:54] default. So that's one condition. What [369:56] else? [369:57] The subnet is attached with a route [369:58] table. That route table must have a [370:01] default route entry pointing at the IGW. [370:04] Basically, [370:05] the route table of the subnet must have [370:08] this entry. If you have noticed when we [370:12] did the demo [370:13] that all the route tables were created [370:16] with the cider block of the VPC only. [370:18] None of them had the 0.0.0.0 [370:21] pointing at the IGW. Let's prove it. [370:24] Here are the route tables that we [370:25] created. Let me select any one of them. [370:27] Let's say route table two. [370:29] If I click on the route table and look [370:31] at the routes available, it's only one [370:33] route [370:35] pointing at the subnets within the cider [370:37] block. [370:38] If I choose any other one of the route [370:40] tables, let's say RT1. [370:44] RT1, look at the routes. [370:47] Same route. So none of them has any [370:50] reference to the internet gateway, [370:52] although we have created an attached [370:55] internet gateway into the VPC. [371:00] So having an internet gateway is one [371:01] thing, but telling your router to use it [371:04] is a different thing. How can you [371:05] enforce [371:07] that the router for a specific subnet is [371:09] going to send traffic to the internet [371:11] through the default route? So through [371:14] this entry that we have seen, 0.0.0.0 [371:18] pointing at the IGW. [371:21] All right. So can I make subnet one [371:24] in the VPC that we created [371:27] a public subnet? Now it satisfies the [371:29] first one. The VPC has an IGW. Can I [371:32] make it a public subnet by satisfying [371:34] the second condition? And the answer is [371:35] absolutely. If I go here, subnet one is [371:38] associated with a route table one, as we [371:42] know. So let me click on this [371:44] and look at [371:48] the route table for this subnet. [371:51] You will see that it's attached to RT_1. [371:54] So what I'm going to do is I'm going to [371:56] do I'm going to go under RT_1 and I'm [371:59] going to [372:00] click on routes and then edit routes. [372:05] And I'm going to add a route and in this [372:08] route, what I will do is I'm going to [372:09] say anything else not in the route [372:12] table, [372:13] please send it to the IGW. So internet [372:16] gateway. [372:17] It will ask me which internet gateway [372:19] and here is the custom VPC internet [372:21] gateway. So this integration and AWS [372:24] knowing the orchestration and management [372:26] layer, knowing what resources are in my [372:29] VPC and it's a pull down menu and I can [372:31] select them and that's how easy it is to [372:35] configure routers to point at internet [372:37] gateways and attach the internet gateway [372:38] to the VPC and create subnets and create [372:40] route tables. So that's the beauty of [372:42] the cloud. That's why you need to learn [372:43] the cloud. This is the modern IT. [372:47] If you are planning for the future, plan [372:49] it from now. Don't take transitional [372:51] careers and in three to five years you [372:54] realize that I wish I have done like my [372:56] friends did and I got into cloud and [372:58] automation and machine learning and AI [373:00] and all that stuff. So you need to see [373:04] the difference. You need to appreciate [373:06] how easy this is becoming compared to [373:08] traditional IT. All right. So let me [373:10] choose the internet gateway and save [373:13] changes. [373:15] So now let's look at the routes and now [373:17] we have two routes, 0000 default route [373:20] pointing at the IGW [373:23] and the entry, the first one. So now we [373:26] have managed to make subnet one a public [373:30] subnet. So let me go back here and what [373:33] I will do just to make my life easier is [373:36] I'm going to [373:37] put here an underscore and I can say [373:40] public. It becomes much easier for me [373:43] when I'm creating to identify my subnets [373:46] as opposed to if I don't have any tags. [373:48] These are called tags, name tags, [373:50] location tags, building tags, [373:52] production, development, testing and so [373:55] on. So now I have done I have managed to [373:57] create subnet one as a public subnet. [374:01] All right. So this is clear on the [374:03] public subnet. How about the private [374:06] subnet? A private subnet is the one that [374:08] does not satisfy the two conditions [374:11] or at least one of them. [374:14] So this subnet for example, [374:15] 172.31.16.0/20, [374:18] it has a routing table like this. Let's [374:21] say this is RT_2 [374:23] or even RT_3 [374:25] 4 that we created because all of them [374:28] they only have this entry. So these are [374:29] all two, three and four are all now [374:32] private subnets. [374:34] Why? Because they don't have this entry. [374:37] So they satisfy the first condition. [374:39] They are in a VPC that has an IGW. Okay, [374:42] fair enough. However, there is no [374:44] instruction to the implied router to [374:47] take that traffic from here that needs [374:49] to get to the internet and deliver it to [374:51] the internet gateway so it can make it [374:53] out to the internet. [374:55] So if you lose one of the two [374:56] conditions, that subnet is immediately [374:59] private. [375:00] Now if you would like to have your [375:02] website virtual machine, then you have [375:04] to launch it in a public subnet [375:06] because that's the only way the internet [375:08] will know about it and it will reach the [375:10] internet directly. [375:12] Whereas if you have some sensitive data [375:15] like for example, a database, some [375:17] credit card information, some order [375:19] information, payment information, [375:21] patient health records and so on, this [375:24] is sensitive, should not be exposed to [375:26] the internet and then hackers are going [375:28] to try to break into it and steal that [375:31] critical information. [375:32] So in that case, you need a private [375:34] subnet and you can hide it in a private [375:36] subnet. And as we move on [375:38] and we learn more about the cloud, you [375:40] will know that how applications are [375:42] deployed and we'll talk about that later [375:44] in the course. All right? Hopefully this [375:45] one is clear [375:47] and you do now understand the difference [375:49] between public IP addresses and public [375:53] subnets in the cloud and also private [375:56] subnets in the cloud that are hidden [375:58] from the internet. [376:03] All right. Now let's go ahead and talk [376:05] about network address translation a [376:08] little bit more. Understand how it [376:10] works. We have mentioned that earlier, [376:12] but now it's time to expose it and [376:14] understand it. [376:17] So the network address translation [376:20] is a feature or an IP feature happening [376:24] on some devices like wireless routers at [376:26] home or in the offices [376:28] to mask or hide the fact that [376:32] the communicating part, the sender is [376:35] with a private IP address and hide it [376:38] behind the [clears throat] public IP [376:39] address. So that's the whole thing. So [376:41] let's understand this. [376:44] We have a router performing network [376:46] address translation. [376:48] The router connects this local area [376:50] network, the mini local area network we [376:52] have on the drawing [376:55] and connects that to the internet. [376:57] The local area network has this range, [377:00] 172.31.1.0/24. [377:03] .1 is configured on the router LAN [377:06] interface [377:08] and the router is connected to the [377:09] switch. And we have a laptop that has an [377:12] IP address 172.31.1.118. [377:16] Both belong to the same network and [377:19] everything looks good and they are both [377:21] configured on ports that belong to the [377:23] default VLAN. So, they can communicate [377:26] with one another. [377:28] And this laptop is configured to send [377:32] anything [377:33] that is going outside the network to [377:35] send it through to the default gateway [377:38] or .1.1. [377:40] This is all easy. [377:43] Now, the user of the laptop would like [377:45] to get to cnn.com. [377:47] And cnn.com happens to have the IP [377:50] address on the internet 205.111.37.86. [377:56] And both are connected to the internet. [377:58] Connections are live and life is good. [378:00] The router got an IP address from the [378:03] service provider, a public IP address on [378:06] the one side, on the internet side, [378:08] which is 100.2.55.33. [378:12] The browser needs to formulate a packet [378:15] that will go to cnn.com. [378:18] So, the packet [378:20] assuming just for analogy that it is an [378:23] envelope, so the message is or the [378:26] payload is put inside an envelope and [378:29] now the browser is going to write, "I am [378:32] the sender 172.31.1.118, [378:35] which which is a private IP [378:37] and this should go to cnn.com, which is [378:39] 205.111.37.86." [378:44] And it will send it to the router [378:46] because this is going outside the [378:47] network, so this will need to be sent to [378:49] the router. [378:50] The router will receive it, will look at [378:53] the source IP address [378:55] and finds out that this is going on the [378:57] internet and the router understands this [378:59] cannot happen. [379:00] So, what do we do? NAT will kick in, [379:03] network address translation, [379:05] and what the router will do is it will [379:07] remove the private IP address from the [379:10] message [379:12] and it will replace it with its own [379:14] public IP address. [379:18] And the destination does not change. [379:20] Now, the message can be sent through the [379:22] internet and it will arrive safely at [379:24] cnn.com. [379:26] cnn.com will receive the message, read [379:29] what is required, so that user wanted to [379:31] go into the financial news [379:34] page. The response is going to be [379:37] formulated, put in an envelope, [379:40] and the sender in this case is going to [379:43] be the server itself, [379:45] and the receiver or the recipient is [379:47] going to be the public IP address of [379:51] the router. [379:52] How and why? Because when it received [379:55] the message, this is what appeared to be [379:57] the source. [379:59] So, now it gets to the router. The [380:01] router has a table of mapping of what [380:04] has been done. [380:06] And part of that was that I have taken [380:09] the 172.31.1.118 [380:13] and I have swapped it with my [380:15] 100.2.55.33. [380:18] So, now when this comes back, it's going [380:20] to do the reverse process, but it will [380:23] not remove the source. It will remove [380:26] the destination, the one that has been [380:28] before placed as the source, [380:31] and swap it with the private IP address, [380:34] and that is how it gets it to the [380:36] laptop. [380:37] So, this is how it works and exactly the [380:39] same happens at home in our wireless [380:42] routers. [380:44] So, if you use the same example and [380:46] assuming the router received this IP [380:49] address from the service provider, of [380:52] course it could be a completely [380:53] different one, but it's a public IP [380:55] address. [380:56] We have this range for the network [380:59] within your home, which is being [381:01] broadcast by the router on the wireless [381:02] LAN. [381:04] The router has the .1.254 [381:07] on the WLAN, on the wireless LAN side, [381:09] and this has the .1.120. The exact same [381:13] thing repeats. [381:14] The private IP address is the source [381:16] when a message is being sent from the [381:18] laptop to the server, [381:20] gets to the wireless router. The [381:22] wireless router will stop it, will [381:24] change this IP address with this IP [381:27] address and then send it to the [381:29] recipient on the internet. [381:32] And the response is the reverse process. [381:35] In AWS, when you have a virtual machine [381:38] that has a public IP address, [381:41] the public IP address is not configured [381:43] on the instance. [381:45] It will be configured on the IGW, on the [381:48] internet gateway. [381:50] And mapping will happen between the [381:52] private IP address of the instance and [381:55] its assigned public IP address. [381:59] And we are going to see how that happens [382:01] in the hands-on lab. All right? So, [382:03] network address translation is extremely [382:05] crucial to conserve the public IP [382:08] address space [382:10] by masking private IP addresses and [382:14] allowing the use of private IP addresses [382:16] internally within wireless LANs or local [382:18] area networks [382:19] and converting that into public IP [382:22] addresses when a communication is [382:24] required with the internet. [382:25] And it does the reverse process on the [382:28] response traffic. Hopefully, it is [382:30] clear. It's very easy and it happens and [382:33] you are using it at home all the time [382:35] without you knowing. So, this is how you [382:38] are seen on the internet as a public IP [382:40] address. And that is how on the internet [382:43] when someone attacks [382:46] a website or a critical system or [382:48] something, they look at the logs and [382:50] they find out who was the the source IP [382:54] address. And then wherever that is, they [382:57] can find quickly the country, which [382:58] service provider, and from the service [383:00] provider logs, they can find out who was [383:03] using that IP address at the time of the [383:05] attack, and that's how they can track [383:07] you down to your home and find you when [383:10] you have done something wrong on the [383:12] internet. All right? So, be careful when [383:13] you use the internet, use it as a good [383:16] citizen and don't use it as a bad [383:18] citizen. [383:22] So, let's now do a hands-on lab in the [383:25] AWS cloud [383:27] where we are going to create a virtual [383:29] machine [383:30] in a subnet. [383:31] We want this subnet to become a public [383:33] subnet. [383:34] So, we are going to edit the IP route [383:38] table of that subnet in order to point [383:40] to the internet gateway. [383:42] It is already in a VPC that includes an [383:44] internet gateway as we have seen, the [383:46] custom VPC that we created. [383:48] And we will log in to that instance or [383:51] virtual machine and we are going to [383:53] access the internet and access it from [383:55] the internet to prove that a public [383:58] subnet means something. [384:01] So, let's go ahead and do this in the [384:04] AWS console. [384:07] So, what we are going to do is we are [384:09] going to adjust subnet one to become a [384:12] public subnet. [384:14] And after that, we need to create a [384:16] virtual machine in the public subnet [384:18] and the virtual machine must have a [384:20] public IP address assigned. [384:23] We need to adjust the security group to [384:25] allow all traffic. Every virtual machine [384:28] that is created in AWS is protected by a [384:33] security group. Think of this right now [384:36] as a protection around the instance. [384:38] We're going to explain it later on what [384:40] a security group is. [384:42] But for this one, in order to void the [384:45] security group, we are going to force it [384:47] to allow all traffic. So, to do no [384:49] filtering whatsoever because we need to [384:51] test the public IP and we need to focus [384:53] on that. [384:56] Once we connect to the machine, we are [384:57] going to try from the machine to access [385:00] something on the internet to find out if [385:02] this is working or not working. [385:05] And then we are going to ping from the [385:06] internet to the instance. So, from my [385:09] laptop, I'm going to send messages [385:12] requesting a response from the virtual [385:15] machine, and I'm going to direct that [385:17] request to the public IP address of the [385:19] virtual machine. And we'll see what [385:21] happens. [385:22] Of course, after doing this, [385:25] we can do some additional step where we [385:28] are going to remove the part that allows [385:31] subnet one to communicate with the [385:33] internet from the route table, and we'll [385:35] try the same test again, and at that [385:37] time, the communication should stop, [385:39] which indicates that the public subnet [385:42] was key to be able to access and [385:44] communicate with the virtual machine. [385:47] So, let's go ahead to the console and do [385:48] this. It's very simple. [385:50] We're going to take the very first [385:51] subnet, subnet one. We're going to [385:54] convert it into a public subnet [385:57] by adding this entry into RT_1, which is [386:02] the route table for subnet one. [386:04] And we are going to continue our testing [386:07] as mentioned. So, let's go ahead and do [386:08] this. [386:09] So, here I am in [386:11] the VPC [386:13] in Ohio, the same one that we created [386:15] before. So, it's the custom VPC. I'm in [386:18] the VPC dashboard. I'm going to go into [386:21] subnets. I'm going to pick subnet one. [386:24] Let's look at the route table of subnet [386:26] one. It has only the entry that states I [386:29] can route anywhere within the VPC to any [386:31] subnet without the aid or help of [386:34] anyone. [386:35] So, this is the route table. We're going [386:36] to go to the route table [386:39] and we are going to edit routes and we [386:41] are going to create a new route that [386:43] would state [386:46] anything else other than the subnets in [386:49] the VPC, [386:50] please send it to the internet gateway. [386:53] And which internet gateway? The one in [386:54] the custom VPC. [386:57] Save changes. [386:59] So now we we have forced subnet one to [387:01] be a public subnet. [387:03] If I go back, let me now label it as [387:05] such. So I'm going to label this as [387:09] public. [387:12] Save. [387:14] And just to check one last time, here is [387:17] the entry that made it a public subnet. [387:20] So what else do I need to do? I need to [387:22] have a security group that is going to [387:24] have all traffic allowed in from [387:26] anywhere. [387:28] So we can do it separately right now. So [387:30] under security, I'm still in the VPC [387:32] dashboard, scrolling down to security, [387:35] security groups. [387:37] And I'm going to create a security [387:38] group. [387:40] For now, please don't bother what is a [387:44] security group. We're going to explain [387:46] that carefully. [387:48] So this is the outbound rules, and it [387:50] shows that all the traffic [387:52] is allowed to anywhere outbound. [387:57] I'm going to call it testing [388:00] _security group. And description, [388:04] testing [388:05] VM public subnet. [388:08] So just a reminder, if I look at it [388:11] later on, I'll find out what this is all [388:13] about. And we have to make sure it is in [388:14] the proper VPC. [388:19] Inbound rules, I'm going to add a rule [388:21] that would allow all traffic. We said [388:24] make sure that it's not going to filter [388:25] anything. So all traffic from anywhere. [388:29] And in the outbound, all traffic to [388:32] anywhere. [388:33] And create security group. [388:35] So the security group for me is called [388:38] testing SG. This is the one we are going [388:40] to use. [388:41] So what do we need to do now? So we [388:42] adjusted the public subnet. [388:45] We adjusted the security group. Now we [388:46] need to create a virtual machine in the [388:48] public subnet. [388:50] So I'm going to click here and then [388:52] write EC2. EC2 is the service for the [388:55] virtual machines in AWS. And I'm going [388:57] to right-click here and open it in a new [389:00] tab. So I will have the VPC tab and the [389:02] EC2 is going to be next to it. [389:05] So instead of jumping on the same page [389:07] between dashboards, I will have the [389:10] required dashboards open in separate [389:12] tabs in front of me. [389:14] So now we are going to go here, click on [389:18] instances, [389:20] launch instance. [389:23] I'm going to call this testing [389:27] _public [389:29] subnets. [389:32] Of course, you can call it just testing. [389:33] Call it anything. The name is [389:35] irrelevant. [389:36] And I'm going to have it as Amazon Linux [389:39] 2023. [389:43] And I'm going to leave it to the size T2 [389:45] micro. [389:47] For the key pair login, I'm going to [389:51] proceed in this case without a key pair. [389:53] Doesn't matter. [389:54] Network settings are important. I want [389:56] to make sure that it's going to be in [389:58] the custom VPC. [390:00] And I want to make sure it's going to be [390:02] in the public subnet. [390:05] This is very important, assigning a [390:08] public IP address to the instance. Make [390:10] sure that this is enabled. [390:12] And I'm going to select an existing [390:14] security group. As I mentioned, you [390:16] cannot create an instance without a [390:17] security group. So here we are going to [390:19] choose the testing one that we created. [390:26] Okay, and that's it. Quick review. [390:29] It's Linux, T2 micro, [390:32] and without a key pair, that's fine. [390:35] Custom VPC, [390:37] and subnet one public, and has a [390:39] security group testing that allows [390:41] everything. Launch the instance. [390:46] So the instance has been successfully [390:48] launched. [390:53] And I can click on connect when it is a [390:56] blue color. [390:58] And I'm going to choose EC2 instance [391:00] connect. Scroll down. [391:02] Click on connect. [391:05] I'm now trying to log in to the [391:07] instance, to open a connection into the [391:09] instance so I can use it to verify [391:12] whether it has access to the internet or [391:13] not. [391:14] As you can see, we are in the instance [391:16] right now. The instance has a public IP [391:18] address [391:20] and has a private IP address. [391:23] So let me do sudo su. [391:28] And from here, I can try to ping an IP [391:31] address on the internet. Ping is [391:35] a testing tool that is used for [391:37] troubleshooting to find out if another [391:39] host that I know the IP address [391:42] of is alive or not. [391:44] So one that we know on the internet is [391:46] the Google DNS, 8.8.8.8. [391:49] This is connected to the internet and it [391:51] does accept ping [391:53] packets or messages and responds to [391:55] them. So let's click on ping. [391:58] And here, as you can see, the response [392:00] is successful. [392:02] How do I know? If I do control C, stop [392:04] it, [392:06] you'll find that seven were transmitted, [392:10] seven were received, zero packet loss, [392:13] and the time. [392:15] That means the virtual machine on a [392:17] public subnet can access the internet. [392:20] All right. [392:21] Can I access it from the internet? So [392:23] let's take the public IP address. [392:28] And I'm going to go into my terminal on [392:31] my MacBook, on my laptop. In your case, [392:33] you are going to open Windows command [392:36] prompt, and you will do exactly the [392:37] same. [392:39] Okay, so here we go. I'm going to do [392:41] ping, and then control V to paste the [392:44] public IP address. [392:45] So the 3146178137 [392:48] is the public IP address I grabbed from [392:51] here, [392:52] from the instance. [392:54] And if I do ping, as you can see also, [392:57] it is successful, and I'm getting the [392:58] responses. How can I know? Control C. [393:03] Six packets were sent, six packets [393:05] received, zero packet loss. [393:08] This indicates [393:10] that by having the instance on a public [393:13] subnet [393:14] with a security group that allows [393:15] communication out and in, [393:18] we were able to communicate from the [393:20] virtual machine outbound to the [393:22] internet, and from the internet inbound [393:24] to the virtual machine, which confirms [393:27] that a public subnet [393:29] is key into this. Now, how else can we [393:33] confirm? Okay, let's go ahead [393:35] into the VPC again. [393:38] And let me go into the route tables. [393:42] And on route table one, here are the [393:44] routes. I'm going to remove this one [393:46] again. [393:47] So edit, and I'm going to remove this. [393:50] And I'm going to save it. [393:52] Now, let's go ahead and try from my [393:55] laptop if I can get to the instance. So [393:58] here I am. I'm going to repeat the same [393:59] command. [394:00] And now, as you can see, there is [394:02] timeout, timeout, timeout. Why? [394:05] It's the same virtual machine. It has a [394:07] public IP address. [394:09] And I was able a second ago to ping it [394:12] from my laptop. What happened now? What [394:15] happened is the placement of the virtual [394:17] machine or the instance right now is on [394:21] a private subnet, not a public subnet. [394:24] So despite the fact that it has a public [394:27] IP address, [394:28] and the public IP address still exists [394:31] on the instance or the virtual machine, [394:34] it is unable to get this traffic. And [394:38] even if it gets it, it will not be able [394:40] to respond. [394:42] Because the route table for the subnet [394:44] subnet one is no longer able to [394:47] communicate with the IGW. It's not [394:49] instructed to communicate with IGW. [394:51] The way it stands right now is this way. [394:56] All right, let's do one thing. Let's add [394:58] the entry again. [395:00] And I'm going to say anything, please [395:02] send it to the IGW. [395:06] And before I click on save changes, see, [395:09] we're still timing out. [395:11] Let's go ahead and do the save changes. [395:16] And see what happens now. [395:18] See, it immediately started working. So [395:21] this confirms that if you want workload [395:24] that is accessible from the internet in [395:27] AWS, it has to be [395:29] a workload, a virtual machine, an [395:31] instance that has a public IP address, [395:34] and it sits on a public subnet, and the [395:38] security group allows the communication [395:40] in and out that you need to have with [395:43] the virtual machine. All right? [395:44] Hopefully this is clear. It confirms our [395:46] point, and everything looks fine right [395:49] now. [395:50] So let's do one thing extra. [395:53] Let's see what IP address do we have on [395:57] the instance. Do we have the public IP [395:59] address on the instance or not? [396:02] So let me go back to the virtual [396:03] machine. [396:06] And I'm going to do the command [396:09] IP address, or IPA. [396:13] Let's see what IP addresses exist on the [396:15] instance. Let me just make it a little [396:17] bigger. So this is 1720001. [396:20] This is a loopback interface [396:21] troubleshooting testing on the instance. [396:23] That's is not the communication IP [396:25] address. [396:27] Then I have number two, which is ENX0. [396:31] And if you look here, you will see that [396:34] we have the inet, the IP address on that [396:37] interface, 172.31.4.177. [396:41] Which is exactly this one. [396:43] So, the private IP address exists on the [396:48] V neck on the virtual network interface [396:50] card of the instance [396:53] and it has a broadcast IP [396:56] 172.31.15.255. [396:59] All right. [397:00] And the mask is /20. All looks good. [397:04] But, where is the public IP address? [397:06] Where is this IP address? Why don't I [397:08] see it here? [397:11] The reason why you don't see it is [397:12] because it is configured on the IGW [397:16] and there is network address translation [397:18] happening on the IGW whenever this [397:21] instance needs to get to the internet [397:24] that will take care or will swap the [397:27] private IP address with the public IP [397:29] address. [397:30] How can we prove this? [397:32] How can I prove that this is existing? [397:35] Let's ask the internet. [397:37] So, on the internet, what we can do [397:40] So, we did the IP address and we saw [397:42] that we only see or we only have the [397:44] private IP address of the virtual [397:46] machine configured on its V neck. [397:49] You could have used this one as well as [397:51] a command. If you are on Windows, all [397:54] you need to do is IP config only without [397:57] get interface address and all that. So, [397:59] open the command prompt and do IP [398:01] config. [398:03] If I do curl [398:04] interfaceconfig.me [398:07] this command, if I use it now on the [398:08] virtual machine, it will tell me how [398:11] does the internet see me [398:13] from an IP address perspective. So, [398:15] let's do curl ifconfig.me. [398:18] So, let's do curl [398:21] ifconfig.me. [398:23] So, I'm asking the internet [398:25] I'm going to send you a packet now. Can [398:27] you tell me what is the source IP [398:29] address that you see in that packet? [398:32] If I hit enter [398:34] you'll see here the response [398:36] 3.146.178.137. [398:40] So, the internet sees me as [398:42] 3.146.178.137, [398:45] which is the public IP on the instance [398:47] and that confirms that there is a device [398:51] somewhere [398:52] that is converting the source IP in the [398:55] packet, which is 172.31.4.177 [398:59] on the way out, when the packet is going [399:02] out [399:03] it's converting that into this IP [399:05] address and that's how the internet sees [399:07] me and the proof is this. [399:09] So, which device is that? That's the [399:11] internet gateway. This is documented in [399:13] AWS and we just proved it that we don't [399:16] have the public IP address anywhere on [399:19] the instance. [399:21] So, the IP address command basically [399:23] lists all the IP addresses that are on [399:26] the virtual machine [399:27] and proves that there is no [399:30] public IP address configured on that [399:33] virtual machine and we have found that [399:36] the internet still sees us or sees the [399:38] virtual machine with a public IP [399:40] address. So, hopefully this is clear. [399:42] Now, we confirm that this is happening. [399:44] You could use the ifconfig or the curl [399:47] ifconfig.me as well on your Windows [399:49] laptop, if you have one, direct from [399:52] your laptop to the internet and see what [399:55] will be your public IP address, but in [399:57] your case, that will be the one from [399:59] your office router or from your home [400:02] wireless router, how [400:05] that is changing or doing network [400:08] address translation to your IP address [400:10] when you communicate with the internet. [400:11] All right. Hopefully this was clear. [400:13] Now, since we are done [400:16] I'm going to go ahead and terminate the [400:18] instance. If you wanted to do some more [400:21] testing, that's fine. At the end, please [400:23] make it a habit that you terminate the [400:25] instance or the virtual machine when you [400:26] don't need it. [400:28] Don't worry about the route table and [400:30] VPC and all that. These are free [400:32] resources, but the virtual machine is [400:34] not. [400:35] Hopefully this was easy to understand. [400:37] Thank you very much. [400:41] Okay, so let's do a demo and the demo [400:43] you will do it from your own PC whether [400:46] you have Linux, Mac or Windows at home [400:50] and it will show you that the wireless [400:53] router does actually do nothing [400:55] between the IP address that you have [400:59] and how you are seen on the internet and [401:01] it will be a public IP on the internet. [401:03] So, you are seen as if you are the IP [401:06] address of the router. [401:07] So, what we'll do is in your case, you [401:09] will be connected to a laptop [401:13] and the laptop is connected to the [401:14] internet. So, you will have a private IP [401:17] from your wireless router. You are [401:19] connected through the wireless router, [401:20] not directly to the internet. [401:24] So, the private IP that you have is most [401:27] probably is going to be a 192.168 IP [401:29] address. Most of the routers of the [401:31] wireless routers do that. [401:33] And then it has a public IP here and the [401:35] internet will see you through the public [401:38] IP on the router. That's what happens. [401:41] So, to simulate this and since I don't [401:43] have a Windows machine or Windows PC [401:47] then I will launch a Windows PC on AWS [401:50] and I will connect to it and I'm going [401:52] to use it as if it is my PC at home and [401:55] I will check and see if there is nothing [401:58] happening or not. You follow the same [402:00] steps on your PC and you should see the [402:03] public IP of your router. So, let's go [402:05] ahead and do this and I'm going to show [402:07] you how it happens, how it works. [402:10] We are going to use the Windows command [402:12] prompt. I'm going to show you IP config [402:14] first because that will show you the [402:17] private IP address that is on the [402:20] machine itself from AWS. [402:23] And then we are going to use the curl [402:26] ifconfig.me [402:28] and that should also show us how the [402:30] internet will see us from the outside. [402:32] So, let's go ahead and do this. So, I am [402:34] on a Windows machine. What I I will do [402:36] here is I will [402:38] write CMD and this is the command prompt [402:41] I'm talking about. [402:44] All right. And I'm going to make it a [402:46] little bigger, so hopefully you will be [402:48] able to see better than [402:50] when it is very small. [402:53] And I'm going to start with IP config. [402:56] IP config will show you the IP address [403:00] that is on the machine. So, let's see. [403:04] So, as you can see I have an IP address. [403:07] This is Forget about DNS for now. This [403:09] is the IP address that I have, IPv4 [403:11] address as you can see and it is [403:13] 172.31.80.56 [403:16] and the subnet mask is [403:19] 255.255.240.0. [403:22] Can you tell me in a cider fashion what [403:26] is the size? [403:28] Is it a /24, /16, /20 [403:32] or all of the above? [403:35] So, this is 8 8. 240 is four ones plus [403:38] 16, so that will become 20. So, this is [403:41] a /20 subnet. [403:43] All right. So, this is my private IP. [403:45] What if I do curl [403:47] and then ifconfig.me? [403:53] As you can see here, it's saying that [403:55] you have you are seen from the internet [403:57] as 52.87.238.95. [404:02] All right. So, if I may just move this [404:05] to the right a little bit [404:07] and minimize the view [404:10] minimize it again. You will see here [404:12] that the 52.87 [404:15] IP address and this is the private IP [404:17] address. So, that's the IP address that [404:19] we have [404:20] and it shows you that there is NAT [404:22] happening. Of course, this is on the IGW [404:24] in AWS, but in your case, it's going to [404:26] be [404:27] in your wireless router. [404:30] In case, if your operating system does [404:32] not have the curl, if it tells you curl [404:35] is not recognized, that means you have [404:38] to install curl or if you are satisfied [404:40] with what you have done on the in the [404:42] cloud on the Linux machine and you have [404:45] seen the curl and you have seen how the [404:46] NAT happens on the gateway, so that's [404:48] good to go. Or of course, you can go to [404:50] your friend, best friend [404:52] ChatGPT and tell how can I install curl [404:56] on a Windows 10 or Windows 11 that you [404:58] have [404:59] and it will tell you exactly the steps. [405:01] Once you have the curl command, you can [405:03] do curl ifconfig.me and it will get you [405:06] the public IP address. [405:12] Now, it's time to talk about the network [405:14] reference models and protocols. [405:17] If we have multi-vendors, we have, let's [405:20] say, an access point from HP [405:24] network from Cisco and we have cables [405:26] from a Chinese company [405:29] and maybe we have data center switches, [405:32] let's say, from Taiwan. [405:34] When they manufacture these [405:37] what are the electrical signals or the [405:39] optical signals on the cables that is [405:41] acceptable by all parties? [405:43] What is the shape of the connection that [405:47] needs to plug into the switch and the [405:48] size and how many connectors and whether [405:51] it is copper or it is something else? [405:54] How should the packet look like exactly [405:57] in order for that to be understood that [405:59] this is coming from this place to that [406:01] place? Where should the IP address for [406:02] the source be placed? Where should the [406:05] destination IP address be placed? So, [406:07] all of these are standards for people [406:09] who are working on cabling, on switches, [406:12] on routers, on software, on browsers, on [406:16] website engines [406:18] to find out [406:20] how they should build it in order to be [406:22] interoperable [406:24] with the other vendors. And now, any [406:27] startup, given these standards, can [406:29] start and work on cables. Maybe they [406:32] have a better quality cable or maybe [406:34] they can compete on the price [406:36] and also for other companies to work on [406:39] switches and compete with Cisco, HP, [406:41] Juniper and the like. [406:43] And also with for routers and also for [406:46] software and also for security and also [406:48] for applications and browsers and so on. [406:52] So the standardization [406:54] or this standardization requires a [406:57] reference model and that is what we need [406:59] to discuss now. [407:01] So first of all we'll start with [407:03] proving to you that we require more [407:06] headers in an IP packet than just the [407:09] source IP address and the destination IP [407:11] address. [407:12] We'll also talk about the open system [407:14] interconnection or open system [407:16] interconnect, the OSI reference model, [407:20] which is the standard model for the [407:22] networking. [407:24] That will take us to talk about TCP and [407:27] UDP protocols and what is a protocol and [407:30] other known protocols in the networking [407:33] field. We're going to pick some of the [407:35] common ones that they will come in handy [407:38] and you will come across them frequently [407:40] no matter what career choice you're [407:42] going to go after when you finish this [407:45] course. [407:48] So let's go back and look at the post [407:52] service analogy that we have talked [407:54] about before and that will lead us to [407:56] find out if we need more headers for IP [407:58] addresses and IP packets or not, more [408:01] than the source and destination IP [408:03] address I mean. [408:04] So if you have John Smith who lives in [408:06] this unit number in this building in [408:09] Boston, Massachusetts in the US [408:12] and this is the building address wants [408:14] to send regular mail [408:16] to Sarah, she lives in unit 308 in this [408:20] building and that's a street address and [408:22] and so on. [408:24] So John puts [408:25] his address and he forgets to put his [408:29] unit number. [408:31] And that's a multi-story building, [408:33] high-rise. [408:35] Sarah [408:36] is the recipient but also he doesn't [408:39] know or he forgot to add he her unit [408:42] number. Let's assume that he forgot. [408:45] So the letter gets sent [408:47] gets shipped through US postal service [408:50] all the way to Egypt. Egypt post will [408:53] deliver it to the building but then at [408:55] the building maybe we have 100, 200 [408:57] units. We don't really know easily where [409:00] to send it, which apartment, which unit. [409:03] And that is why this will be a problem [409:05] and the mail will not be delivered [409:07] without the unit number or the apartment [409:09] address. Of course, there could be a lot [409:11] of asking around, security guard, [409:13] watchman and all that until they know [409:16] where Sarah is but if not then this is [409:18] going to be shipped back [409:21] to the recipient as undeliverable. [409:25] Okay, but if we add the unit numbers [409:28] then there should be no problem [409:30] whatsoever. [409:34] And everything will be cool. [409:36] The forward mail will go there and the [409:38] response will be delivered as well. So [409:40] similarly, we need additional headers in [409:42] an IP packet to be able to precisely [409:44] identify on the receiving end, there [409:48] could be multiple VMs and multiple [409:50] applications on the server on the [409:52] receiving server. [409:54] Now when the packet gets to the server [409:57] which application or which VM should [409:59] receive it? So we need additional [410:01] headers. [410:04] Also, which application on the source [410:07] sent the request? Was it Chrome? Was it [410:10] Safari? Was it Firefox? Was it mail, [410:13] email? [410:14] Or was it Zoom? So on your laptop you [410:17] might be running a lot of applications. [410:20] When the response comes back [410:22] which one should receive the response? [410:25] They are all on the same laptop. The [410:27] laptop has the same IP but then we need [410:29] to distinguish between the different [410:31] units in the building. Your laptop is [410:33] the building and it has many [410:34] applications open. So which one should [410:37] the software send it to? [410:40] This tells us that we don't have enough [410:44] information in the IP packet if we only [410:47] confine it to the source and destination [410:49] IP. Because of the fact multiple apps [410:53] can be running or multiple VMs on the [410:55] server side and multiple apps on your [410:57] phone or client side. [411:00] So what is that header that we need? We [411:02] call it the ports, the IP ports. [411:06] So let's try to understand the source [411:08] and destination ports a little bit more. [411:11] So source and destination ports are [411:12] required headers in a packet [411:14] and this is in addition to the source [411:17] and destination IP address. [411:19] If we look here and we try to do the [411:21] analogy of an envelope if this laptop is [411:25] in Germany [411:27] and it has an IP address and this is not [411:30] a private IP address, this is the public [411:32] IP address [411:34] opens a browser and now it's trying to [411:36] send [411:38] a request or a message or a login or [411:40] whatever that is, let's say to [411:43] a bank [411:45] in the US or a corporate in the US. [411:47] And this is the server [411:49] IP address and it is a public IP address [411:51] as well. [411:53] So here [411:54] the information we need at a minimum is [411:57] who is the source, who is the sender as [411:59] an IP address and which application [412:03] port [412:04] is on this laptop that should receive [412:07] the response. [412:09] And where it is going and what is the [412:12] destination port, which application in [412:14] case that we have multiple applications [412:16] running on different virtual machines [412:18] for example in this server [412:20] then which one, which application port I [412:23] should [412:24] send it to. So when it is received, it [412:27] will go to the one that is functioning [412:29] or expecting communication on port 80. [412:33] What is a port? We'll talk about that. [412:35] So think about it as a unit and it has a [412:38] door. So each unit in a building has a [412:41] door. So this is going to the door or [412:44] the unit that has port 80 or has unit [412:47] number 80, apartment 80. So think of [412:50] ports like [412:52] units in a condominium building and this [412:55] is going to be the unit number. That's [412:56] what the port is but actually it is an [412:59] application port, a port that the [413:01] application is listening on to find out [413:04] if anyone needs to talk to it. Think [413:07] about it as a local extension in a phone [413:10] system inside the building. So extension [413:12] number 80 should receive this message. [413:18] So it gets here. Now the server knows [413:21] which one should receive the [413:23] communication for port 80 and it will [413:25] send it to it. [413:27] If this is listening on port let's say [413:29] 443 [413:30] and this is listening on port 22. These [413:33] are all legitimate ports but we're going [413:34] to talk about them later on. [413:37] So in that case, this server, the [413:39] software in this server should be able [413:41] to tell which one is the port 80 [413:44] application and send the traffic to it. [413:47] Now if it is to respond, what will [413:49] happen? It will be from and in this case [413:53] it will be the IP address on the server, [413:56] which is this IP address the port on the [413:59] server, that's the sender now because [414:00] now we are talking about the response [414:03] port 80 on the server and it will be [414:05] going to 100.2.55.33, [414:08] which is this IP address and to which [414:11] port? To the original port that sent it, [414:13] which was 55,000. [414:16] So now if I have multiple client [414:18] softwares running here, the one or the [414:21] unit number 55,000 is the one that will [414:24] get it. So the others are not going to [414:26] get the response by mistake. And this is [414:28] exactly how when you open your browser [414:32] and you have 10 tabs open and each one [414:35] is going to a different website, you [414:37] will never find that the first tab for [414:40] example is going to see cnn.com. When [414:42] the response comes, the page of cnn.com [414:45] you will never see it on the second or [414:46] third or fourth tab. You will always get [414:48] it in the right tab. Even if you are [414:51] working on a different tab, you will [414:52] find the data of cnn.com in the same [414:54] place, in the same tab that you have [414:55] opened. This is because of the ports. [414:59] A quick recap. [415:01] Source IP and destination IP are not [415:03] enough headers to be sent with the [415:05] packet. We need source port and [415:07] destination port as well. [415:14] All right, so let's talk now about the [415:15] first model or the main model when it [415:18] comes to networking, the open system [415:20] interconnect or interconnection or the [415:22] OSI reference model. What is that? [415:26] Oh my goodness. This is not my drawing. [415:29] This is the source for the drawing. [415:32] But [415:33] this is a seven layers model. [415:37] All right. It looks like a building to [415:39] me [415:39] or at least the skeleton of a building. [415:42] But what is that for? So the OSI model [415:44] is just a framework, a collection of [415:47] standards [415:49] that breaks down how data travels across [415:52] a network from the user [415:55] using an application, let's say Chrome [415:57] for example [415:58] until it reaches, so if this is on this [416:01] side, until it gets to the server on the [416:04] other side. So from the user that from [416:06] the application, the client application [416:09] through the network [416:11] through the LAN and WAN until it gets to [416:14] the other side and it is received and [416:16] comprehended by the receiver. That's [416:19] what the OSI layer defines. [416:21] So the different layers will define [416:23] things like what are the standards for [416:25] cabling. [416:26] So that would be the first layer. The [416:28] physical layer will identify that. [416:31] And what type of cables we can use, and [416:34] what type of signals, and what is the [416:36] standards for the optical signals, and [416:39] what's the standard for the electrical [416:41] signals, and what's the length of the [416:43] cable, and how many wires should we use, [416:45] and what type of wire should we use, [416:47] what type of connectors we should use. [416:50] All of that is defined as standards [416:53] such that if we bring one connector from [416:56] China and one cable from Brazil, and [416:59] then we get the copper wires [417:02] from the US, and we get the crimping [417:05] tools from Japan, or the tools that we [417:08] use to make the cable, all of them are [417:10] going to work [417:12] without any issues. And when we connect [417:14] that to hardware switches or routers [417:16] that are coming from Taiwan, for [417:19] example, and they're coming from [417:21] Vietnam, then all of that is going to [417:23] work without any issues. Why? Because [417:26] everyone is following the standard, and [417:29] that is why it ends up working like [417:31] charm without any issues. [417:33] All right. For the switches, then the [417:36] second layer, the data link layer, will [417:38] specify [417:40] any required information and standards [417:43] about the switches, like the protocols, [417:45] the protocols for the LAN, the protocols [417:48] for wide area network, the protocols for [417:50] data center, as far as switching is [417:53] concerned and NIC cards are concerned. [417:56] All of that is defined here. [417:57] So, if you bring in [418:00] a laptop or a server that has a NIC [418:02] card, a network interface card, that you [418:04] bought from China, the server is from [418:07] Korea, and then you bring in the cable [418:11] from Taiwan, and you connect all of [418:13] these, and you connect it to the switch [418:14] from the US, all of that is going to [418:16] work without any problems. This is going [418:18] to be data link layer, as it is called. [418:21] So, it defines the standards for [418:23] switching and related. [418:25] Then we have layer three, and please [418:27] note that there are seven layers, and [418:29] that's why when we say layer one, layer [418:31] two, layer four, layer seven, you know [418:33] what we are talking about. So, when we [418:35] say that a device functions at layer [418:37] seven, then you should understand that [418:39] it understands all the application [418:41] headers and stuff that like that. [418:44] The most important ones that always are [418:48] relevant are layer three, layer four, [418:50] and layer seven. You need to know these [418:52] like the back of your hand. What do they [418:54] do? What's their function? [418:57] Layer three is about the network, so it [418:59] defines the standards for the routers, [419:02] the interfaces, the routing protocols, [419:05] the ping ICMP, [419:07] IPsec. We'll talk about it later on for [419:10] scrambling the data. IP, [419:12] OSPF, a lot of things will function at [419:15] this layer [419:17] that have to do with routing. [419:20] Then we get into the fourth one, the [419:23] transport. So, this is the bus that will [419:26] take the data from one side and will [419:30] establish a connection with the other [419:31] side, and then we'll send the data down [419:34] to get there. So, that's the transport, [419:36] the connection between the two sides [419:39] that needs to be done. [419:40] And this will define a lot of things [419:42] that we are going to discuss, TCP, UDP, [419:44] SSL, TLS. We are going to talk about all [419:46] of these. [419:47] Then we have session, which is [419:50] controlling the communication. You are [419:53] opening your browser and you're talking [419:55] to the [419:56] website or the [419:58] e-commerce, amazon.com, for example. So, [420:01] that session between your application [420:04] and the other side, who's managing that? [420:06] That will be the session layer. [420:08] In the two sides, by the way. [420:10] And then we have the presentation. So, [420:12] this one defines the session information [420:14] and how the session should be between [420:17] the two sides, how to open the sessions, [420:19] how to close the sessions, what are the [420:21] messages exchanged for that. This is all [420:23] at the session layer. [420:26] And then we have the presentation that [420:28] decides how the data should look like, [420:30] and if there is any scrambling for [420:32] security, which is called encryption, [420:34] we're going to cover that later on. [420:36] If it is required, then this layer will [420:39] take care of that. And then we have the [420:40] application layer that defines if you [420:43] are working with DNS, HTTP for browsers, [420:46] or HTTPS, and all that stuff. [420:49] All right. Each one of these layers [420:51] define the standards and how the [420:54] protocols or the frames or the format of [420:57] the data should be at every single [421:00] layer, how to establish a session, how [421:02] to establish a connection between the [421:04] two sides, how the network should look [421:06] like, and how every one of these headers [421:08] related to these services or functions [421:12] will be identified in the packet, and it [421:15] has to be standard across everything, [421:17] and that is how [421:19] the end points, they will be able to [421:22] communicate without any problem. Okay? [421:24] So, the framework [421:26] in seven understandable steps, each one [421:29] doing a specific job, that's for a [421:32] successful communication from one end [421:34] device, let's say my laptop, with a [421:36] server in a data center. [421:39] The packet, as it starts, it will start [421:42] at the user. So, the user will open the [421:44] browser, let's say, for example. It [421:46] doesn't have to be a browser, it could [421:47] be a client, Uber, for example, Uber [421:50] application, or Google Maps, and going [421:53] to the Google server. [421:56] So, the user will start whatever he is [421:58] doing here or she is doing here, [422:00] and that will be the payload, the data [422:02] itself. [422:04] So, the stack of TCP, [422:07] or the stack of services that have to do [422:10] with networks inside your laptop or her [422:13] laptop or his laptop, [422:15] the [snorts] application layer is going [422:17] to start getting that data and then [422:20] deciding on what headers are going to be [422:22] added and how to facilitate its access [422:25] to the network. [422:27] The presentation layer will look, do we [422:29] need any scrambling? Do we need to add [422:31] any headers that relates to that? And [422:32] then the session layer will decide how [422:34] the session would be and will manage the [422:36] session. [422:37] So, these three are going to prepare the [422:40] data [422:41] the right way, so it will be sent to the [422:43] other side. If it needs scrambling, if [422:45] it doesn't need scrambling, how it [422:46] should look like, if there are any [422:47] headers to be added, and so on. [422:50] Then it gets down to the function that [422:54] does the transport layer. Everything we [422:56] are talking about right now is inside [422:58] the laptop. [423:00] So, we're not going to go through layers [423:02] in shelves and all that. It's all inside [423:04] the laptop, so please use your [423:06] imagination that there are components in [423:09] the software and hardware in the laptop [423:11] that are going to do these functions. [423:13] Which component? Who cares? [423:16] You are not the software developer right [423:18] now. You are just starting. Maybe later [423:21] on in the future you will understand [423:23] this very well, and you will start [423:24] developing to these different functions. [423:28] But for now, these functions exist in [423:30] every one of our devices, even your your [423:34] phone, iPhone or Android, it does have [423:36] all of that. [423:39] This is the IP stack or the TCP/IP stack [423:42] inside your laptop or phone or iPad that [423:45] will be doing this. Okay. [423:47] Now, the transport layer [423:49] needs to add headers. Why? Because it is [423:52] the transport from here to there, to the [423:55] other side. Is it directly? No, but it [423:58] has to add headers so the other side [424:00] will understand. Do we need to open a [424:03] connection or not? [424:04] Do we need to follow the sequence of [424:06] each packet? So, if one is missed, then [424:08] I need to tell you. Do we need to have [424:10] flow control? So, if you're sending too [424:12] much, I need to slow you down. Do we [424:14] need to have extra communication, [424:16] basically, to ensure that there is [424:18] nothing missed, nothing is received in [424:20] error or out of sequence, and if [424:22] anything is missed, then we can talk and [424:24] you can resend it again? [424:25] If we need to do that, or just I will [424:27] send you whatever I will send, receive [424:29] it, and if we miss anything, who cares? [424:32] And both of these are valid options when [424:34] it gets to a transport layer. [424:36] So, the transport, it's going to add its [424:39] own headers, the bits and pieces, and [424:42] will deliver it. Okay, now it's time to [424:44] ship it through the network. So, what do [424:46] we need to do? We need to give it to the [424:48] layer that understands routing and [424:50] understands IP addresses and understands [424:52] BGP, for example, if that's required, [424:54] and other stuff. [424:56] So, network address translation also [424:58] happens at this layer. [424:59] Do we need to add headers? Of course. [425:02] That header exists, and here's our [425:04] original data, [425:05] and now an IP header is added. Source, [425:08] destination IP addresses are added, and [425:10] if anything else is needed. At the [425:12] transport, this is the source port and [425:15] destination port will be there as well. [425:19] Goes through the switch. For the switch [425:21] to deliver to the different ones in the [425:23] same local area network, then probably [425:25] headers are going to be added. Also, [425:27] these are called data link or link layer [425:29] or link two headers. [425:32] Once this is done, it is ready now to go [425:34] out on the NIC card to the network, to [425:37] the local area network, and then [425:38] possibly to the another router or [425:41] something. [425:43] So, it will filter down to now, if you [425:46] are holding your iPhone connected [425:47] through Wi-Fi, then this has to be [425:49] converted into frequencies in the [425:52] wireless LAN. [425:54] If this was a wired copper port into a [425:57] switch, then it will be converted into [426:00] electrical signals to be sent through [426:02] the copper wire. If it was optical [426:04] cable, fiber optic cable, then it will [426:06] be converted into light signals to be [426:09] sent. Who is going to do that? That is [426:11] the physical layer. [426:13] So, this [426:14] path from the source, from the [426:17] application until it gets to the [426:18] physical layer, is called encapsulation. [426:21] Why is that? Because we have the data, [426:23] and imagine how many times we have added [426:26] things around it as if it is a capsule [426:28] at the end. We are encapsulating the [426:29] data. We are including the data but [426:32] adding a lot of headers around it. [426:35] Now it gets as a series of binary zeros [426:39] and ones either presented as electrical [426:41] signals or light signals or however [426:44] it gets to the other side. The physical [426:46] layer here it needs to do the reverse [426:49] process de-encapsulation. [426:52] So the physical layer here is going to [426:54] translate that into what is acceptable [426:58] for the data link layer. So the data [427:00] link layer will be able to read any [427:03] information required for the data link [427:05] and comprehend it and find out if it is [427:07] for me or for someone else then it's [427:10] going to remove layer two headers and [427:12] it's going to pass it on [427:15] to the network layer. The network layer [427:17] would look at the source and destination [427:19] IP where this is going. If it is to me I [427:22] will process it else if I'm a router [427:24] then I'm going to send it. [427:26] If it is a router it will end at this [427:28] layer and it will not have a lot of [427:30] information above. [427:33] Now if this was the server as we are [427:35] showing here then it will pass it on to [427:38] the transport layer to understand okay [427:40] was that supposed to be a connection [427:43] oriented communication or [427:45] connectionless? [427:46] Do we need to [427:48] look at the sequencing and all that or [427:50] not? Do we need to do retransmission or [427:53] not if something is missing? And it [427:55] understands the protocol or the port [427:57] it's going to is it going to HTTP 80 [428:00] for example or port 80? If it is going [428:02] to port 80 then it will remove each one [428:05] after it does the processing it will [428:08] remove the header and will leave the up [428:10] the headers for the layers above. [428:13] If this was a router then the router [428:15] will pass it on. So it will process the [428:17] network layer will look at any filtering [428:19] required and then it will pass it on to [428:21] the next router or the or to the server [428:23] at the end but this is not our case. [428:25] We're using a simple case [428:27] that they are both [428:28] close to each other. There are no no [428:30] hops or no devices in between. [428:33] So now it goes up session layer [428:35] reads the information presentation layer [428:38] and then it goes to the application [428:40] layer. Now the application here will [428:43] understand it and then the application [428:46] will become when it for the response it [428:48] will become the sender and here will be [428:50] the receiver. So as if we are going to [428:52] reverse the functions encapsulation for [428:55] the response and then de-encapsulation [428:58] at the laptop level for the response. So [429:01] that's exactly how it happens. If we [429:03] didn't have all the standards and we did [429:05] modularize the different functionalities [429:08] the TCP/IP stack inside any device would [429:11] have been a nightmare. But now since we [429:13] have broken these into functions and [429:15] standards and all that it's easy for a [429:18] company for example to specialize in [429:20] only doing the scrambling function of [429:23] data [429:24] or only a deployment of a new protocol [429:28] at the transport layer for example or a [429:30] a new function at the transport layer. [429:32] So they can focus or zoom into [429:35] a specific functionality and develop for [429:38] that functionality only. [429:41] So the source software will takes the [429:42] data from the application flows down [429:45] through the different layers to the [429:46] physical layer. This is called [429:48] encapsulation and then at the receiving [429:51] end we do the opposite which is called [429:53] de-encapsulation. From the physical up [429:55] is de-encapsulation from the application [429:58] down is encapsulation. [430:02] Here's an example. Let's say a user is [430:05] going to open a browser and needs to get [430:07] to a webpage on the server. So what [430:09] happens? [430:11] So the browser will send the HTTP [430:13] request that is a layer seven activity [430:16] which is done by the application layer. [430:20] An HTTP [430:22] and we're going to talk about this this [430:23] is a standard protocol that is defined [430:26] at layer seven will create the request [430:28] like for example get for me a get [430:31] request to read the [430:34] HTML file of the website. [430:36] So the webpage of the website simply. [430:39] But this is still layer seven and this [430:41] is all happening now at whatever [430:44] the the browser functionality that will [430:46] take care of of that inside the sender [430:50] or the client. [430:52] Now the HTTP data [430:54] is handed to the to TCP at layer four [430:58] which is the transport layer. [431:01] Which adds a TCP header that includes so [431:04] this is the data after the browser has [431:06] prepared it [431:08] with session and presentation. Now it [431:10] gets to transport transport will add a [431:12] TCP header. [431:14] What is TCP? We'll talk about that. [431:16] It will talk about what is the source [431:18] port. [431:19] A random port. [431:22] We'll talk about these ports later on. [431:24] Destination port is going to be to be [431:26] port 80 for HTTP. So now the transport [431:29] is saying who is the source port source [431:31] application client application and what [431:34] is the destination port on the server on [431:36] the other side? [431:37] This is where the port number appears [431:39] and then it goes down to layer three IP [431:42] to add the source IP and destination IP [431:45] layer two and then out to the network. [431:47] So hopefully this makes it clear in [431:50] addition to the previous slide. [431:53] What are the benefits of doing that? [431:55] Standardization and interoperability. [431:58] And that allows all software and [432:00] hardware vendors [432:02] to make products that are interoperable. [432:05] It's a layered troubleshooting. When you [432:07] have a problem that has to do with a [432:09] network go and look at the network. [432:11] When you have a problem that has to do [432:13] with ports not allowed allowed traffic [432:15] is blocked then we go and look at the [432:17] transport or configurations that have to [432:19] do with the transport. So we can focus [432:21] on specific layers while fixing problems [432:24] as opposed to if it was all one big [432:27] function then which part should we look [432:30] into? [432:31] It's an easier implementation of [432:33] networking [432:34] because it's easier to break down [432:36] understand and work with networking [432:38] components different components. [432:40] Modularity is very important as well. So [432:42] it allows smaller companies or some [432:44] companies to specialize in optimizing [432:47] some of the functionalities or modules [432:50] within the seven layers. [432:53] Let's now zoom into some of the [432:55] important layers and we'll focus on [432:57] layer seven four and three because these [432:59] ones are very critical and you will deal [433:01] with them a lot in your career [433:04] regardless what that is and especially [433:06] if you are into cloud engineering [433:09] network security or network engineering. [433:13] The OSI model layers we have the [433:14] application which will prepare the data [433:16] as we mentioned. We have the [433:17] presentation that will format and [433:20] scramble or encrypt the data if [433:22] required. We have the session that will [433:24] start and stop the sessions to the [433:26] receivers. We have the transport that [433:29] will ensure the message will get to the [433:30] receiver fully and in sequence if [433:32] required. We have the network that will [433:35] find the best path the IP routing [433:37] through the network. We have the data [433:39] link layer that will add the delivery [433:41] details at the switch level or the LAN [433:43] level if you will. [433:44] Physical layer that will identify [433:47] standards for the cables and if it is [433:49] Wi-Fi or signals that will carry the [433:51] data. So this is an abbreviated [433:53] definition of the function of each one [433:55] of the layers. [433:59] Let's zoom into layer seven the [434:01] application layer. [434:02] So the application layer is the closest [434:05] to the end user. Of course because we [434:06] said it will be built into the browser [434:09] for example. So this is where the client [434:11] sits and that's the browser in front of [434:13] him or her and they start working on it. [434:16] So this is where the users will interact [434:18] with the applications [434:20] and this will provide the application [434:22] layer is not the application itself. [434:24] It's a functionality within the browser [434:28] that will take the data that you want. [434:29] You want to go to cnn.com. So it will [434:31] take that and it will translate it into [434:35] how should the data look like when I [434:37] want to go to cnn.com? [434:39] So it will provide network services to [434:41] the applications like browsers or email [434:43] clients and file transfer. [434:47] And it's not the application itself but [434:49] provides the services to allow the [434:51] application to use the network or to [434:54] work over the network. [434:56] And it will handle the requests and the [434:58] response operations between the sender [435:00] and receiver or the user and [435:03] the other side by handling the lower [435:07] layers. So between the user applications [435:09] and the lower layers that are available [435:11] at the user side so it can get to the [435:13] other side correctly. [435:16] So think of the layer seven as the layer [435:19] that will let the applications like [435:20] Chrome or Outlook use the network [435:24] through the laptop or the iPhone or the [435:28] Android phone through the network until [435:30] it gets to the right place. That's layer [435:32] seven. [435:33] Any device that has the intelligence of [435:37] understanding what's happening in layer [435:39] seven is usually an expensive device and [435:43] it's an advanced device. [435:46] Next one we're going to discuss [435:48] transport layer layer number four. [435:51] This layer creates the end-to-end [435:53] transport between the two communicating [435:55] hosts between the sender and receiver. [435:58] The ports are added and interpreted or [436:00] read here. So when one says I'm from [436:03] port 55,000 as a source the port will be [436:06] added at the transport layer. [436:08] And also where it is going it's going to [436:10] cnn.com on port 80. [436:12] Then the destination port is going to be [436:15] also identified here and then added in [436:17] the TCP header. [436:20] Then we have the third layer that we [436:21] need to zoom into, which is the network [436:23] layer. And as you understand, it's the [436:26] IP layer. Basically, this is the main [436:28] protocol that operates here. [436:30] And it will move the data between the [436:33] two hosts that are not physically [436:35] connected. [436:36] So, [436:37] it will do the routing decisions, what [436:40] to do, is it in the same network or in a [436:42] different network, do I need to send it [436:44] to the router or it will be reachable [436:45] through the switch? All of that [436:47] intelligence happens at this layer. [436:50] And it uses the logical IP addressing. [436:52] So, the source and destination IP [436:53] addresses are going to be added here. [436:56] And we have the source port and [436:57] destination port from the transport [436:59] layer. [437:01] Examples of what functions here also is [437:03] IPsec, network address translation, and [437:06] dynamic routing protocols. [437:08] Hopefully, that was easy to understand. [437:10] The OSI layer is very, very important. [437:13] And if you don't get your head around it [437:15] for whatever reason, [437:17] know what layer three, layer four, and [437:19] layer seven are for because these ones [437:21] are going to come and as bumps in your [437:24] way if you don't understand them very [437:26] frequently. [437:30] So, the OSI model that we have [437:32] discussed, how is that related to the [437:34] TCP/IP model? There is a model called [437:37] TCP/IP. [437:39] What is the relation of the OSI model [437:40] also to the network devices? [437:44] So, for networking devices, where do [437:46] they function at the OSI layer? [437:50] So, routers will operate at the network [437:52] layer. [437:54] And switches will operate at the data [437:55] link layer, which is layer two. [437:57] And we'll see later on when we talk [437:59] about firewalls, they could be [438:00] functioning here or they could be [438:02] functioning here as well. We'll talk [438:03] about that later on. [438:06] The TCP/IP model [438:08] is also built for the same purpose. [438:12] But the TCP/IP model combines these [438:15] three layers into one layer called the [438:17] application layer. [438:19] And then we have the transport, we have [438:21] the network, and the physical and data [438:24] link layer are called the network access [438:25] layer. [438:27] So, here we have four layers, here we [438:29] have seven layers. [438:33] Now, let's start with TCP/IP protocols. [438:36] Let's understand what is a protocol and [438:38] why is that important and some common [438:41] protocols that we are going to come [438:43] across frequently in your career, [438:46] whether it is network or anything else. [438:52] So, first of all, what is a protocol? [438:54] A protocol is a standard set of rules. [438:58] So, there are a number of documented [439:00] rules agreed upon. For what? [439:03] In networking, for formatting and [439:05] processing data that computing devices [439:08] need to know how to send messages. So, [439:11] this set of rules or protocols agreed [439:13] upon in a protocol that is known and [439:17] standardized across the globe [439:19] will allow the computing devices [439:21] understand how they should send [439:24] messages. [439:26] So, how to create them, which headers, [439:28] what is the length of each header, which [439:30] one to put before the others, which one [439:33] to put after the payload, which one to [439:35] use before the payload. This is the set [439:38] of protocols such that developers who [439:41] are creating applications that will use [439:44] these protocols or need to communicate [439:46] with others. For example, [439:48] if someone is developing a new browser. [439:51] So, let's say Chrome, Safari, and [439:53] Firefox, there is one that is coming up [439:55] and it's much better than them. [439:58] However, that browser needs to [440:00] communicate with existing websites. The [440:03] existing websites are using a protocol [440:05] called X. [440:07] That browser needs to understand the [440:09] details of the X protocol and then [440:12] develop according to that such that the [440:14] browser will format or create the proper [440:17] format of messages. And when it receives [440:20] messages as well, it will be able to [440:22] understand them. [440:23] And if anything goes wrong or something [440:26] sent was not as per the protocol, then [440:29] there should be some errors exhibited. [440:32] And that should be all agreed upon. [440:35] So, for example, with websites, whether [440:37] you know it or not, we all use HTTP and [440:39] HTTPS, the hypertext transfer protocol. [440:44] So, that is a standard, even if you [440:46] bring an application from Taiwan, from [440:50] China, developed in Vietnam, [440:52] and then you use it with websites in the [440:54] US, in Germany, or in India, it will [440:57] work. [440:58] Because they are following a standard [441:00] formatting of the protocol. When would [441:02] the problems arise? When the format is [441:05] not per the standard. Network protocols [441:07] are used as a common language to enable [441:10] network hosts to communicate. So, the [441:11] only reason we create protocols is [441:14] interoperability and for the successful [441:17] connection and communication between [441:20] computing devices and the softwares on [441:22] them or the servers and the softwares on [441:24] them. [441:26] Just to give you an example, for the [441:28] application layer, there are certain [441:30] protocols that are widely recognized [441:32] like HTTP, HTTPS, DNS, SMTP for email, [441:36] FTP for file transfer, NFS for file [441:39] system, SSH for connectivity. [441:42] At the presentation layer, we have the [441:44] ones that deal with scrambling the data [441:46] or encryption, TLS [441:48] and uh SSL. TLS is the newer version of [441:52] SSL or the successor of SSL. [441:58] Then, if we look at the transport layer, [442:00] we'll find that we have TCP, UDP, and [442:02] some functionality of the encryption or [442:04] scrambling also happens here. Some [442:06] documentation will tell you that [442:08] encryption happens here, some [442:09] documentation will tell you that it [442:10] happens here. Anyways, the recognition [442:12] of the ports must happen at the [442:14] transport layer. [442:16] At the network layer, we have IP, [442:18] Internet Protocol, ICMP, the Internet [442:21] Control Message Protocol, Network [442:22] Address Translation, Address Resolution [442:25] Protocol, IP Security. These happen at [442:27] the network layer. So, these are [442:29] examples. [442:32] TLS and SSL, that's why we have the star [442:34] here that it has functionalities across [442:36] layer four and layer six, the transport [442:38] and the presentation. [442:41] So, we mentioned TCP and UDP at the [442:44] transport layer. So, what is that? TCP [442:46] is Transmission Control Protocol and [442:49] that is the TCP in the TCP/IP keyword. [442:53] Transmission Control Protocol is a [442:54] protocol used at the transport layer, [442:57] layer four. [442:58] The number of protocol is protocol [443:00] number six. [443:02] Used at layer four means it has to do [443:04] with establishing the connection if [443:06] required between the two parties, [443:08] between the two communicating parties. [443:10] So, a connection is established in TCP. [443:13] The two parties must establish a [443:16] connection between the client and the [443:18] server before data is exchanged. And if [443:20] this fails, data will not be exchanged. [443:23] So, if we think that the client is a [443:25] laptop and the server is a virtual [443:27] machine or a physical server with an [443:29] application, [443:30] then they have to send a SYN. This is [443:33] part of the TCP handshake. [443:36] The client will send a SYN message, [443:38] synchronize message. [443:41] The server, because it understands TCP [443:44] and it knows the protocol, it will [443:46] understand that this format is for a [443:47] synchronization message. Someone is [443:49] trying to establish a connection with [443:51] me. So, [443:52] after that, they will exchange data with [443:55] me. [443:56] So, it will send a SYN ACK, [443:58] acknowledging the SYN. So, this is again [444:00] a message that is well known in the [444:02] protocol TCP [444:04] indicating that, "Okay, fine. I have [444:06] seen your SYN and I am ready now to [444:10] start the connection." [444:12] Then, the client is going to send an [444:13] acknowledgement saying, "Thumbs up. [444:15] Let's go ahead and start to [444:17] communicate." [444:19] In this connectivity on this connection, [444:21] now they will maintain the sequencing. [444:24] So, the sequencing of message, ensuring [444:26] that messages are delivered in sequence. [444:28] If one is received out of sequence, then [444:30] the server will send an and say, "You [444:33] didn't send me this message. Please [444:35] retransmit that message because I didn't [444:37] get it." [444:38] They will make sure that the messages [444:39] are received without errors and with [444:42] acknowledgements of the receipt and [444:44] retransmission if there are any missed [444:46] or unreliable or erroneous packets. [444:49] Basically, [444:51] this kind of communication ensures that [444:54] 100% of the data is delivered, nothing [444:57] is missed, and nothing is erroneous. [444:59] That is what TCP is all about. [445:02] Of course, this is reliable, but it can [445:04] be slow because you are retransmitting [445:06] and you are sending a lot of [445:08] acknowledgements and and SYN and SYN [445:10] ACK, establishing connections first. So, [445:13] if the connection is for whatever reason [445:14] not established, no communication will [445:16] happen, and so on. [445:18] TCP would use it when you are dealing [445:20] with critical applications and critical [445:22] data that you don't want anything to [445:24] miss. [445:26] Examples, [445:27] websites, email. You don't want to send [445:29] an email and then half of it will be [445:31] missed in between. [445:32] And file downloads. You want to make [445:34] sure that your downloads are complete [445:36] without missing anything, without any [445:38] corrupted data. [445:41] Previous one is reliable but slow. [445:43] What if we are dealing with voice? [445:46] Voice calls over the network. We're [445:47] dealing with video streaming. What if we [445:50] are dealing with games that has a lot of [445:52] graphics and and is sensitive to [445:54] latency? [445:55] Then in that case, you can use UDP, User [445:58] Datagram Protocol. [446:00] So, these are the two major [446:02] types of connectivity at the transport [446:05] layer, either TCP or UDP. [446:07] So, again, it's used at layer four, but [446:09] this is protocol number 17. The previous [446:11] one was number six. [446:13] TCP was number six. It does not [446:15] establish a connection. It doesn't use [446:17] sequencing, error control, flow control, [446:19] or acknowledgements. So, just send and [446:22] best effort. If I receive it, good. If I [446:24] don't receive it, who cares? And one [446:26] might say, "Okay, but you might lose [446:28] data here as well." But, think about it. [446:31] Think about voice calls. [446:33] So, I'm talking to you over the phone [446:35] and that is voice over IP. We're using [446:37] an application over the internet, Skype [446:39] or Zoom or something. And let's say [446:41] we're doing audio only. Now, if I was [446:45] speaking and you were following and then [446:47] some voice got or was broken or some [446:52] words were scrambled, you didn't [446:54] understand me, or maybe some noise got [446:56] in between. What would you say? The two [446:58] parties [446:59] the receiving end, which is you, you [447:01] would say, [447:03] "Your voice is breaking up. Can you [447:04] please repeat? I didn't get the last [447:06] sentence, right?" So, the applications [447:08] or the users are going to correct or [447:12] request the retransmission, not the [447:14] application itself. Same thing for [447:16] video. If we're doing video conferencing [447:19] and then the video gets distorted [447:21] somehow, you would tell me, [447:23] "Can we close the connection and and [447:25] start again?" [447:27] And then when we start, everything looks [447:28] fine. So, the two ends can fix problems [447:32] if they happen. They can realize [447:33] problems and fix them. For games, it [447:36] will show in the games as well. So, user [447:39] datagram protocol is important when we [447:41] don't really care about missing some [447:43] data because the two parties [447:45] communicating can [447:47] fix or detect that, but we need the [447:49] speed. [447:52] So, this is just sending a request, the [447:54] server will respond. There is no SYN or [447:56] SYN-ACK or acknowledgement. There is no [447:58] establishing a connection beforehand. [448:01] So, it's faster, but not reliable [448:03] compared to TCP and use cases include [448:06] online games, voice calls, video calls, [448:09] and live video streaming. All right. So, [448:12] to recap quickly, a protocol is a [448:14] standard set of [448:16] formats, of message details, and error [448:20] messages that are used for the [448:22] successful communication between [448:24] different parties regardless or [448:27] irrespective of who is the developer of [448:30] the application or the software for as [448:32] long as they follow the definitions and [448:35] the rules in the protocol. All right? [448:41] Now, let's go ahead and look at some [448:43] common TCP/IP protocols that you will [448:45] come across. So, I'll give you some [448:47] examples of what you might face and you [448:49] will face in your engineering roles. So, [448:53] the first one is Internet Control [448:55] Message Protocol or ICMP. [448:59] Simply, the ICMP is a protocol that will [449:03] be used by one party or one device to [449:06] send a message, we call it ping, [449:09] and wait for a response to find out if [449:12] the server has received it and is alive [449:14] or not. [449:15] So, when I do ping 8.8.8.8 [449:18] on my laptop, whether it is in command [449:20] prompt in Windows or on Mac or on Linux, [449:24] for an IP address, and the IP address [449:27] can receive the this message. If the [449:30] server is alive, it will respond and [449:32] tell me that, "Yes, I'm alive." This is [449:35] called an echo request [449:37] and the response is called an echo [449:39] reply. [449:41] And here's a snapshot. We have seen it [449:43] before. If I do ping 8.8.8.8, this is [449:46] done from my MacBook, [449:48] then I'm pinging this IP address. So, [449:51] 8.8.8.8 is the domain name system or [449:55] service for Google. So, one server [449:57] in Google that is alive and accepts [450:00] pings and responds to them. [450:03] And this indicates a successful receipt [450:06] of responses and this is the time it [450:08] took from when I sent it until I [450:10] received it in milliseconds. [450:12] And if I stop it, here it tells me [450:15] statistics. Five packets were sent, five [450:17] packets were received, 0% packet loss. [450:21] It functions at layer three, very useful [450:24] in troubleshooting. However, some people [450:27] misuse this to find out if they are [450:30] scanning a network to hack it, [450:33] they will scan the IP addresses by [450:35] sending random ping messages to find out [450:39] if servers are alive and then they will [450:41] start to orchestrate attacks on these IP [450:44] addresses. [450:45] That's why some networks, they will [450:47] block ping and they don't allow it. So, [450:49] in that case, if you don't receive [450:51] response, it's not 100% the server is [450:54] not alive. [450:56] It could be that the security in the [450:58] network is blocking ping from reaching [451:00] the server and that's why it's not [451:02] responding. So, here if I had anything [451:04] at Google to stop ping and say no to [451:08] ping, don't allow ping, the server will [451:11] never receive the message, that's why it [451:13] will never respond. So, receiving a [451:15] response 100% means the server is alive. [451:19] Not receiving a response, if you know if [451:23] you know for sure that the server should [451:26] receive it if it is alive, there is no [451:28] security to stop that, then that [451:30] indicates the server is not alive. [451:33] But, if you don't know, you're trying to [451:35] ping, you are a a hacker and you're [451:36] trying to orchestrate an attack on a [451:38] specific IP address, you would like to [451:41] know if it is alive or not. In that [451:43] case, if that server stops or is not [451:46] allowed to receive a ping, that is not [451:49] an indication that the server is down or [451:52] not alive, you should try some other way [451:55] to find out. Of course, I'm not trying [451:57] to enable you to to hack servers on the [452:00] internet, I'm just telling you when you [452:02] are doing legitimate work on the [452:04] internet or in your network, how to use [452:07] the ping, and you need to be aware [452:09] whether the other side accepts pings or [452:11] not. [452:15] Now, let's look at another one, common [452:17] TCP/IP protocols. We'll look at the [452:19] secure shell or SSH. This is a secure [452:23] way for you to log in to remote devices. [452:28] When you log in to that remote device, [452:30] you are going to log in as if you were [452:32] physically on the device and then you [452:33] can start to type commands, [452:35] troubleshooting, or set up applications, [452:37] or whatever you want to do. [452:39] So, how does it look like? How does it [452:41] work? We have a server or [452:45] a device that accepts SSH connections. [452:48] So, it is a secure shell server. It can [452:52] accept clients to connect to it [452:54] securely. That's the whole reason. [452:57] And then you need an SSH client on your [452:59] side. So, the the client must have an [453:02] SSH client. [453:04] The server must have an SSH server. Any [453:07] Windows 10 and above [453:09] has SSH client and has SSH server [453:12] available. And if they are not [453:14] activated, you can activate them. It's [453:16] called OpenSSH. [453:19] All right. So, what happens in the [453:21] handshake? SSH is [453:24] connection-oriented [453:26] protocol. So, it runs on TCP. So, there [453:29] has to be a connection and SYN, SYN-ACK, [453:32] acknowledgement happening between the [453:34] two sides. So, the client will initiate [453:36] the connection to the server. [453:39] The server will send a key that the [453:42] client can use to scramble the data and [453:45] start to send the data. [453:47] So, they will negotiate the connection [453:49] parameters and then the client can use [453:51] that key in order to communicate with [453:53] the server. That key is used to scramble [453:55] the data. We're going to discuss [453:57] scrambling the data in the next module. [454:00] All right. So, whoever if if there is [454:02] any man in the middle that tries to copy [454:06] that data, they should not understand it [454:08] because they don't have that key. They [454:09] don't have the key phrase that scrambles [454:13] the data. [454:14] So, the data will be garbled, will be [454:16] scrambled, they will not be able to know [454:19] what it means. [454:21] And that's the whole point. [454:23] So, SSH, it's a secure way to remotely [454:26] access and control another computer over [454:29] a network. It could be over the internet [454:31] and it could be over a local area [454:33] network or a private network, local area [454:35] and wide area and so on. [454:37] Data transfer between the two ends is [454:40] secure, encrypted, scrambled. So, nobody [454:43] can see the data transferred over the [454:44] connection and SSH operates at the [454:47] application layer, layer seven, [454:50] and uses what I meant by uses TCP, it [454:53] uses port 22 at the transport layer. [454:57] Why is it at the application layer? [454:58] Because the presentation, as we [455:00] mentioned before, is responsible for the [455:02] encryption and that's why they say it's [455:04] at layer seven. However, the actual port [455:08] used is TCP 22. [455:13] It runs over port TCP 22 at layer four. [455:16] All right? [455:19] And SSH is especially useful for [455:21] managing and administering servers. [455:25] Example use cases, you would like to log [455:27] in to a remote Linux system to manage it [455:30] and run commands. That's a solid [455:32] example. Let's go ahead and do a demo [455:34] and show how this works. [455:39] So, let's go ahead now and do a demo. [455:41] What we'll establish is we'll have an [455:43] AWS Linux EC2 instance and we'll try to [455:46] SSH into it from a Mac or Linux client. [455:50] What am I going to try and do? How does [455:53] SSH work in AWS? So, we'll have a [455:55] virtual machine, Linux virtual machine [455:57] in AWS, an EC2 instance. And by default, [456:01] it has an SSH servers and it works the [456:04] following way. [456:06] When you try to connect to the When you [456:09] I'm sorry. a look here. When you try to [456:11] create the instance, there is an option [456:14] to create a key pair, an SSH key pair. [456:19] A key pair means we have a public key [456:21] that will stay in the instance in the [456:23] AWS side, and we have a private key that [456:26] you will download it, and you don't have [456:28] a choice. As soon as you create the [456:30] pair, it will be downloaded to your [456:31] laptop. We will see it in the demo. [456:34] So, the SSH key pair that we are going [456:36] to create is how the negotiation happens [456:40] for security between the two parties, [456:43] and the key will be used to scramble the [456:45] data on this side. [456:48] And the public key will be used to [456:51] decipher or unscramble or restore the [456:54] original message on the EC2 instance [456:57] side. [456:58] What if you try to connect via SSH and [457:01] you don't have the right private key? [457:03] The connection will be refused. [457:05] So, that's exactly how it works, and [457:07] that's what how we'll do it now. [457:11] Please remember that the public key [457:12] remains in AWS, [457:14] and a private key that will get [457:16] downloaded to your computer. [457:20] And the key pair is used for [457:21] authenticating the SSH connection to the [457:23] EC2 instance. [457:25] SSH server is like a security guard at [457:28] the entrance of an important place. The [457:30] client is trying to connect to the [457:32] instance, get into the instance, right? [457:34] So, the security guard, the SSH server, [457:36] will say, "Can you present your ID, [457:38] please?" And the ID in this case, the [457:40] analogy, is the private key that will be [457:43] presented with the connection request. [457:45] The server will look at the ID, and then [457:48] look at the list of people who are [457:49] allowed. [457:50] If the matching public key, remember we [457:53] said we create a key pair, so they are a [457:55] matching public private key. [457:57] If it finds a matching public key, it [458:00] will allow you inside and say, "Welcome [458:02] to the instance. You can now log into [458:04] the instance." [458:05] And afterwards, the same will be used [458:07] for the encryption, as we mentioned. So, [458:09] let's go ahead and do that in the AWS [458:10] console. All right, so here is my [458:14] console. [458:15] What we'll do now is we are going to [458:17] create a virtual machine [458:19] in AWS, in our custom VPC, [458:23] and we are going to create a key pair [458:25] and download it. [458:27] The instance must be accessible from the [458:29] internet, so we will launch it in public [458:32] subnet one that we have created before, [458:35] and we'll download that key pair. Then, [458:37] the instructions will be available in [458:40] the console on how we can connect to it [458:43] using SSH. [458:45] All right, so let's call this [458:48] testing [458:49] two. [458:50] You can call it whatever you want. The [458:52] name here doesn't matter, actually. [458:54] I'm going to go with AWS Linux as well, [458:56] so Amazon Linux. [459:00] And I'm going to use the free tier T2 [459:02] micro, because I don't want to pay any [459:04] money. [459:07] Key pair for login. We can use a key [459:09] pair to securely connect to your [459:11] instance. Then, absolutely, I would like [459:13] to create one. [459:17] I don't have any created, [459:19] and I'm still in United States, Ohio. [459:21] Please pay attention to where you are [459:22] exactly, and I'm going to create a new [459:25] key pair. [459:28] I'm going to give it a name, testing [459:33] two. [459:34] You can call it SSH test, SSH lab, SSH [459:37] demo, whatever you like. [459:39] Or let's let's do it a meaningful name, [459:42] SSH demo. I like that one more. [459:45] And I will leave everything else to the [459:47] default. It's {dot} pem. It has to be [459:49] {dot} pem, and I'll leave it to RSA, and [459:51] then click on create key pair. Notice [459:54] what will happen now. [459:57] See, a download has happened, SSH demo [460:00] {dot} pem. So, I have that right now [460:04] on my computer. [460:06] And if I click on where it ended, right, [460:08] as you can see, that this is the file, [460:12] SSH {dot} pem, [460:13] and it's asking me for key access. [460:16] So, you can find information about it, [460:18] and it here it shows that this is a [460:20] certificate standard. [460:24] Please make a note. This is extremely [460:26] important. Now, I know that it has been [460:28] in my downloads folder. In your laptop, [460:31] you need to find out. When you clicked [460:33] on the file, [460:34] it will show you where exactly in your [460:36] laptop it is. This is very important to [460:39] know. Is it in the downloads folder? Is [460:40] it in a user folder? Is it in a temp [460:43] folder? You need to find out where that [460:45] file is, because you are going to use [460:47] it. We are going to go into that folder, [460:49] and then try to connect. [460:51] Or at least we need to know the path, [460:52] how to get to it. [460:55] So, let me now [460:56] continue this, and then we'll come back [460:59] to the key. So, I'm going to click on [461:02] edit, because I want to make sure that [461:04] it's going to be in the custom VPC, [461:07] and I would like to make sure that it [461:09] will receive [461:10] enable a public IP address. [461:14] And for the security group, I'm going to [461:16] use the one that we created that is wide [461:19] open [461:20] for now, testing one VPC, because I [461:22] don't want it to filter or block any [461:24] traffic. [461:26] And [461:28] that should be it for now. So, let's me [461:30] just quickly look at this again. So, we [461:34] have an Amazon Linux, [461:36] we have a T2 micro free tier. [461:39] The key pair login, we have already [461:40] downloaded that. Remember that this is a [461:42] key pair. So, the one I have on my [461:44] machine is the private key. [461:47] The one that will be in AWS on the [461:50] instance or related to the instance is [461:52] the public one. [461:54] In any other documentation, they will [461:55] tell you the other way around, that the [461:57] public key will be with the client, and [461:59] the private key will be with the server. [462:02] Understand the concept, and don't stick [462:04] into the documentation differences, but [462:06] AWS, for sure, keeps the public, and [462:10] gives you the private. [462:13] All right, and it is in the right VPC, [462:14] and it is on [462:16] on the wrong subnet, actually. It's good [462:18] that we have reviewed it, and I need it [462:20] in the public subnet. If I put it in [462:21] subnet two or three or four, these are [462:24] private, so it will not work. [462:26] And we have a public IP address. So, now [462:28] I'm good to go. Let me go ahead and [462:29] launch the instance. Please always do a [462:31] revision before you create, because [462:34] I overlooked the subnet. Although I went [462:37] into the network, but while chatting [462:39] with you, [462:40] I did not notice that I had it on the [462:42] wrong subnet. So, this is very important [462:43] to do. [462:44] So, the instance is created, and here's [462:47] the ID. I click on the ID. [462:53] And now I have the instance. [462:58] Of course, this could be because the [463:00] distance that I have between UAE and [463:04] United States. [463:05] Okay, so I need to connect to the [463:07] instance. We have done before the [463:08] connect using EC2 connect, which is just [463:11] go down and click connect. This is not [463:13] what we want to try now. I want to try [463:14] the SSH client. [463:16] I want to use it not from the portal. I [463:18] want to connect from my laptop into the [463:22] instance through SSH and through the [463:25] internet. [463:26] So, here you will find the details. [463:29] So, let's find what is required to [463:30] connect. Open an SSH client. I have it. [463:34] In Mac, it is on the terminal or in the [463:37] terminal program. I can access that, and [463:39] it's enabled by default. [463:40] Locate your private key. Find out the [463:42] key that was downloaded. Where is it [463:44] exactly? [463:46] The key is going to be used to launch [463:50] this instance is SSH demo {dot} pem. So, [463:52] even if you forgot the name, here you [463:54] have the name of the key for this [463:57] instance. [464:00] The key usually has public permissions, [464:02] so anyone can use it. This is not [464:04] acceptable. When you want to do SSH, it [464:06] has to be [464:07] private and not publicly viewable. [464:11] So, you need to use this command on the [464:12] file. [464:14] Where do you apply this command? You [464:16] have to head inside the folder where the [464:18] file is. That's one way to do it, or the [464:20] easier way to do it, and then you type [464:22] this command. [464:23] Then you can connect to it using this [464:26] this command. SSH minus I, I want to SSH [464:29] into [464:30] the instance [464:32] using [464:33] this key, and consider that I am the [464:36] user EC2 hyphen user. [464:38] So, EC2 hyphen user, that's me. I would [464:41] like to connect to you, the server, [464:44] using [464:45] this key, and the connection will be [464:47] SSH. [464:49] So, now this is going to format a [464:51] packet, an IP packet from my browser, [464:54] that will be having a destination of [464:57] 18.191.168.182. [465:00] The source IP address is going to be my [465:02] laptop IP address, which is a private [465:04] IP, because I'm using it in a Wi-Fi [465:06] network. [465:07] When it gets to the router at my [465:10] location, the router will do NAT, will [465:12] translate that. [465:13] What will be the port, the source port [465:16] on my side? It will be a random port [465:19] created from a range of available ports. [465:22] What will be the port for the [465:23] destination? It's going to be TCP port [465:26] 22. This is added at the transport [465:28] layer. [465:29] Then the network layer will add the IP [465:31] addresses, the source and destination, [465:33] and now the packet is ready, and it's [465:35] going to carry the key information along [465:38] with it. [465:39] This is how it will work. So, let me go [465:41] in terminal, and first of all, let's try [465:43] and see how the key looks like. What [465:45] What does this key look like? I know [465:47] that it has gone into downloads, and if [465:50] you notice here, I am into a folder [465:52] called ITF under downloads. So, what I [465:55] will do is I will do CD {dot} {dot}, CD [465:57] space {dot} {dot}. It will take me one [465:59] step up. [466:01] So, now if I do LS [466:03] SSH demo [466:05] {dot} pem, [466:07] I have the file. [466:09] So, let's open the file and find out [466:11] what it includes. Nano [466:14] ssh demo.pem. These are Linux or Mac OS [466:19] commands. These are not Windows [466:21] commands. I'm going to show you how to [466:22] do it on Windows. [466:24] And here is how the file looks like. [466:26] So, begin RSA private key. So, this [466:28] confirms it's the private key. And then [466:31] as you can see here, this is the key. [466:35] So, very hard. It's not like a password. [466:37] SSH can work with passwords as well, but [466:40] that is disabled by default on EC2 [466:42] instances. You can enable it if you [466:44] want. But this is way more secure. This [466:47] is a key, so that's a long string [466:50] and very hard to predict or to find out [466:54] what it is. [466:55] And the public key on the other side is [466:57] going to be as complicated. [466:59] And since they were generated using the [467:01] same generator, there is a way to check [467:04] if these two form a pair or not. [467:07] So, that's how it looks like. [467:09] All right, I'm going to exit. So, I'm [467:10] going to do control X. [467:14] And now what I need to do, I need to [467:15] change the permissions on the file. So, [467:18] I'm going to take this command, copy. [467:21] I'm going to go back into terminal [467:23] and I'm going to do this. [467:24] CHMOD, change mode 400 ssh demo.pem. [467:29] This will make the file a private file, [467:31] not a public file. So, let me before [467:33] doing this, let's try to connect and [467:36] find out what happens. [467:38] So, I'm going to jump to the last step, [467:41] copy this, and try to connect and see [467:43] what happens. [467:46] So, here it's telling me the [467:47] authenticity of this host [467:50] cannot be established. I don't know if [467:52] this is a secure host or not. However, [467:54] are you sure you want to continue? And I [467:56] will say yes. So, it's giving me yes, [467:58] no, fingerprint. [468:02] So, I'm trying to connect now. See what [468:04] happened? [468:05] Bad permissions on the file. [468:08] Why? The permission is denied because [468:10] it's a public key. You have to change [468:13] the permissions beforehand. It has to be [468:16] secure and this is unprotected [468:19] private key file. [468:20] So, SSH is smart. Even it checks whether [468:23] the key access is open or closed. [468:26] So, what I will do now is I'm going to [468:28] copy [468:29] not this one, this one again, to lock [468:30] down the permissions. I'm going to use [468:32] it. [468:33] And then I'm going to repeat. Let me [468:35] clear. [468:37] I'm going to repeat the same SSH [468:38] command. [468:40] Press on the arrow keys up and down. It [468:42] has the history and it repeats the [468:44] commands. [468:45] So, now I'm going to click. [468:50] And see what happened now? [468:51] I am logged into an Amazon Linux 2023. [468:55] And here it shows me that I am the EC2 [468:58] hyphen user, which was what I requested [469:00] here. [469:02] But here it's not showing me that [469:05] public IP address. It's showing me a [469:07] private IP address. Remember, network [469:09] address translation happens, right? What [469:11] I need to check to verify whether this [469:13] is the right one or not, I will just go [469:15] here. [469:17] I'll go back to the instance page [469:19] and I will check what is the private IP. [469:21] Here is the private IP, 172.31.2.144. [469:27] So, that's exactly where I am. [469:30] We can do [469:31] sudo [469:33] su, super user. [469:36] And I will start doing ping 8.8.8.8. Can [469:39] I get to the internet? [469:43] As you can see, I can get to the [469:44] internet from the device without any [469:47] issues. [469:48] And if I do control [469:51] C to stop it, [469:53] and then I'm going to copy the public IP [469:55] address, which is this right here. [469:59] So, now I am in the instance and I can [470:02] ping to the outside, to the to Google [470:03] site. If I do exit, [470:06] So, now [470:11] I have closed the SSH connection and I'm [470:13] back on my laptop. Now, can I ping the [470:16] instance? [470:19] Yes, I can. [470:20] So, now the instance is available on the [470:22] internet and I was able to connect to [470:24] it, to SSH into it. What if I need to [470:26] SSH again into the instance? Just use [470:28] the history commands and you can click [470:30] enter again and you will be connected [470:31] again into the instance. So, that's how [470:34] easy it works. But now I have a secure [470:36] connection. I am in Dubai in UAE [470:39] and the server is in Ohio in the US and [470:42] all this connectivity or the [470:44] communication between me and the server [470:46] is protected by the private and public [470:48] key pair. [470:49] All the information is scrambled. It's [470:51] encrypted and nobody can look at it or [470:55] understand it. They can copy it maybe, [470:57] but they will not be able to understand [470:58] it unless they have my private key [471:01] or the public key on the other side. All [471:03] right, hopefully this is clear and this [471:05] is for Linux and Mac. [471:07] We will look at how we can do this on [471:09] Windows. And it's exactly similar [471:11] process. All right, so since we are done [471:13] with the test, if you are not going to [471:15] continue working right now, please go [471:17] ahead and stop your instance and you can [471:19] bring it up later on. All right? [471:24] Let's now [471:26] use a Windows client. So, my machine is [471:29] going to be a Windows machine and we're [471:30] going to SSH into a Linux EC2 instance [471:34] in AWS. So, we're going to repeat the [471:36] same steps we did before [471:39] to create an EC2 instance, a Linux one, [471:42] but we are SSHing from a Windows [471:44] machine. [471:45] This is going to be a Windows client. [471:47] That's the only difference. [471:49] So, let's go ahead and do it. [471:51] All right. So, here is my Windows [471:53] machine as you can see at the bottom and [471:55] I'm connected to my AWS account and I'm [471:58] going to go ahead and create the Linux [472:00] machine. [472:02] So, let me put this one [472:05] little bigger. [472:06] Okay. Hopefully this is better visible [472:08] for you. [472:09] The response will be a little bit slow [472:11] because I'm using a Windows machine on [472:13] the cloud. So, this Windows client is in [472:15] AWS actually. [472:16] But it works exactly the same if you [472:18] were using Windows on your machine. [472:21] So, launch instance. [472:25] Oh, but let No, let's do it in Ohio. [472:28] So, to take advantage of the previous [472:30] settings we have done. All right. So, I [472:32] am now in Ohio. So, what I will do is [472:34] I'll I will call this win testing. [472:39] And I'm going to still choose [472:43] an Amazon Linux [472:45] and it's free tier as you mentioned [472:46] before. [472:48] And I will use T2 micro as well because [472:50] it is free. [472:52] Okay, and for the key pair, I'm going to [472:54] also create and download a key pair. So, [472:57] I'm going to create a new one. [473:03] And this I'm going to call it [473:05] win [473:06] win [473:10] file or win key. [473:13] And I'm going to leave it to .pem, [473:15] everything as is, and I'm going to do [473:17] create key pair. [473:20] It's funny when I increase the size how [473:23] slow this becomes. [473:28] Okay. [473:29] Okay, I want to show you this. [473:31] So, see on the right-hand side. I [473:34] apologize if the size is not [473:35] appropriate. Let me try to do it from [473:37] the browser, maybe it works better. [473:39] All right, hopefully you can see it now. [473:42] So, it has downloaded a file on my [473:44] laptop and that is the .pem file, the [473:47] win [473:48] key file. [473:49] And we are going to continue [473:53] our settings. So, I'm going to choose T2 [473:55] micro and that will be free tier [473:57] eligible as I mentioned. The key pair is [473:59] win-key. [474:01] We are going to locate the file where it [474:03] is exactly. [474:04] And for the VPC, as you know, we are [474:07] going to click on edit. [474:09] I'm going to choose the VPC custom. [474:16] And for the subnet, I'm going to choose [474:18] the subnet one public. [474:22] To make sure that it will receive an IP [474:23] address. This is very important. Auto [474:26] assign IP address must be enabled, [474:29] not disabled. [474:31] And select an existing [474:33] group security group, which is the [474:35] testing group. [474:37] So, this one. [474:40] All right, just to make sure custom VPC [474:43] and we have uh subnet public subnet one. [474:47] And everything looks good to me. So, [474:49] let's just make sure that we have [474:51] everything. It's a Linux [474:53] and we have the key and it's T2 micro, [474:56] right VPC and right everything. It's [474:58] always good to check [475:00] rather than finding out after [475:02] troubleshooting a lot that you did [475:03] something wrong and you'll have to redo [475:05] it again. [475:08] So, this will be our Linux instance [475:11] in the cloud that we need to connect to, [475:14] right? [475:15] So, we need to get some information from [475:16] the Linux in order to be able to work on [475:19] it. [475:22] Which is the connection and what's the [475:24] key and all that. [475:26] So, I'm going to click on connect. [475:29] See here, we have a private IP address. [475:33] And we also have a public IP address to [475:36] the instance, 18.191.252.228. [475:41] So, let me click on connect. [475:45] And I'm going to use SSH client. [475:50] And that will give me the steps that I [475:52] need. So, CHMOD 400 does not work on [475:56] uh CMD in the command prompt in um [475:59] Windows. [476:00] So, what we will do is this is this [476:02] would be the one that we are going to [476:04] use SSH minus I win and easy to use and [476:09] so on. [476:10] So let me go back now to the desktop. [476:12] I'm going to minimize Edge the browser. [476:17] So let me minimize this. [476:21] Okay, and I need to go back to my [476:24] Windows [476:25] desktop. [476:28] Which is this guy right here. [476:33] Okay, [476:34] so this is my Windows desktop. Let me [476:36] just resize it so you can better see [476:38] what I'm working on. [476:43] If I can really create this that will be [476:47] perfect. I don't want to see it in front [476:49] of my face all the time. [476:51] Okay, so what we need to look for is [476:55] where did the file go? So I can look in [476:57] the file system. I click on [477:04] and hopefully in downloads. [477:08] And let me look. Yeah, it is in [477:10] downloads. So it's very important to [477:12] locate where did the file go? [477:14] In order to find it. And win hyphen key [477:17] dot pem is the name of the file. All [477:18] right, now I need to get to the command [477:20] prompt. So what I will do is I'm going [477:22] to type CMD here and you will see that [477:24] it will show here. Double click on that. [477:27] So this is the command prompt. Whenever [477:29] you hear me talking about the command [477:30] prompt, this is what I'm talking about. [477:32] So let's relocate it to the middle of [477:35] the page. [477:37] And here let's enlarge it a little bit. [477:45] Okay, hopefully it's visible now. [477:48] So what I will do is I'm going to do CD [477:51] downloads. [477:53] And if I do dir just to check. [477:57] We have here [477:59] the file. [478:02] The win key dot pem. So what do I need [478:04] to do now? I need to get the command for [478:06] the SSH minus I to try and SSH from [478:09] here. [478:10] So where do I get that from? I get it [478:11] from [478:12] the browser window. [478:18] So let me minimize again and get to [478:21] Edge. [478:25] And I'm going to copy that from here. Oh [478:27] actually I had copied it. [478:29] Anyways, that's okay. [478:31] And I'm going to go to command prompt [478:32] again. [478:34] And let's try and see if it works. So [478:37] now I am on the same directory where the [478:40] win hyphen key dot pem file exists. [478:42] That's the easiest way. Of course you [478:44] can add the path and do it from [478:45] anywhere, but the easiest is locate [478:47] where that is. [478:48] Use CD and the name of the directory as [478:52] I did here in order to see let me just [478:54] make this a little bit bigger. So CD [478:57] downloads as you can see here. So I I [478:59] went into the downloads directory. So [479:02] you need to move to that directory where [479:04] the pem file exists and then from here [479:07] I'm going to try and hit enter and see [479:10] if it will connect. [479:15] I'm going to click yes. [479:17] Let's see what happens. [479:20] And as you can see I am connected into [479:23] the EC2 instance. Here it says Amazon [479:26] Linux 2023 [479:28] and here I have the EC2 and the IP [479:31] address and so on. [479:33] Now [479:34] I can [479:35] do sudo SU and do ping 8.8.8.8. [479:42] And that would be responding from the [479:46] Google server. So we can do this and we [479:48] can reach the internet without any [479:50] problems. We did SSH. The SSH is working [479:53] and now we are typing commands from the [479:54] instance to Google and everything is [479:56] working fine. That means the forward [479:58] path to Google is working and the [479:59] response is coming back as well. So life [480:01] is good. Do control C and it stops it. [480:05] And as you can see here, we have 0% [480:08] packet loss and we have sent this many [480:11] and this many were received and life is [480:12] good. [480:13] All right, so hopefully this is clear [480:15] how you can do it from Windows and this [480:17] is very easy as you can see. Don't [480:19] forget to terminate the instance because [480:21] we don't need it anymore here. So what I [480:23] will do now is I'm going to exit from [480:25] here. Exit. [480:28] And then another exit. [480:30] And now I'm back into Windows. I do CLS. [480:33] In Linux and Mac we do clear here CLS [480:36] and it will clear the window as you can [480:39] see. All right, so what I will do now is [480:41] I don't need the instance anymore. So [480:42] I'm going to go ahead and remove it. [480:44] Why? Because if you leave it for [480:47] extended period of time and if you are [480:49] not on the free tier [480:51] or if you have some credits and they [480:53] finish, you will start to get charged [480:54] and I don't want to [480:56] you to spend money if you can avoid it. [480:58] So what I will do now is I'm I'm going [481:00] to go into instance state and I am going [481:03] to go ahead and terminate the instance. [481:05] Thank you so much. [481:07] Resize it back and click on terminate [481:10] and delete. I need to check that it is [481:12] shutting down and that means it is on [481:15] the way to be terminated. So now you're [481:17] good to go. [481:18] All right, hopefully this was clear and [481:20] it is not problematic. [481:26] We are still with common TCP/IP [481:28] protocols and now we are going to look [481:30] at the HTTP and HTTPS. Whether you know [481:33] it or not, but whenever you use your [481:35] browser, be it Safari, Firefox, Chrome, [481:39] Edge, whatever or whichever browser that [481:42] you are using, [481:43] the communication between your browser [481:45] and the web server or the website or [481:47] amazon.com or wherever that you are [481:50] trying to get the data from [481:52] is based on HTTP, the hypertext transfer [481:56] protocol. [481:57] HTTPS is a secure version of that where [482:00] between you and the server, between your [482:02] browser and the server, everything is [482:03] going to be scrambled, is going to be [482:05] ciphered, encrypted, so nobody can read [482:09] it or make sense of it even if they can [482:10] get a copy of that traffic. So let's go [482:12] ahead and have a look. [482:15] Let's start with HTTP, hypertext [482:17] transfer protocol. [482:19] So it is a set of rules that web [482:21] browsers and websites [482:23] used to communicate with each other. So [482:25] this standard was primarily created for [482:28] the smooth and successful communication [482:31] between browsers and the websites. And [482:33] the websites can be anything. Can be [482:36] Gmail, it can be hotmail.com, it can be [482:39] British Telecom, it can be cnn.com, any [482:42] website. [482:45] So what does it do? It allows the [482:46] browsers like Chrome or Firefox to [482:49] request web pages for you to sign in to [482:52] your online banking for example, to look [482:54] at your accounts. These are different [482:56] pages on the websites. [482:58] And when the requests are sent, then the [483:01] website will understand what exactly you [483:03] want and it will send the information [483:05] back and that's how you get the websites [483:07] in your browser and you can look at [483:09] them. [483:10] As in SSH, it functions at layer seven [483:13] at the application layer. [483:16] And it uses TCP port 80 at the transport [483:19] layer or layer four. And if we said TCP [483:21] means what? It means the two parties, [483:24] the source or the client and the server [483:28] are going to communicate and establish a [483:31] connection and they will establish the [483:34] rules of that connection. So the [483:37] sequencing of packets, the [483:39] retransmission when needed, errors when [483:42] there are errors, what are the error [483:43] codes that will be sent if a page is not [483:45] available or the website is down or [483:47] whatever. [483:48] So they will agree on this set and then [483:50] the connection will start. So the send [483:53] syn ack and acknowledgement is going to [483:54] happen beforehand. So this is the port [483:57] it uses at layer four. [484:00] And here is an example. This is to show [484:03] when someone is not using [484:11] So you're working on HTTP and the [484:13] website is funny. It's called bad SSL. [484:16] So let's go ahead and look at this [484:17] website. It's just a dummy page. [484:19] But if you look here at the top [484:21] you'll see that it's HTTP and next to it [484:24] it's saying that it is not secure. [484:27] So this is not HTTPS basically. [484:29] When we're talking about HTTP and HTTPS, [484:32] the success of HTTP and HTTPS between [484:36] browsers and websites led to the [484:39] adoption for that language to be used [484:41] even between application components. As [484:44] you progress in IT, you will find that a [484:47] lot of the application components that [484:49] you will come across, they are [484:50] communicating using HTTP. And why is [484:53] that? Because it has everything. It has [484:55] the rules, has the formats, it has the [484:58] error messages, it has a lot of things [485:00] to do. That's one thing to note. [485:02] The second thing to note is when we are [485:04] talking about it functions at layer [485:06] seven, that means any information that [485:08] will be added because of HTTP like HTTP [485:11] headers for example and there are many [485:13] of them. [485:14] They will only be understood by devices [485:17] that can process up to layer seven. [485:20] So for example, the web server, it [485:22] processes up to layer seven because it [485:24] has the application and that's how it [485:25] understands that. If you would like to [485:27] put any security device in between [485:30] and you want to filter or check the [485:33] packets or understand everything at that [485:36] packet to ensure that it is secure and [485:38] it's not malicious activities and it's [485:40] not including any viruses or anything, [485:43] then the device that will be doing that [485:45] check has to understand layer seven. It [485:47] has to have software components that can [485:50] look at the packet at layer seven and [485:53] understand the HTTP headers and look at [485:55] them and find out if it is following the [485:57] standard or if it is suspicious. So, [486:00] this is very important and that's why we [486:02] mentioned layer three, layer four, and [486:03] layer seven are going to [486:05] be bumps on the road. You have to [486:07] understand in order to assimilate what [486:10] you need to do from a networking [486:12] perspective, from a security [486:13] perspective, from a lot of features that [486:16] you are going to use whether in the [486:17] cloud, in the network, or in [486:19] cybersecurity, or in a lot of other [486:21] things. [486:22] Now, let's move on to HTTPS, the secure [486:25] your version of HTTP. [486:27] So, this is a normal HTTP over TLS. TLS [486:31] is abbreviation of transport layer [486:33] security. [486:35] HTTPS ensures that anything that your [486:38] browser is going to be exchanging with [486:40] the server, whether it is login [486:42] information, credit card information, [486:44] account information, whatever that is, [486:46] it's going to be secure and scrambled, [486:48] ciphered, such that if anyone in the [486:51] middle, man-in-the-middle attack we call [486:53] it, can grab a copy of that data [486:56] somehow, they will not be able to make [486:58] sense of it or understand the [487:00] information included. [487:02] And it operates at layer seven like [487:04] HTTP. [487:06] And at the TCP layer, it uses port 443. [487:11] HTTP uses port 80 at the transport [487:14] layer. [487:15] Can I configure my server, my website, [487:18] to listen or to function at a different [487:21] port other than port 80, which is a [487:23] default? The answer is yes. You can [487:25] configure it to run at port 8000, maybe [487:28] 8080. [487:29] And in that case, the client and the [487:32] browser that are going to be [487:33] communicating with the server, if the [487:36] server is listening now based on the [487:38] updated configuration at port 8000, then [487:41] anything sent from here should be [487:43] communicating with port 8000. Otherwise, [487:46] if this communicates with port 80, but [487:48] the server is not functioning at 80 [487:50] anymore, it will not happen. The [487:53] communication will be broken. [487:56] HTTPS functions at TCP port 443 [488:00] at layer four. And examples would be a [488:03] lot of things. Could be cnn.com. As soon [488:06] as you get to the website, you'll find [488:08] here it's not saying that it is not [488:10] secure. And if you click click on this, [488:12] it will tell you that the connection is [488:13] secure. [488:14] And if you look here, you'll find that [488:16] this is HTTPS. [488:19] Okay? So, these are the difference [488:21] between the two. Very common. You will [488:23] come across HTTP and HTTPS a lot when [488:26] you are learning in IT. So, that's why [488:29] you need to know them. Whether you are a [488:30] developer, a cybersecurity consultant, a [488:32] network engineer, a cloud engineer, [488:34] DevOps engineer, you will come across [488:36] HTTPS a lot. So, it's very important to [488:39] know HTTP and HTTPS. If you are a [488:41] developer, maybe you need to dive deeper [488:44] into these protocols because you are [488:46] going to build software that will start [488:48] using HTTP and HTTPS. All right. So, [488:51] hopefully, this was easy. [488:56] Now, since we have learned a lot of [488:58] information about TCP/IP, about ports, [489:02] about many things, [489:04] now let's put all that together and [489:06] revisit the TCP/IP packet anatomy. [489:10] Basically, look at what is the [489:12] composition, what are the different [489:14] fields that we have addressed, and where [489:16] do they exist, and how they will be [489:19] sorted out, and which layers is going to [489:21] be using them, and all that. This is [489:22] very important, and we'll look at some [489:24] examples because we need to understand [489:27] when a client communicates with a [489:29] server, what will be the source port, [489:32] and where it will come from, how it will [489:34] be assigned. [489:35] Also, what will be the destination port, [489:37] the port on the server, which should be [489:39] known, otherwise the communication will [489:40] not happen properly. Imagine and [489:42] remember when we said that if you send a [489:45] letter [489:46] and the address for the recipient does [489:49] not have the unit number in the [489:50] building, then it will be difficult or [489:52] challenging to deliver it properly. [489:55] Same thing here. You need to know the [489:58] unit number, the port number for the [490:00] application you are trying to talk to, [490:02] otherwise the client software is going [490:04] to create a packet that is going to be [490:07] sent to the server, but then it might [490:10] not be delivered properly, or it will go [490:12] to the wrong unit, and then an error [490:14] will be created. [490:16] So, let's go ahead and look at the [490:17] TCP/IP packet anatomy. [490:20] So, first thing we need to understand [490:22] TCP and UDP. Transmission Control [490:25] Protocol, which is protocol number six, [490:28] and UDP, which is User Datagram [490:30] Protocol, which is protocol number 17. [490:32] But where do they sit in the headers of [490:34] the packet? [490:35] Believe it or not, but this is what a [490:37] TCP packet is going to include. And it [490:40] will be surprising to see that the [490:42] payload is only this part. Of course, it [490:45] can be long. [490:47] But then we have so many other fields [490:49] that will be added by the source and by [490:52] the destination when they are [490:53] communicating. So, for the forward [490:55] traffic and the responses. [490:57] The HTTP packet has a length field as [491:00] well. So, all of these are going to be [491:02] Anything that has to do with HTTP is [491:04] going to be added at layer seven, for [491:07] example. [491:09] We have type of service and version. [491:11] These are things that we are not going [491:12] to discuss outside our scope. Time to [491:14] live. How many times or how many devices [491:17] can process this packet before it [491:20] reaches the destination? And if the TTL, [491:22] that's usually a number that decrements [491:25] each time a node will pick up this [491:28] packet and try to process it. [491:30] So, the TTL, if it reaches zero, the [491:32] packet must be dropped because that [491:34] means it might be circulating endlessly [491:37] in the network. [491:39] One important field here is the [491:40] protocol. So, is it TCP or is it UDP? [491:43] And that's how layer four in one end, [491:46] when it sends the very first packet [491:48] to the other side, it would say, [491:51] if it said TCP, port number six, that [491:53] means let's go ahead and please create a [491:57] connection and agree on the rules of the [492:00] communication before we start. So, [492:02] retransmission, error flow, flow [492:04] control, and all that are going to be [492:05] included. [492:07] If the protocol value was 17, that means [492:10] the client with the first packet is [492:12] telling the destination, let's [492:13] communicate, but don't worry about [492:16] errors and retransmissions and [492:18] sequencing and all that. We I'm just [492:20] Whatever you receive from me, do the [492:22] de-encapsulation, make sense of the [492:24] data, send it to the server, and that's [492:26] it. [492:29] Then we have the headers, source IP [492:31] address, who is the sender of that [492:33] packet, and the destination IP address, [492:35] who is the intended recipient. [492:38] Please remember, when I call you, if you [492:40] are John and I'm Issa, when I call you, [492:42] John, can you please help me with that? [492:44] When you come back to me, you'd say, [492:45] Issa, I've done such and such and such. [492:48] So, always the source and the source IP [492:51] address in and destination in one [492:53] direction, they are going to be reversed [492:55] in the response of that communication. [492:59] So, then we'll get the protocol as we [493:00] mentioned, and then we have the source [493:02] IP address and the destination IP [493:03] address. [493:04] And then we have other fields out of our [493:06] scope right now. [493:08] But then, this happens at layer three, [493:11] the source IP and and destination IP. [493:14] The protocol happens at transport layer. [493:17] And also the source port and destination [493:19] port will happen at layer four. [493:24] These are called IP headers [493:26] because [493:28] except for the protocol, because these [493:30] are normal IP headers, and the network [493:32] source IP and destination IP are the [493:34] highlights. [493:35] And the source port and destination [493:37] ports are called TCP or UDP headers, [493:40] which port for the source and which port [493:42] for the destination. [493:46] So, now we are speaking about ports, [493:47] ports, ports all the time. How do we [493:50] allocate the ports? What are the [493:51] available ranges? Is there any range [493:54] that could be used deliberately without [493:56] conflicting with anything else? Let's [493:58] find out. [494:00] So, the ports are interpreted at layer [494:02] four. [494:04] And the well-known ports are 0 to 1023. [494:08] So, these are the assigned ports. For [494:10] example, HTTP, by default, port 80. [494:13] HTTPS, by default, port 443. SSH, by [494:16] default, port 22, and so on. [494:20] So, this is SSH, HTTP, HTTPS, and we [494:24] have DNS. We are going to talk about it [494:26] later on. Domain Name System. When you [494:28] type cnn.com, how is that translated [494:30] into an IP address? [494:32] So, this uses both TCP or UDP port [494:35] number 53. [494:37] So, these are pre-assigned. Nobody can [494:39] use them. They are assigned to services [494:42] or protocols. [494:44] This is Remote Desktop Protocol, a [494:46] Microsoft protocol when someone is [494:48] trying to get from a client to a [494:50] Microsoft server or a Microsoft machine [494:53] remotely to administer and control that [494:55] machine. Similar to SSH, but this is for [494:58] Linux, and this is for Windows. [495:02] We have MySQL, one type of the [495:04] databases, and it is very well known, [495:06] very widely used on the internet, and [495:08] that that's the port, 3306. [495:13] Then we have registered ports, and this [495:15] is the range, and usually companies will [495:18] avoid using that deliberately. [495:21] And then you have the dynamic or private [495:24] ports. So, this is what clients can use [495:27] deliberately without any permissions, [495:29] and also ensuring that it will not [495:31] conflict with anyone. [495:33] And the range is 94,152 to 65,535. [495:38] So, what do we use the dynamic port for? [495:40] When your browser is creating a packet [495:43] to go and send it to cnn.com, [495:46] so, the source IP, destination IP will [495:48] be added. The destination port is known. [495:50] I mean, that's HTTPS going to be so 443. [495:54] But, what will be the source port? The [495:56] client or this session port from the [495:58] client? How it will be decided or [496:01] assigned? [496:02] The browser is going to check for this [496:05] range locally [496:07] which ports are used and it's going to [496:08] pick one port that is not used randomly. [496:12] If my laptop is opening 20 sessions to [496:15] my Gmail and to my Hotmail and to Zoom [496:17] and to this and to that, [496:20] these are going to be each assigned a [496:22] random port from this range and the port [496:25] will not be reused if another session is [496:27] using it. [496:29] And that is how when the client is going [496:31] to send to the server, [496:34] it the client will send with it the [496:36] source port [496:38] and the source IP as well. [496:41] And of course, the destination port and [496:43] destination IP, they will all be in the [496:45] packet. [496:46] So, when this is sent, then the server [496:48] when it responds, the source port will [496:51] be the destination port. So, when it [496:52] comes back to the laptop that has 100 or [496:55] maybe 200 sessions and tabs and [496:57] applications running, it will know [496:59] exactly what's the unit number, which [497:02] session and which application to deliver [497:04] it to. So, this is very very important. [497:06] This is called dynamic range or [497:08] ephemeral port range. Whether you hear [497:10] this term or that term, it's the same. [497:14] From the client to the server, the [497:16] destination port is the port of the [497:18] application, the unit number in the [497:20] building at the destination, at the [497:21] recipient side. [497:24] And the source port is picked randomly [497:26] from the range that we discussed. [497:29] So, here's an example. This client is [497:31] going to use a browser to get to this [497:34] website, let's say Dolphin Ed Academy. [497:38] And the IP address of the source [497:41] is this IP address and it appears to be [497:43] a public IP address, so it's connected [497:45] to the internet. It could be a direct IP [497:47] address or it could be the one on the [497:48] wireless router at home or in the [497:50] office. [497:51] The web server side, this is the IP [497:53] address, again it's a public IP address [497:55] and it is listening on or functioning at [497:58] port 80 HTTP. When you hear the term [498:01] listening on, that means this is the [498:04] port that it is expected to receive [498:07] traffic on or this is the unit number in [498:09] the building that you need to deliver or [498:11] the server needs to deliver the packet [498:13] to. All right? So, when you when you [498:15] hear that it works on port, it listens [498:18] on port, it processes port, it's all the [498:20] same thing that the application for [498:22] correct and accurate delivery needs to [498:25] see that in the packet as the [498:27] destination port. [498:29] The browser will look at the random [498:31] range that we discussed and it will find [498:33] out randomly that port 50,000 is unused. [498:36] So, it will create the packet. The [498:38] source IP address is this IP address. [498:41] The source port is the random unused one [498:44] that no other session in this device is [498:47] using. [498:49] And then the destination port is 80 [498:51] depending on our knowledge of the server [498:54] and destination IP address is 98732164. [498:59] And it is going to tell the server, [499:01] "Please, we need to establish a TCP [499:03] connection. This has to be a reliable [499:06] connection." [499:08] In the response, this is going to be [499:10] reversed. The destination port [499:14] is the source port that's in the [499:16] response from the server when they are [499:18] reversed. [499:19] And the source port is the server port [499:21] that used to be the destination in the [499:23] forward traffic. So, let's look at it [499:24] again. [499:25] Here we have the source port [499:28] and the source IP are those of the [499:29] client. Why? Because that is the sender. [499:32] And the traffic was going from the [499:34] sender to the receiver. So, the [499:35] destination port and destination IP used [499:37] to be the server ones. [499:39] When the server comprehends and [499:41] understands the message, prepares the [499:43] response, then it's going to take what [499:46] used to be the source port and the [499:48] source IP in the original message that [499:51] reached the server, these are going to [499:53] be the destination port and the [499:55] destination IP. [499:58] And since it was [499:59] initially [500:01] destined to the server, the destination [500:03] IP and destination port, now in the [500:06] reverse direction, they are going to be [500:08] the source port and the source IP. Makes [500:10] sense, right? And the protocol is still [500:12] number six. [500:13] So, this is [500:15] basic, it's obvious. We use it for the [500:17] analogy. If I call your phone number, [500:19] you didn't pick up because you were [500:20] busy. When you call me back, you will [500:22] have to dial my number, not your number. [500:25] A lot of people in IT, network, [500:29] network security, cloud, DevOps, they do [500:32] a lot of mistakes when they set security [500:34] to filter out packets based on inbound [500:38] or outbound. And when we get to the [500:40] security module, we are going to talk [500:42] about that [500:43] in more details. [500:45] So, please, if you are going to [500:47] eventually configure anything that has [500:49] to do with packet filtering, traffic [500:51] filtering, security, firewalls and all [500:53] that, make sure that you draw it. If you [500:56] are not sure, draw where is the client, [500:59] where is the server, and for this [501:01] direction, what will be the source and [501:03] destination? [501:05] And for the reverse, what will be the [501:07] source and destination? That's one [501:09] thing. [501:10] What if the server needs to go to an [501:11] update server and download a new version [501:15] of the server software? Let's say the [501:17] server is running on Nginx or Apache and [501:20] it needs to download a newer version. [501:23] In that case, the source or the client [501:25] is going to be the server and the actual [501:28] server will be the update server on the [501:29] internet. So, in this direction, who is [501:32] the source? Who is the one sending the [501:36] traffic? What will be the destination? [501:38] It's extremely extremely important [501:41] to map out the flows expected when you [501:44] configure that. [501:46] Here is one more example and in this [501:48] case, we are taking it one step higher. [501:52] So, in this case, we have a server that [501:54] has three applications active. [501:57] The first one is an SSH server. So, [501:59] administrators can connect using SSH to [502:02] this server and it is functioning or [502:04] listening on port 22 TCP. [502:08] Then we have a domain name server that [502:09] will translate cnn.com into an IP [502:12] address, dolphinedacademy.com into an IP [502:14] address and so on. [502:16] And then we have a web server. So, it [502:18] could be an e-commerce website, [502:20] something like eBay, amazon.com and all [502:23] that, but we are talking about like a [502:24] mini version here because we are talking [502:26] about a single server. [502:27] And this is expecting connections on [502:29] port 80 or it could be 80 and [502:33] HTTPS as well and 443. [502:36] All right, so what's the scenario? [502:39] We have a user and the administrator [502:41] that needs to connect SSH [502:44] to fix few things in the code here or in [502:47] the website. [502:48] And while working [502:51] on using SSH and administering that, the [502:53] user also will need to connect to the [502:56] web server to see the updates. What is [502:58] the impact or effect of these changes [503:00] and whether they have fixed the problem [503:01] or not. [503:03] So, two connections in the same server [503:06] from the same client. [503:08] Remember that the ephemeral range or the [503:10] dynamic port range is the 49152 to [503:14] 65535. [503:18] So, let's talk about the first one. The [503:19] client is trying to SSH, is trying to [503:22] connect securely into the server for [503:24] administrative purposes. [503:27] So, in that case, [503:29] the source port is going to be a random [503:32] port unused in any of the other sessions [503:34] and it will be picked up by software. [503:36] You don't need to get involved. [503:38] And it decided that it's going to take [503:39] 61234. [503:42] Here we are ignoring the IP addresses, [503:44] but of course, let's say this is IPS [503:49] or IPC for the client [503:51] and this is IPS. [503:54] So, this could be 200.10.1.5 [503:57] and this could be 150, for example, [504:00] .2.1.1. [504:02] So, we'll focus on the ports. So, the [504:04] source port randomly selected from this [504:06] range unused in the client and the [504:08] destination is going to be 22 TCP. [504:12] And this is the traffic from the client [504:14] to the server. [504:15] So, the server going to receive it, [504:17] check on the key and check on all the [504:19] information and now it is good to go. [504:20] So, what the server would do, it will [504:22] respond [504:23] and it it would say, "This is being sent [504:25] from the source, which is the SSH [504:28] server, port 22, [504:30] going back to what used to be the source [504:32] in the request." [504:34] And of course, the IPs are going to be [504:36] IPC [504:38] and in this case, going to IPS, which is [504:40] the server IP address, and in this [504:43] direction, they are going to be [504:44] reversed. The source will be IPS and the [504:46] destination will be IPC. [504:49] Connection established. The [504:50] administrator does whatever he or she [504:53] needed to do and now it's time to test [504:55] it. [504:56] So, they need to do an HTTP connect [505:00] connection is open, but they open the [505:02] browser and now they need to go and do [505:04] HTTP into the server. [505:07] So, again, the software here will look [505:09] at this dynamic range and see what has [505:12] been already taken. [505:14] For example, 61234 will never be picked [505:17] up. [505:18] It will pick up another one that is [505:19] unused. And here we have more than [505:21] enough, 16,000 plus [505:24] ports available [505:25] to be used as a source port. And I don't [505:28] think any of us will have 16,000 [505:31] sessions open at the same time [505:34] to 16,000 different applications and [505:36] websites and all that. Maybe have 50, [505:38] 100, 200, but never 16,000. [505:42] So, it will decide on this is free, the [505:44] 50,000, and the destination in this case [505:47] will be TCP 80. Why? Because we know [505:49] that the server is listening on this [505:51] port. [505:52] Server will receive it, understand it [505:54] because it's standard HTTP, and now it's [505:56] time to respond. So, when it responds, [505:59] they will be reversed. The source is [506:00] going to be 80 and the destination is [506:02] going to be 50,000. So, please, please, [506:05] please stick this fact about the source [506:08] port and a destination port in forward [506:11] direction and they will be reversed in [506:13] the other direction. Now, let's expand [506:15] it a little bit. [506:17] Let's say that this server would like to [506:19] go on the internet to an update server. [506:25] And the update server is going to be [506:26] using port 443, for example. [506:30] So, HTTPS. [506:34] All right? So, the request is going to [506:37] be initiated from the server out. So, [506:40] the destination is going to be port 443 [506:42] in this case. [506:44] While the source is going to be a random [506:46] port selected depending on how the [506:48] software will do it. [506:54] All right, let's now discuss the [506:56] security or the cybersecurity [506:58] introduction and the network security [507:00] introduction. [507:02] A lot of people get confused about [507:03] network security and cybersecurity and [507:05] they think they are the same thing. [507:08] And here we are going to clarify the [507:10] relation between network security and [507:12] cybersecurity for beginners. [507:16] In this module, we're going to introduce [507:18] what cybersecurity is and what exactly [507:20] it covers. [507:21] And then we are going to look at network [507:23] security. So, the focus is going to be [507:25] about network security, but we have to [507:27] take the 50,000 ft view first. [507:30] Look at what cybersecurity is and the [507:32] role of network security within [507:34] cybersecurity. [507:35] We're going to extend the discussion to [507:37] network security. We're going to talk [507:39] about network devices again, but this [507:41] time we're going to focus on the [507:43] firewalls. The very famous or the most [507:47] common [507:48] device in protecting or in securing your [507:52] network and the data within. We'll look [507:54] at firewall examples and we are going to [507:56] use two examples from AWS, the security [507:58] groups and the network ACLs, and both of [508:02] them are layer four firewalls. What does [508:05] that mean? [508:07] That means they have the intelligence to [508:09] understand up to the transport layer [508:12] only, but they don't go beyond that. [508:14] They don't understand what's happening [508:15] in the application. They cannot [508:17] comprehend any headers are that are [508:20] added by HTTP or by encryption. [508:23] So, they only understand IP addresses [508:25] and ports and that's what they can [508:26] permit or deny based on. And we'll also [508:29] look at encryption. Then we're going to [508:32] look at virtual private networks, which [508:34] relates very well to encryption that we [508:36] have mentioned multiple times, but now [508:37] it's time to explain what that is. [508:43] So, let's go ahead and start with [508:45] cybersecurity overview. [508:47] What is cybersecurity basically? Before [508:49] we do that, we'll take a step back and [508:51] we'll do an analogy so you understand [508:53] the importance of security when it comes [508:56] to networks and data. [508:58] So, think of your phone or computer like [509:01] your house. What do you do to secure [509:03] your house? [509:04] There has to be a lot of different ways [509:06] to secure it. [509:08] There are the passwords that we need to [509:10] protect and firewalls. So, let's say, [509:12] for example, this is locking your doors [509:14] every night. [509:16] And then we have the scrambling of the [509:18] data so nobody can read your data. This [509:20] is like when you spread or close your [509:22] curtains so nobody can see you in the [509:25] evening while you are inside the house. [509:28] Then we have an alarm system. If anyone [509:31] breaks into a window or breaks into a [509:33] door, then we need that. So, that is the [509:36] role in cybersecurity for antiviruses [509:39] and security monitoring. [509:41] Then probably you will have a device [509:44] with a camera and mic that will check [509:46] who's at the door before opening the [509:48] door, right? So, think like [509:50] authentication in network. So, we are [509:52] going to cover all of these. So, these [509:54] are stuff that cybersecurity covers. So, [509:57] cybersecurity is about protecting [509:58] computers. [510:00] Computers include servers, include [510:02] storage, include anything that does [510:04] computations. [510:05] Protecting networks so nobody can break [510:07] into the network and bring it down. [510:09] Delete the configuration, for example. [510:11] And also the data, whether it is stored [510:14] or travels across the network from being [510:17] stolen, [510:18] attacked like hacked or damaged. So, [510:21] this is the core responsibility of [510:24] cybersecurity in general. [510:26] So, please note that we talked about [510:28] networks and we talked about computers, [510:30] but this is part of what you need to [510:32] protect. [510:34] Why is cybersecurity important? Because [510:36] it will protect your personal [510:38] information, your credit cards, your [510:39] photos, your money, your bank accounts, [510:41] your passwords. That is all done by [510:44] implementing cybersecurity measures. [510:47] Also to stop hackers from breaking into [510:49] systems, whether these are websites they [510:52] will hack or even your laptop and then [510:54] they will ask you for a ransom. [510:56] And also to keep companies and services [510:59] running. Some hackers or types of the [511:01] hacks is the denial of service. They [511:03] will have loads and loads of traffic on [511:06] a server such that the resources on the [511:08] server, the memory and CPU will be busy [511:11] and they will not be able to serve [511:12] legitimate users. So, this is also type [511:16] of attacks that people can do in order [511:18] to deny the service from legitimate [511:21] users. [511:22] So, this can happen in banks, in [511:24] hospitals, and in schools, universities, [511:26] and so on. [511:27] Also to prevent data loss or leaks. So, [511:30] cybersecurity is very wide in its [511:32] responsibility to protect a lot of [511:34] things and to make sure that your IT is [511:37] healthy, is operational the right way, [511:40] and is protected from any malicious [511:43] activities. [511:46] So, cybersecurity is not network [511:48] security. Network security is part of [511:50] cybersecurity. So, let's look at the [511:52] areas or specializations that are under [511:55] cybersecurity. What are they and what [511:57] are these specializations? [511:59] So, we look at network security. This is [512:01] one of many areas under cybersecurity. [512:03] And as the name implies, this is about [512:05] protecting network devices [512:08] and protecting the data stored or the [512:10] data that is moving over these networks [512:13] or through the internet or local area [512:16] networks. [512:17] Then we have application security, which [512:20] is the security of the software and [512:22] applications from bugs, from backdoors, [512:25] from Trojans, from from from There are [512:27] so many things that you can do to [512:29] protect applications and software. [512:33] Then we have the endpoint security. I [512:35] need to have security software on your [512:38] laptop, for example. I need to have [512:40] encryption, for example, done on your [512:42] laptop. I need to have similar things to [512:45] detect malicious activities on servers [512:48] to make sure that they are sending [512:50] updates and notifications about their [512:52] performance and all that to monitoring [512:54] and alerting. [512:55] So, this is for devices like servers, [512:57] storage, laptops, and phones. They have [512:59] to have endpoint security and there are [513:00] companies that are specialized in [513:03] endpoint security. And then we have [513:04] cloud security. So, it could be the [513:06] network that you own or it could be the [513:08] cloud. And in that case, in the cloud, [513:11] then the provider of the cloud will be [513:13] responsible for the network and you will [513:15] be responsible maybe for the endpoint [513:17] security and the application security [513:19] and so on. [513:20] So, infrastructure and data in the cloud [513:22] must be protected as well. There is [513:23] identity and access management. Who can [513:26] access your infrastructure, whether it [513:29] is in the cloud or on prem? [513:31] And when they access it, what are they [513:34] allowed to do? Are they allowed to get [513:36] into databases and change things? Or is [513:39] it only read only to look at the [513:41] configurations and find out if it's done [513:42] right or wrong? [513:44] Can they change configurations? Can they [513:46] delete resources or they are just [513:49] high-level entry-level users? They can [513:52] just view and not do all of that. So, [513:53] that is all in identity and access [513:55] management. Who are the users [513:57] that are allowed to do this and at what [513:59] level? [514:00] So, who's allowed to access what and [514:02] what they can do? And then there is the [514:03] physical security itself. [514:06] AWS has data centers. Azure has data [514:08] centers. Now, who is allowed to get into [514:11] these data centers? And what is [514:13] happening in the data centers? And who [514:16] went in at what time and where did they [514:18] walk within the data center? So, even if [514:20] they are allowed, [514:21] then we look at badges that will allow [514:24] them in specific areas and not anywhere. [514:26] They cannot just go ahead and open any [514:28] cabinets or any cage and walk in if it [514:31] belongs to third parties or different [514:33] companies or if it is an area where they [514:36] should not be in. [514:40] And then policies and rules for security [514:43] and security policies and all that there [514:45] are rules and policies. What are the [514:47] standards implemented for that? And this [514:49] is also part of cybersecurity, which is [514:52] the compliance and auditing part. So, as [514:55] you can see, network security is just [514:57] one of maybe seven or eight different [514:59] areas in cybersecurity. [515:01] So, please be aware in your career that [515:04] nobody is going to fool you [515:06] intentionally or based on ignorance and [515:09] tell you that cybersecurity is network [515:11] security. It's the same thing. You need [515:12] to take network plus and CCNA before you [515:16] do cybersecurity. And my answer to that [515:19] would be, [515:20] "What if I'm going to specialize in [515:22] these areas? Why do I have to dive deep [515:26] into network security? Maybe cloud [515:28] security will have a little bit of that [515:30] as well. So, if I'm not specializing in [515:32] this one or that one, why should I [515:36] dive deep into networking? If I'm going [515:38] to do endpoint security or physical [515:39] security or compliance and auditing? Why [515:42] do I need to be the expert of [515:44] networking? [515:45] So, please be aware of what [515:47] cybersecurity is and what network [515:49] security is and how they relate to one [515:51] another. This is very important to keep [515:53] in mind as you cruise through your IT [515:56] career. [516:00] All right, so now let's focus on network [516:03] security. The normal extension or the [516:05] normal continuation is to go through [516:08] network security as a branch of [516:10] cybersecurity. So, please keep that in [516:13] mind all the time. [516:15] So, network security, it is about [516:16] protecting the network devices and data [516:20] as the data travel across or live on a [516:23] network, get stored on a network in a [516:25] database or in a storage device. [516:27] The emission of the network security is [516:29] to keep the bad guys out and make sure [516:32] that the data is safe and only the good [516:35] guys should be logged in [516:38] to the network or access the network and [516:39] only do what they are allowed to do. [516:43] So, that will take us to discuss network [516:45] devices again, but now we are going to [516:47] focus on the security part. What are [516:49] network security device? The very common [516:51] one that we will face day in and day [516:54] out, whether we are using AWS or Azure [516:57] or Google Cloud or even if you are [516:58] working on premises, we always need to [517:01] think about firewalls. [517:03] Firewall is a security gate, is a [517:05] security guard of your network and [517:08] applications. So, it can protect the [517:10] network and it can protect the servers [517:12] or the computing devices and the [517:14] applications on top. [517:16] Is it going to do everything in the [517:18] application? The answer is depending on [517:20] the intelligence of the device. Does it [517:24] delete the need for end point security? [517:26] And the answer is no. They are integral [517:29] parts of the overall cybersecurity [517:32] mechanism that you do. [517:34] So, here is an example of a firewall [517:35] that we can place. It will protect the [517:37] local area network switch and it will [517:39] protect the application servers and [517:41] database servers if we are in a data [517:43] center. Of course, some people would [517:45] place that in front of the router. [517:47] That's a possibility if the firewall is [517:49] an advanced one that can also process [517:52] routing. [517:54] The firewall can be configured to allow [517:56] or sometimes it's called deny or block [518:00] data coming in. [518:02] If data is coming into the network or [518:05] the server, this is called inbound. [518:08] If data is being sent out of the [518:11] network, this is called outbound. So, [518:13] some people would call it ingress for [518:15] inbound and egress for outbound. So, [518:17] please understand what this mean because [518:20] they are very important when you are [518:21] configuring your firewalls. [518:25] Once configured, the firewall will be [518:27] like this security guard that is going [518:30] to be looking around and trying to [518:32] figure out if there is anything that's [518:34] not supposed to run through the [518:37] firewall, then it will stop it depending [518:39] on the configuration that you have [518:40] placed. [518:41] When I was stressing before on the [518:43] importance of understanding the flows [518:46] and the ports and what is the source [518:47] port and what's the destination port, [518:49] what's the source IP, what's the [518:51] destination IP, because if you don't [518:53] understand it well, you will configure [518:54] the firewall in a wrong way and that [518:56] will deny legitimate traffic and may [518:59] allow traffic that is not supposed to [519:01] run through the firewall. [519:04] Firewalls can protect at the network [519:06] level or at the application level. So, [519:08] firewalls might be a layer four [519:10] firewall, which means it understands IP [519:13] and transport layer only. That's called [519:14] a layer four firewall. [519:16] An advanced firewall sometimes it's [519:19] called next generation firewall or web [519:21] application firewall, that is a firewall [519:23] that can understand up to layer seven. [519:25] So, it can process all the headers and [519:28] it can even look at the payload at layer [519:30] seven. [519:31] The complexity of the firewall depending [519:33] on the budget and depends depends on [519:36] also the use case, what you need to use [519:38] it for. [519:40] So, we might also deploy separate [519:43] firewalls at the separate segments and [519:45] it depends on which business you are in. [519:48] So, there are some standards depending [519:50] on the business that they have to comply [519:52] with and part of that compliance, there [519:54] will be some clauses about firewalls in [519:58] your infrastructure and how many [519:59] firewalls have to be there. [520:02] So, we could also have hardware [520:04] firewalls of or software-based [520:06] firewalls. The two examples that we are [520:08] going to study in AWS are [520:10] software-based. [520:12] The infrastructure security part, how do [520:15] companies classify segments or trusted, [520:19] untrusted, or highly critical, low [520:21] critical, public zones in their [520:24] infrastructure? Here I'm not talking [520:25] about a startup that maybe have one or [520:28] two servers. I'm talking about a [520:30] corporate a hospital, a university, a [520:33] government, or a ministry in a [520:35] government that they have a sizable [520:38] infrastructure [520:39] and they want to protect it according to [520:42] best practices and according to [520:43] standards. What they do is they start to [520:45] classify zones in their infrastructure [520:49] from a security perspective. [520:51] So, the zoning architectures [520:54] firewalls, as we have seen, can divide [520:56] the network into trusted and untrusted [520:59] segments. The security architecture of [521:01] the network infrastructure consists of [521:03] zones. So, there are security architects [521:06] and this is a job. There are [521:08] infrastructure security architects that [521:11] will be defining according to compliance [521:15] needs and standards and the business and [521:17] so on, they will be defining an a [521:20] security architecture that will classify [521:22] zones and they will detail what should [521:26] be in each one of these zones. [521:29] So, the zoning architecture is designed [521:31] based on the criticality and the [521:32] security risk of each component. So, [521:34] let's have this example that we have [521:37] here. [521:37] So, I have a firewall. Now, we are not [521:39] showing the routers. [521:42] We are showing the firewalls primarily [521:45] and this is an architecture and that's [521:47] why it's not a physical drawing. So, you [521:50] need to understand moving into IT that [521:53] there are physical diagrams where you [521:56] have to put the devices and you have to [521:58] put the ports and the types of the [522:00] cables, speeds, and all that stuff. [522:04] And there are architecture conceptual [522:07] drawings that explain the concept and [522:10] that not necessarily is going to include [522:13] all the devices by name. [522:16] All right, or type. [522:17] So, here we have the internet and this [522:20] is a zero trust area. We don't trust the [522:23] internet. That's why we have, let's say, [522:25] firewall one or we can call it the DMZ [522:28] firewall that is a firewall that will [522:31] filter traffic coming in or going out to [522:34] the internet before it hits the [522:37] demilitarized zone. We call that [522:39] demilitarized zone and that's a low [522:41] trust. So, it is trusted at a low level [522:44] because it is only one firewall away [522:47] from the internet, which is zero trust. [522:49] This is a data center security [522:52] architecture, by the way. [522:54] So, external DMZ, what would you place? [522:56] Why do you build it? Which workloads are [522:59] you going to host in a external DMZ? So, [523:02] examples are voice over IP servers. If [523:04] you are using voice over IP, telephony [523:07] over IP, basically telephony over the [523:09] network, [523:10] if you are going to have a file transfer [523:13] protocol server where people can get in [523:15] and download files from the outside, [523:16] from the internet, if you have web, DNS, [523:20] VPN, [523:22] or extranet servers that are exposed to [523:24] the outside, any workloads that should [523:27] be accessed directly from the internet [523:29] and they are not a high risk or a highly [523:33] critical workload, then they can be [523:35] placed in the external DMZ. Okay. [523:38] So, let's say I have the servers and all [523:40] that. If these servers [523:41] they need to communicate, for example, [523:43] with a database inside, do they just [523:46] communicate through the network or do we [523:48] have to have again checkpoints, [523:51] firewalls that are going to process [523:53] requests before they get in? [523:56] And the answer is [523:57] if the ones inside are classified as [524:02] trusted, that means I cannot connect a [524:05] low trust to a high trust directly [524:06] through the network, through a switch or [524:08] a router directly. I have to put another [524:11] layer of security or a checkpoint that [524:14] will do more checks because if someone [524:18] from the internet somehow hacks one of [524:20] the servers here, [524:22] before they can get in or roam around [524:25] the infrastructure, I have to do another [524:27] checkpoint. Police officers that they [524:30] will stop them and look at the ID, try [524:32] to find out what they are trying to go [524:34] to and why and who are they before they [524:36] are let in. I'm talking about the [524:38] traffic they are sending, of course. [524:41] Okay? So, what would I have in a in a [524:43] high trust zone? You will have [524:44] applications and maybe end user systems. [524:48] All right, then where are the databases? [524:51] These are the applications. Databases, [524:53] mission-critical applications, and IT [524:56] support critical services or resources, [524:59] they are going to be in a highest trust. [525:01] Look at the color coding, by the way. [525:03] The colors usually incorporates and in [525:05] their zoning architecture, they have [525:07] meanings. [525:08] Here you have the green, that is the [525:10] highest trusted. And the red is the most [525:14] dangerous one and that's why it is no [525:17] trust or zero trust and the color red [525:19] signifies that. If you look from afar, [525:22] you will be able to tell which zone and [525:24] what kind of security is that. And of [525:26] course, they document in their [525:28] documentation, they document the color [525:30] legend and what that means as well. [525:33] All right, so if I move from the purple, [525:34] if it is high trust and I would like to [525:36] communicate, application here would like [525:38] to communicate with the database here. [525:40] So, it has to go through a layer of [525:42] firewalls. [525:43] Now, what about the corporate users who [525:45] are coming through wide area network? [525:47] They are not coming through the [525:48] internet. [525:50] Should I fully trust them? And the [525:52] answer is no. If they are coming from [525:53] wide area network, we'll have them as [525:55] medium trust. So, they are higher trust [525:57] than the blue, but they are lower trust [526:00] than the purple and green. And that's [526:01] why we have firewalls behind the WAN [526:05] routers, the wide area network routers, [526:07] because they need to protect traffic or [526:10] filter traffic before it gets into the [526:12] operational zones. And from there, maybe [526:15] they will try to get into the highest [526:17] trust zone. [526:19] So, this is not something you need to [526:21] worry about now, because that is [526:23] advanced when we talk about these [526:24] architectures, and you need to get into [526:27] network security deeply, understand [526:29] firewalls and how they get configured [526:31] and their features and so on, before you [526:34] will be at the architecture level [526:35] deciding on zoning designs. Usually, you [526:39] will enter from the junior to mid to [526:41] senior engineering before you move into [526:44] the architecture part. [526:48] All right, let's now go into AWS again [526:51] and introduce one type of virtual [526:54] firewall, a layer four firewall, so it [526:57] only understand the transport layer, the [526:59] ports and the IP addresses, cannot get [527:01] into the application, presentation, or [527:04] session or encryption details. [527:07] And that is the security groups. This is [527:09] available also in Microsoft Azure and in [527:11] Google, and it is a type of a firewall [527:15] that will protect at the virtual machine [527:18] level. So, let's go ahead and discuss [527:20] that in more details. [527:22] So, the security group, what is it? It's [527:24] a virtual firewall that applies at the [527:27] instances network interface. [527:29] So, each virtual machine in AWS, as we [527:32] mentioned earlier, it's called an EC2 [527:34] instance. Elastic Compute Cloud is what [527:37] EC2 is or abbreviation for. And then [527:40] instance means it's one virtual machine, [527:43] basically. [527:44] Each virtual machine, as we know from [527:46] the virtualization concept, it's going [527:48] to have virtual resources allocated. One [527:51] of them is a virtual network interface. [527:54] So, if we look at this symbol as the [527:57] virtual interface, it's called the ENI [528:00] in the AWS world, Elastic Network [528:03] Interface. [528:04] What does it signify? Why did they call [528:06] it this way? I don't care. All we care [528:08] about is to use the right terms that AWS [528:10] has used or has decided to use for the [528:14] VNIC or the virtual network interface. [528:17] So, if you heard the term ENI or VNIC, [528:20] it's exactly the same thing, virtual [528:22] network interface card. [528:25] So, it's a virtual firewall that applies [528:26] at the instance network interface. [528:28] And in the security group, we can only [528:31] allow permit rules, allow rules. So, how [528:35] about the deny ones? By default, if it [528:38] is not there, that means it's denied. [528:40] If we have a security group with allow [528:43] allow allow, and that's it, that means [528:44] there is an implicit deny at the end. [528:47] So, if anything that is not allowed is [528:49] denied. So, if I have a blank rule set [528:52] in a security group, that means [528:54] everything is denied. [528:57] If you make a change to a security [528:59] group, the changes are going to take [529:01] effect immediately. We're going to [529:02] present all of that, so don't worry [529:04] about that. [529:06] In a firewall, there is something called [529:08] inbound, [529:09] and there is something called outbound [529:11] or ingress and egress. [529:15] But you need to understand the meaning [529:18] from the vendor perspective, not up to [529:20] you. [529:21] From the vendor perspective, what is [529:24] ingress or inbound, and what is egress [529:26] or outbound? For example, [529:28] in some Cisco routers, if you're talking [529:30] about [529:31] inbound, it could be what is coming into [529:34] the router, and outbound, what is going [529:36] out of the route. [529:38] But here, when we are talking about [529:40] inbound, that means traffic that is [529:43] coming eventually into the instance. So, [529:46] if the firewall, if the security group [529:48] allows it, [529:49] it will go inside the instance. It's It [529:52] is sent to the instance. [529:54] Whereas outbound, that means it's [529:56] initiated from the instance, and if [529:58] allowed, it will go out. [530:03] So, inbound or ingress means coming into [530:05] the firewall destined to the instance. [530:09] Outbound means that it is leaving the [530:12] instance through the firewall to the [530:14] outside. And the outside could be [530:16] another instance that is in the same [530:18] subnet, or it could be [530:20] another instance in a different subnet [530:22] in a VPC or even out to the internet. It [530:24] could be going to anywhere. We don't [530:27] care where it's going. What we care [530:28] about is outbound means leaving the [530:31] instance or the instance has initiated [530:33] that traffic. [530:37] Outbound is always at the initiating [530:39] instance side. So, outbound is always [530:42] coming from the instance, even if it was [530:45] going to another instance in the same [530:47] subnet. So, this is outbound, and then [530:50] it will be inbound if allowed to the [530:52] other instance. So, please make sure [530:54] that you understand the flow that you [530:57] are trying to allow or deny, where it [531:00] will be initiated from, where it is [531:02] going to, what are the involved ports [531:04] for the source and destination, and then [531:06] you will know where you decide. So, for [531:08] example, for this flow, [531:14] assuming that it started from here. [531:15] Let's say this instance is doing a ping [531:18] or SSH into this instance. [531:20] So, it is initiated from here, which [531:23] means it has to be allowed, if you want [531:26] to allow it, through the security group [531:28] in order to pass through the security [531:31] group and continue its trip. [531:35] So, as it reaches here, the same flow, [531:37] the exact same flow, here it is inbound, [531:40] not outbound. So, in the inbound rules [531:43] here, you need to allow it if you want [531:45] to let it go into the instance. [531:48] If you did not understand that, then [531:51] definitely you're going to configure [531:52] that wrong, or maybe you'll do one side [531:54] and forget about the other side, [531:56] and then the traffic will not flow, and [531:58] you will have problems, and we got a lot [532:00] of questions like that based on lack of [532:04] understanding. Despite the fact we [532:06] stressed time and time again on the [532:08] importance of understanding the ports, [532:10] understanding the flow, what is the [532:12] source IP, what's the source port, [532:15] what's the destination IP, what's the [532:17] destination port. And now we'll add to [532:19] that, what are the involved security [532:22] groups or firewalls in the path that [532:25] need to allow this to get through. [532:30] So, here we have to allow it on the [532:31] outbound in the blue security group, and [532:34] we have to allow it on the inbound in [532:37] the receiving security group. [532:39] All right. So, let's say this was a [532:40] ping, ping IP address allowed in the [532:43] outbound, allowed in the inbound, [532:45] everything is cool. [532:47] In security groups, they are called to [532:49] be stateful. They have a memory and they [532:52] remember the state. They remember what [532:54] was allowed in one direction, [532:57] so the instance will receive the ping, [532:59] and now it's time to respond and say, [533:01] "I'm alive. Yes, I'm okay. I got your [533:03] message." As a special case, because it [533:06] is stateful, [533:08] if the traffic was allowed in one [533:09] direction, the response for that traffic [533:12] when it arrives, it will be allowed. [533:14] This is as if you are driving your car [533:16] into a gated community or a gated [533:18] compound. [533:19] So, when you are coming in, they will [533:21] ask you, "Where are you going?" Maybe [533:23] they will take your phone number and [533:24] name, which unit you are going to. Maybe [533:25] they will call a landlord or the owner [533:28] of that unit or the resident in that [533:30] unit, and they will make sure that you [533:32] are allowed to get in. [533:34] So, you get in. [533:35] When you are leaving, the barrier or the [533:38] gate will open automatically as you [533:39] approach, and they will not ask you for [533:41] anything else. Or maybe they have [533:42] cameras that will record that you have [533:44] left, and that's it. [533:47] This is stateful. So, that's exactly the [533:49] same analogy for security groups. Is [533:52] this true for any virtual firewalls or [533:55] any cloud firewalls? [533:56] Go and check the documentation of every [533:59] vendor you are dealing with to find out [534:02] if it is stateless or stateful. [534:06] What if it was not stateful? That means [534:09] you must configure the response rules [534:13] to be allowed here on the outbound, and [534:15] when it arrives here, then you have to [534:17] allow the response inbound on this [534:19] firewall. [534:21] All right? So, this is extremely [534:23] extremely important to know which [534:25] firewall you are dealing with, is it [534:27] stateful or stateless, and should I [534:29] allow rules in both directions for the [534:31] forward traffic and the return or the [534:33] response, or is it enough to do it in [534:35] one direction, and then response is [534:37] going to uh work without any problems. [534:41] Let's look at inbound rules and how the [534:44] format in the security group looks like. [534:47] So, what do we configure if we wanted to [534:51] edit or create a security group and [534:53] define the parameters and whether that [534:57] will be allowed or not. So, here's an [534:59] example. We need to allow this inbound [535:01] traffic. Let's assume that this is [535:03] coming from the internet. Yeah, a user [535:05] is sitting here and needs to connect to [535:08] an instance that is [535:10] in a public subnet connected to the [535:12] internet. [535:14] All right, what do you need? [535:16] Any instance, any virtual machine [535:18] created in AWS, must have a security [535:21] group. That's not an option. There is no [535:22] way you can start an instance without a [535:25] security group. [535:27] And even when you are creating the [535:28] instance, and we have seen that before [535:29] and we'll to it again, [535:31] you are told do you want to use an [535:34] existing security group or do you want [535:36] to create a new one? [535:38] So for the inbound rules, the [535:39] destination is the instance itself. [535:43] So when you are creating the inbound [535:45] rules, so this is an example of an [535:47] inbound rule. [535:49] You can decide on the IP version. It [535:50] could be IPv4 or IPv6. That means the [535:53] security group can filter based on IPv4 [535:56] addresses or IPv6 addresses. [535:59] Then what is the type of the traffic? [536:02] Here we can say HTTP, SSH, all traffic, [536:05] all TCP. There is a lot of choices. [536:07] We're going to look at that. [536:09] Then the protocol. Is it TCP or UDP? [536:12] Then the port range. Why do they call it [536:14] a range? Because it could be a single [536:16] port or it could be a range of ports. If [536:18] you want for example to allow all the [536:20] ephemeral, all the dynamic port range. [536:23] And then we have the source and that's [536:25] it. [536:26] So where is the destination? [536:29] The statement we are going to make here [536:30] is [536:31] when the traffic hits the virtual [536:34] firewall of a specific instance in the [536:37] inbound direction, [536:39] it is obvious that this is headed to [536:41] this instance. So why should I ask about [536:43] the destination? I know the destination [536:45] IP address. [536:46] I know you are headed to the instance [536:48] I'm trying to protect. So the [536:50] destination is already known, but what [536:51] we care about is where it is coming [536:54] from. [536:55] Who are you? Are you allowed to come in? [536:57] Are you allowed to send traffic in the [536:58] inbound? And we're not talking about [537:01] only your IP address, but also [537:04] which port on the instance. So the the [537:08] port range here is destination port [537:10] range. We don't ask about the IP, [537:12] but we ask about the port. Why? Because [537:15] I may have here web, I may have here [537:17] SSH, I may have here FTP, I may have [537:20] multiple applications on the server or [537:22] on the virtual machine. So I need to [537:24] make sure that I know whether you on [537:27] this IP address, you are allowed to [537:29] communicate with the web. Maybe you're [537:31] only allowed to come into SSH as an [537:34] administrator, but not to use FTP or the [537:37] web. [537:38] So it gives you that granularity that [537:40] you can define based on the source, [537:43] where it is coming from, the source. So [537:45] this is the source. [537:49] But the port is on the server. So it is [537:51] very very important to understand that. [537:56] A lot of the simple and obvious mistakes [537:58] happen because of this confusion and [538:00] people don't know what is the source, [538:02] where is the source, where is the [538:03] destination. You don't know, you can't [538:05] figure it out, bring a piece of paper, [538:07] draw where is the client, what is the [538:08] flow. Somebody is trying to come through [538:11] TCP and get into the HTTP port on the [538:15] server, trying to get to a web server. [538:17] So the flow is clear. Is it from within [538:20] AWS in my VPC? Is it from outside VPC or [538:23] is it coming from the internet? [538:25] All right, so it's coming from the [538:26] internet. What are the allowed sources [538:28] on the internet that can communicate [538:30] with this virtual machine on the HTTP [538:33] port? [538:35] And based on that you'll find out. So [538:37] here for example, there is only one [538:39] source that is allowed. 98.12.37.32/32. [538:45] So that's a specific IP address, not a [538:47] range. /32 means a host IP address. [538:51] So it has to match everything here as [538:53] is. So this IP address is allowed as a [538:57] source [538:58] to communicate with the HTTP port on the [539:01] instance. [539:04] We have a second rule. The second rule [539:06] is about SSH. [539:08] And SSH runs on TCP and on port 22. [539:12] So port 22 is here. [539:15] So we're talking about port 22. Earlier [539:17] we were talking about port 80. Again, [539:19] that is a port on the instance. [539:23] So this is a destination port. [539:25] The source is 95.12.65.91/32 [539:31] again. [539:32] So /32 means only this IP address. [539:35] So there is another IP address [539:38] that is allowed to come in and to do SSH [539:41] into the instance. [539:42] All right. [539:43] What if we get [539:46] an SSH request, but coming from a [539:48] different IP? For example, what if this [539:50] IP address tries to send an SSH into the [539:53] instance? [539:55] Would it be allowed? [539:56] Security group, inbound, check the [539:59] rules. [540:01] Cross, cross. We don't have any other [540:03] rules. Deny. [540:05] It will not be allowed. [540:06] What if the second IP address tries to [540:08] send in an HTTP? Again, [540:12] do I have an HTTP rule? Yes. What's the [540:14] source? [540:15] 98.12. This is 95.12. [540:19] No, not allowed. [540:21] Cross. So that will be an implicit deny. [540:23] So basically here there is a deny [540:26] anything rule that we don't see. [540:28] However, it's an implicit deny. Deny [540:31] all. [540:31] And as you see at the end, there is no [540:33] allow or deny. It's only allow rules in [540:35] the security group. Based on that, the [540:37] source in the inbound rules is the [540:40] client, the one who initiated the [540:42] traffic, and the port is on the [540:44] instance. [540:45] By the way, if the source was another [540:48] instance within the VPC, so the source [540:51] IP will be all also this one. So if an [540:54] instance within the VPC was trying to [540:56] talk to another instance within the same [540:58] subnet or any different subnet, the [541:00] source is the initiator of the traffic, [541:02] the destination is where it is headed. [541:06] Now let's look at the outbound rules and [541:09] there will be a difference here, a key [541:11] difference. [541:12] So let's look at the outbound rule and [541:14] what information you need to fill in. [541:17] So IP version, same. Type of traffic, [541:20] same field, same choice, pull down menu, [541:22] ICMP, HTTP, SSH, HTTPS, all traffic, all [541:26] TCP and and so on. [541:28] Protocol, TCP or UDP. Port range. [541:32] And destination. [541:34] So it is very clear if the traffic is [541:36] going out, we are talking about the [541:38] destination IP address. [541:41] But also we are talking about the [541:42] destination port [541:45] or ports. [541:47] So in the outbound, we know the source [541:50] is the instance because this is the [541:51] firewall or the security group that will [541:53] inspect the traffic. If it come to me [541:55] and it wants to get out, [541:57] then obviously it's coming from the [541:59] virtual machine. So I don't need to ask [542:01] about the source. [542:02] But in this case, what I need to ask is [542:04] where it is going both at the IP level [542:07] and at the port level on that [542:09] destination. So I don't care about the [542:11] source port, I don't care about the IP [542:13] port because I know them. [542:15] I know it's coming from [542:17] the instance. I know the IP of the [542:19] instance and I know the port because I [542:22] have received the packet and I know the [542:23] port on the instance. [542:25] What I care about to allow it or not [542:26] allowed is where it is going, not [542:30] where it has been originated from. [542:33] All right. [542:34] So if there is no rule to allow that, [542:37] then guess what? There will be an [542:38] implicit deny at the end that will block [542:40] the traffic. [542:42] So in this example, we are allowing IPv4 [542:44] HTTP [542:46] on port 80 to go to this specific IP [542:49] address. So the instance can send [542:52] outbound HTTP to a specific IP address, [542:56] which is the 133.45.89. [542:59] And it's a specific IP, not a range. [543:04] And I also allow HTTPS, the secure [543:07] version of HTTP on port 443, [543:10] and that is to another IP, [543:12] 100.130.4.56/32. [543:17] So I have two IP addresses. I'm allowed [543:19] to send one of them HTTP [543:22] and the other one I'm allowed to send it [543:24] HTTPS. And that's it. [543:26] So what about any other traffic? If the [543:28] instance tries to ping another instance, [543:31] not allowed. Why? Because [543:33] it doesn't match, doesn't match, [543:35] blocked. What if it it is trying to SSH [543:38] into another server? Not allowed. Why? [543:40] Because it's not HTTP and it's not HTTPS [543:42] and it's not port 80 and it's not port [543:43] 443. [543:45] What if it is trying to HTTP into a [543:48] third IP? So an IP that is not this one [543:53] and is not that this one and it's [543:54] initiated from here. Block. Why? Because [543:57] this is very specific, very close. [544:01] What if I need the instance to download [544:04] updates from a specific server on the [544:06] internet? [544:08] I mean in addition to these two, [544:10] I need to download or download something [544:12] from GitHub [544:14] or download something from a storage in [544:17] S3 or a storage in Azure. [544:20] Do you know the IP address of the [544:22] server? [544:23] If you know, then configure a new rule [544:25] and allow HTTP or HTTPS. So you have to [544:28] know the IP address of the server [544:30] and you have to the port range or the [544:32] port on the server and then you need to [544:34] add a rule to allow that. And please [544:37] also pay attention, there is no allow or [544:39] deny because the rules in a security [544:40] group in AWS [544:43] is without deny rules. You allow, allow, [544:46] allow, everything else is denied [544:47] implicitly. [544:49] It could be different in Azure. It could [544:50] be different in GCP. So always study the [544:53] specifics of the firewalls that are [544:56] available in the cloud provider that you [544:58] are working. Find out if you can [545:00] configure allow or deny. Find out if it [545:03] is stateless or stateful [545:06] and then decide on what you need to [545:08] configure. Is it asking about the source [545:10] IP, destination port, destination IP? If [545:13] you understand this well and you [545:14] understand your flows that you want to [545:16] allow, then you'll be able to configure [545:19] them properly. [545:21] Remember that [545:22] the security groups are stateful. So if [545:25] this instance initiate HTTP to this IP [545:29] address on port 80 and it is allowed [545:32] here, if the traffic goes out to the [545:35] server. Now, the server is going to [545:37] process it and respond. The response is [545:40] going to be allowed automatically in the [545:43] inbound direction even if there is no [545:45] specific rule to allow it. Why? Because [545:49] in AWS, security groups are stateful. [545:54] If you allow traffic in one direction by [545:57] allowing the rule [545:58] whether it is outbound or inbound, if it [546:01] was outbound, the response coming back [546:03] will be inbound to the firewall. So, [546:05] that will be allowed automatically. If [546:07] the traffic was allowed inbound to the [546:09] instance and [546:12] the response will be going out of the [546:14] instance, that will be allowed [546:15] automatically even if you don't have a [546:18] specific rule to allow it. All right? [546:21] So, please remember that the destination [546:24] IP and the port are on the destination [546:27] and not on the instance. [546:37] So, let's go ahead now and do a security [546:39] group walk-through in the AWS console. [546:42] All right. So, where would I find that? [546:43] You can find it under EC2 and you can [546:45] find it under VPC as well. So, what we [546:48] need to do now, let's go ahead and see [546:49] the default security groups, how they [546:51] look like [546:53] and what do they have in terms of rules [546:55] in the inbound and in the outbound. [546:59] So, if you are in the VPC dashboard and [547:01] you scroll down to security, this is [547:04] where security groups are. You can also [547:06] come from here and click on this. So, I [547:08] can click on security groups. [547:12] So, these both are default security [547:14] groups. How would I know? [547:16] They are named default, that's number [547:18] one, and also as you can see here [547:22] default VPC security group, default VPC [547:24] security group. This is not what we [547:25] created. I have two VPCs. We have the [547:28] default VPC and custom VPC and each VPC [547:31] comes by default with one security [547:33] group. What's my proof? Let's move to [547:35] another region that I rarely use, Tokyo, [547:38] for example. [547:41] And let's check how many VPCs we have [547:43] and how many security groups we will [547:45] have. So, let me make this a little [547:47] bigger. [547:48] So, here [547:51] we have one VPC, no name, and if we [547:55] scroll to the right, it will tell me [547:57] it's a default VPC, right? [548:00] And if I go [548:03] to security groups under security [548:05] you'll find there is one security group. [548:07] It's called default [548:09] and it belongs to this VPC and the [548:12] description is default VPC security [548:14] group. So, it's all the same [548:16] but let me move back to Ohio so that we [548:19] don't create anything and then we don't [548:21] need it later on. It's not going to cost [548:24] you anything to create VPC security [548:26] groups and subnets and route tables and [548:28] all that, but it's a habit that you only [548:30] build resources where you actually need [548:33] them, not just go randomly create [548:35] resources anywhere. If you are used to [548:37] do that, eventually you're going to [548:39] create chargeable resources, forget [548:41] about them, and then get a surprise [548:43] bill. So, let's go ahead and check one [548:45] of the default security groups that is [548:47] in United States in Ohio. [548:51] So, we have two VPCs as we mentioned. [548:54] The one that ends with D23 is the custom [548:56] one. Let's refresh [548:59] ourselves on that. So, this is the [549:01] custom VPC, D23, and this is the default [549:04] which ends with DE2. So, what I can do [549:07] in order to be able to know everything [549:09] in my [549:10] account, then what I will do is this one [549:14] I'm going to mark it as [549:18] custom [549:20] VPC default SG. So, it's custom VPC [549:25] default security group and I'm going to [549:26] save it. [549:28] And the other one I'm going to mark it [549:31] So, let's remove this and I'm going to [549:33] say default VPC default SG. [549:36] So, from now on, I know that this one I [549:39] have created, these ones are the default [549:42] ones, and if I scroll a little bit to [549:44] the right, I'll find these two are in [549:46] the same VPC. So, there is no confusion [549:48] there. Okay. [549:50] What do we need to see? I need to see [549:52] the default security group in the [549:54] default VPC, how does it look like? This [549:57] is the DE2 and if I scroll down, I'll [550:01] find in the inbound rules and outbound [550:03] rules. Inbound rules, there is no name [550:06] for the rule, that's a default rule, and [550:08] this is just the rule ID, so it's [550:10] irrelevant to the actual impact of the [550:13] security group. [550:14] And it allows all traffic. [550:18] All right? So, what are the the the [550:20] other options we're going to edit and [550:21] see now. Allows all protocols, all [550:25] ports, but here is the tricky part. If [550:28] you didn't scroll to the right all the [550:29] way. So, this is how it appears when you [550:31] open it. So, it appears as it allows all [550:34] traffic on all protocols, all port [550:36] ranges. So, they don't scroll all the [550:39] way to the right to check the source. [550:42] So, this source is very tricky. [550:44] So, what does this source say? This is a [550:47] security group ID. [550:49] Each security group has an ID as you can [550:51] see here. [550:54] And the source is the security group [550:57] itself. [550:58] A11 and EA11. [551:03] So, by default [551:05] the security group, the default security [551:07] group, allows all traffic in the inbound [551:10] direction from all ports [551:13] provided it is coming from the same [551:16] security group as the source. What does [551:18] that mean? It has to be coming from an [551:22] instance that has the same security [551:25] group applied to it whether in the same [551:27] subnet or a different subnet. [551:30] So, if it is coming from a different [551:32] instance that has a different security [551:34] group, this will not be allowed. It will [551:36] not be allowed. No matter what the [551:37] traffic is, if the source does not have [551:41] the same security group applied to it, [551:44] it will never be allowed. [551:46] If you wanted to open up the inbound [551:49] rules here, what you have to do is you [551:51] have to do edit inbound rules [551:55] and you can delete this if you want. So, [551:58] I can delete and then I can add rule and [552:01] then I can state what do I need, custom [552:03] TCP or UDP? Is it ICMP or all TCP, all [552:08] UDP? Or you have all ICMP IV4, all [552:11] traffic, SSH, SMTP, and so on. [552:13] So, I can do all traffic from anywhere [552:17] and I can save it, but this is not [552:19] recommended and that's why they are [552:21] stating here, "Rules with this source [552:23] allow all IP addresses to access your [552:25] instance. We recommend setting security [552:28] group rules to allow access from known [552:30] IP addresses only. Don't open up your [552:32] security group widely like this because [552:34] it could be dangerous." Now, you are not [552:36] limiting to anyone and some of the IP [552:40] addresses possibly that will will come [552:42] into your instance or will try to break [552:44] into your instance could be ill-intended [552:47] or malicious activity. [552:50] So, this is for the inbound. I'm not [552:51] going to change anything because this is [552:53] the default and I don't want to play [552:54] with it. [552:56] How about on the outbound? So, please [552:59] remember the default on the inbound rule [553:01] for the default VPC security group [553:05] allows access to all ports, all [553:09] traffic only if it is coming from an [553:13] instance within the same VPC that has [553:15] the same security group applied. [553:18] How about on the outbound? On the [553:20] outbound it allows IPV4, all traffic, [553:24] all protocols, all ports to all [553:27] destinations. [553:28] Traffic from the instance going out is [553:31] allowed to all destinations on all [553:33] ports, zero restrictions. That's for the [553:36] outbound, the traffic that is initiated [553:39] from the instance and going out. So, [553:42] everything is allowed. [553:44] So, that's the default. Let's look at [553:46] the default security group for the [553:48] custom VPC and see if there is any [553:50] difference. [553:52] For the outbound [553:54] it's all traffic, all all all to all [553:56] destinations. So, it's exactly the same [553:58] like the default VPC default security [554:01] group. [554:02] On the inbound [554:03] you will see that all traffic all port [554:06] range, everything if it is coming from [554:08] the same security ID. [554:10] If I want to edit, I would I would show [554:12] you as well for the outbound, for [554:15] example, then I can also do [554:18] for example, delete this rule and then [554:20] add a rule. Let's say where I want to [554:22] allow only HTTP. So, I'm going to allow [554:26] HTTP. [554:28] So, this is the port on the destination [554:32] on the destination. So, this is [554:33] outbound, instance talking to a server. [554:36] The server has HTTP port 80 and as soon [554:39] as you choose HTTP, you'll see here that [554:42] it is port 80. [554:44] What if I had a server operating on port [554:47] 8000? So, it is expecting to receive [554:49] requests on port 8000. So, in that case, [554:52] you can say custom TCP and then you can [554:55] put 8000 [554:57] and you can select what is the IP [555:01] address of the other side if you know [555:02] it. If you don't, you can allow all or [555:04] you can write down the range. So, it [555:06] could be 100.0.0.1/32, [555:11] for example. So, in that case, that [555:13] means it's only allowed HTTP on port [555:16] 8000 only to this server IP address. So, [555:20] you can restrict if you want, but in the [555:23] outbound, you have to account for every [555:25] single possible traffic that will leave [555:28] your instance to the outside, originate [555:30] from your instance to the outside. If [555:32] this instance talks to a database, you [555:34] have to allow that on the outbound. [555:36] If this instance will talk or you will [555:39] look to this instance and it try to ping [555:42] another virtual machine, then you have [555:44] to allow that on the outbound. If the [555:46] traffic is originating from the [555:48] instance, starting from the instance, [555:51] then the outbound rules has to be either [555:54] wide open to account for anything, or it [555:57] has to be detailed enough to account for [555:59] all possible communications out. [556:02] So, this is very important to remember. [556:04] All right? [556:06] So, that was our quick walk through and [556:08] of course, you can always [556:11] go to security groups and you can create [556:13] a new security group, if you wanted. You [556:15] can add rules, if you want. Here, by [556:17] default, on the outbound, [556:20] it's going to allow all traffic [556:21] outbound. On the inbound, you can add [556:23] rules, if you wanted, and it can be SSH [556:25] or anything else that you you need to [556:27] allow. You can lock it down to what you [556:28] want from which IP addresses, or you can [556:31] write down the IP addresses, if you know [556:33] them. Put a description, if you'd like, [556:35] and then save, and that will start the [556:38] security group. Of course, here, because [556:40] I didn't add the information, it's [556:41] asking me for it, so I'm going to skip [556:43] that [556:45] for the inbound rules, and I'm going to [556:47] put a name for the security group. So, [556:49] mine test SG, [556:52] and I'm going to allow [556:55] testing [556:56] security groups. Anything that describes [556:59] what we are trying to do. In your case, [557:00] it's up to you, but here, you will [557:02] always receive this warning, if you [557:04] leave things at 0.0.0.0. [557:08] Now, if I check it out on the inbound [557:10] rules, no inbound rules. [557:13] So, what traffic will be allowed to come [557:16] into this instance through the security [557:19] group? [557:20] Based on what we have here, we have no [557:22] rules explicit. That means we have zero [557:25] allows, [557:26] which means, if traffic is coming, [557:28] originated from the outside, coming [557:30] through the security group, it will be [557:31] dropped. No matter what the traffic is, [557:33] no matter where it's it's coming from, [557:35] because the implicit deny is the only [557:37] rule that exists in this security group [557:39] now on the inbound direction. [557:41] How about if the instance would like to [557:43] communicate from the instance to the [557:45] outside? [557:47] So, let's check what is the outbound [557:48] rule. [557:49] It allows all traffic. [557:53] All protocols, all port ranges to any [557:55] destination. So, any traffic going out [557:58] from the instance through the security [558:01] group, no matter what the port is at the [558:03] destination, no matter what the IP [558:04] address is at the destination, will be [558:06] allowed. [558:07] So, in that case, it's wide open on the [558:09] outbound. For traffic coming from the [558:11] outside, it is wide widely locked. There [558:14] is nothing that is going to pass. [558:17] What if traffic from the instance, let's [558:20] say ping. [558:21] I'm on the instance at the prompt, and [558:23] I'm doing ping 8.8.8.8, [558:26] and assuming that the internet is [558:29] accessible to the instance. So, the [558:30] instance is on a public subnet. [558:33] So, the traffic will go out, it will [558:35] reach Google 8.8.8.8. [558:39] They will formulate the response and [558:41] send it back. [558:43] So, it will come on the inbound of the [558:45] security group. [558:46] Do you think it will pass or it will be [558:48] dropped? [558:49] The response coming from 8.8.8.8 to me. [558:53] The answer is, remember that the [558:55] security groups are stateful. They have [558:58] memory. So, if anything was allowed in [559:01] one direction, the response to that [559:03] traffic will be allowed, no matter what. [559:05] So, in this case, [559:07] the ping response coming from Google [559:09] back through the security group, despite [559:11] the fact there are no rules on the [559:13] inbound, it will pass and the instance [559:15] will see it. [559:17] All right, so that is the statefulness [559:19] of the security group. [559:24] All right, let's go ahead and do some [559:25] practice on security groups and [559:28] stress the facts that we have mentioned. [559:31] So, we have practice number one, and [559:33] this is for inbound rules, and you are [559:35] required to explain what this means. [559:38] So, we have a virtual machine with a [559:40] security group, and the inbound rules [559:42] look like this. [559:45] The first rule is talking about [559:47] type of traffic HTTP, [559:50] and the protocol is TCP, the port is 80, [559:54] and the source is [559:56] 0.0.0/0 [559:58] means from anywhere. [560:00] Anywhere could be from the same subnet, [560:02] could be from the same VPC, could be [560:04] from the internet, could be from another [560:07] VPC. So, I don't care where it's coming [560:09] from, basically. Here, it says, if it is [560:12] headed to port 80, [560:14] and that's HTTP, I don't care where it's [560:16] coming from, allowed. [560:18] And remember that we don't we don't [560:19] write allowed here, because there is an [560:21] implicit deny at the end. [560:23] The second rule we have, we allow SSH on [560:26] port 22 [560:28] from this specific IP. And why we are [560:30] saying specific IP? Because it's /32. [560:33] That means only this IP. [560:35] So, explain what does this mean? [560:38] If you want to go ahead and pause, [560:40] think about it, [560:41] decide what it does, and then restart or [560:44] resume the video again in order to see [560:47] the answer. [560:51] All right, so what does it mean? It [560:52] means for HTTP port 80, anyone can [560:56] access the instance over HTTP. Anyone [560:59] can send inbound traffic to the instance [561:02] over port HTTP, and no matter what the [561:05] source IP address is, it will be [561:06] allowed. [561:08] For the second rule, it states that for [561:11] port 22 TCP, SSH, [561:14] only this IP address 192.168.1.10 [561:18] can SSH into the server. And this could [561:20] be the IP address of the administrator [561:22] who is allowed to get into the server, [561:24] or the machine that is allowed to be [561:28] used by the administrators to SSH into [561:31] this instance for administrative [561:33] purposes. [561:36] Here is another one, [561:38] and this is [561:39] for outbound. [561:41] So, explain what this means. [561:43] Outbound rules, [561:45] type all traffic, all protocols, all [561:48] port ranges, 0.0.0.0, [561:51] and that's outbound, not inbound. [561:54] Outbound means [561:55] the rule will apply for traffic going [561:58] out of the instance, initiated or [562:00] originated at the instance and moving [562:02] outside. [562:04] So, what do you think? Pause, if it's [562:06] not clear, and try to go through it, and [562:08] then resume to watch. [562:13] So, this means the server can send, or [562:15] the virtual machine can send traffic, [562:18] any traffic, anywhere on any port. [562:21] For example, download updates from the [562:23] internet. [562:25] Is this a recommended setting? The [562:27] answer is no, [562:28] but this is the default setting in AWS. [562:31] They allow everything outbound, and they [562:33] lock everything inbound. [562:37] Number three, [562:38] here's another example, [562:40] inbound rules that we need to explain [562:42] what it does. [562:43] Here, we have SSH, TCP, port 22, from [562:48] anywhere, [562:49] and it's inbound. [562:51] So, we are talking about traffic coming [562:53] this way. [562:54] So, anyone can try to SSH into the [562:56] instance. I think that was obvious and [562:58] easy, that's why I didn't ask you to [562:59] stop and resume the video later on. [563:04] Practice number four. [563:06] There is a custom TCP. So, that's not a [563:09] standard port, [563:11] and the port is 5432. [563:14] And we're talking about [563:16] outbound rules. [563:18] Destination is 10.0.2.0/24. [563:21] Please remember that for the outbound, [563:24] both the ports and the destinations are [563:28] on the destination you are headed to, [563:30] not on the virtual machine itself. [563:32] So, what does this mean? [563:35] Here, we we just have a a drawing for [563:39] a subnet with this same range, assuming [563:41] that this is within AWS. It could be [563:43] outside AWS. [563:46] Okay, so 10.0.1.0/24 [563:48] is where the instance in question is. [563:51] So, this is applied to instance A. We're [563:54] not talking about this one. [563:56] So, this is where the security group is [563:57] applied, and now we are look looking at [563:59] outbound, [564:02] and this is only allowed, if it is [564:05] going to 10.0.2.0/24, [564:10] and on a specific port, which is 5432. [564:15] Interpretation. [564:18] This server, which is instance A, [564:22] can connect to 10.0.2.0/24. [564:25] So, any instance within this subnet. [564:28] This is not a /32. [564:30] /24 means I have 254 usable hosts [564:35] that I can send the traffic to. Of [564:37] course, in AWS, you have the first and [564:39] last, the broadcast IP and the subnet [564:41] ID, [564:42] and the first three more IP addresses, [564:45] so the one, two, three as well. These [564:47] are not allowed, these are reserved. [564:49] So, now, if you have 251 IP addresses [564:51] usable, then you send the traffic to any [564:54] one of them on this port, and things [564:56] will be allowed. [564:58] Of course, this is outbound here. If [565:01] it's not allowed inbound in the security [565:03] group here, it will not be functioning. [565:06] Although it went out of the security [565:08] group here, but it was blocked here. So, [565:10] you have to allow [565:12] the rules that are on security groups or [565:15] security firewalls along the path, not [565:18] only at the source. [565:22] All right, practice number five. [565:24] Custom TCP [565:25] protocol is TCP and port range and [565:28] source. Source means this is inbound [565:32] rule. [565:33] All right, so always keep in mind. So [565:35] now I'm talking about traffic that will [565:37] be coming into my instances [565:41] and the source is 10.0.1.0/24. [565:45] And that's custom TCP. It's a little bit [565:48] confusing. Pause the video, think about [565:50] it, and then resume to watch. [565:55] So the subnet where the security group [565:58] and the instance are is 10.0.1.0/24. [566:03] And now we are looking at the inbound [566:04] rule, let's say at the security group of [566:06] this instance, for example. [566:09] So I'm going to allow [566:12] TCP port 3306 [566:14] on the instance. So 3306 is a port on [566:18] the instance, and that's a database port [566:20] well known. [566:23] Only if the source IP address that sent [566:26] in the request was within the [566:28] 10.0.1.0/24, [566:30] but that is my subnet. [566:32] So this rule means [566:34] we will only allow access to the port [566:37] 3306 on the instance if the request was [566:40] coming from within the subnet. So [566:43] another virtual machine, another [566:45] instance within the subnet, then we are [566:47] going to allow it. [566:49] And that's the interpretation. [566:50] So only EC2 instances in this subnet can [566:53] connect on port 3306, which is MySQL [566:57] database, and that is the most used [566:59] database on the internet. All right, so [567:01] hopefully that was clear. Inbound and [567:03] outbound, watch it, remember that it is [567:05] stateful, and always draw your flows [567:09] until you get your head around it, and [567:11] then you can do mind mapping to the [567:13] flows and all that, and decide what is [567:15] right and what is wrong. [567:19] All right, let's go ahead and do [567:22] an in-depth security group practice, and [567:25] we're going to involve virtual machines [567:27] in order to know more and understand [567:29] security groups much better than we did [567:32] on the slide. So let's understand it [567:34] hands-on. Let's get our hands dirty [567:36] working with security groups. [567:38] So we want to do a setup, [567:41] a lab, hands-on lab in AWS that will be [567:45] used for us to test and ping and SSH and [567:48] all that stuff, and see if it works or [567:50] it doesn't work. [567:53] All right, lab setup, step number one. [567:57] We need to create two security groups, [568:00] and we'll use the names [568:02] security group A, security group B, and [568:04] leave the default settings. [568:07] And we're going to walk through the [568:08] default inbound and outbound rules [568:10] configurations on this default settings. [568:15] So let's go ahead and do that first. All [568:16] right, so I need to create two security [568:18] groups. Let's find easy. [568:21] Security groups. [568:23] We are going to [568:27] name them SGA [568:29] for the first one, [568:31] testing [568:32] security groups, [568:35] and this is going to be in the custom [568:38] VPC. We're going to do everything in the [568:40] custom VPC. [568:42] Inbound rules, I was told to leave it at [568:44] the default. Outbound rules, leave it at [568:45] the default. So I don't need anything [568:47] else. Create. [568:51] And now I need to create a new one. [568:53] So I'm going to go back [568:55] and create a security group, [568:58] and I'm going to call it SGB as [569:01] instructed, and testing [569:04] security groups, [569:06] and again in the custom VPC. If you [569:09] create a security group in a VPC and you [569:12] go to another one expecting that you [569:14] created it in the second one, you will [569:15] not see it. [569:17] So security group as a resource is tied [569:19] or confined to a VPC. [569:22] It's not confined to an account where [569:24] you can use it however you like. That's [569:27] why they are asking me where should this [569:29] be created. [569:31] And leave everything to the default as I [569:33] was instructed and create the security [569:35] groups. [569:36] All right, let's check. [569:38] Since both are identical, let's check [569:40] one of them, SGB, for example. [569:42] So on the inbound, there is nothing [569:44] allowed. On the outbound, [569:47] all IPv4, all traffic, all protocols, [569:49] all ranges to all destinations is [569:51] allowed. All right, that sounds good. [569:54] Let's go ahead and check step number [569:56] two. [569:57] So in step number two, we are going to [569:59] create two virtual machines, two EC2 [570:01] instances. One is called instance_A, [570:05] so we have to use this name, and the [570:06] other is called instance_B in the public [570:10] subnet or subnet one public. [570:12] This subnet is in the custom VPC as [570:14] well, the same VPC where we have created [570:17] the security groups. [570:19] All right, what else should we know [570:20] about these instances? [570:22] Create a key pair for each instance, use [570:25] the instance_A [570:27] key [570:28] and instance_B key for the key pair [570:31] names. [570:34] Ensure that a public IP address is [570:36] assigned to each instance. [570:39] Okay. [570:40] And associate instance A with SGA and [570:43] instance B with SGB. All right, we can [570:47] reference that if we forget anything. So [570:48] let's go ahead and create the two [570:50] virtual machines. [570:51] So I'm still in Ohio. What I will do now [570:53] is I need to go to EC2 dashboard. [570:57] If I click on this, it will over it will [570:59] open in the same tab. So I can [571:01] right-click on that and open link in a [571:03] new tab. And if you look at the top [571:05] here, a new tab will open now. [571:07] So now I have access to the EC2 [571:09] dashboard, and if I switch tabs, I still [571:12] have access to the VPC dashboard. [571:15] So let's go under here and launch [571:17] instance. [571:19] We are going to create the first one. [571:22] So let me enlarge this a little bit. [571:26] So this is going to be instance_A, [571:28] instance_A, [571:31] and I was not told what's the operating [571:33] system, so I'm going to go with Linux, [571:35] Amazon Linux, free tier eligible AMI, [571:39] Amazon machine image, or the OS of that [571:42] instance. [571:44] I'm going to stick with T2 micro. I was [571:46] not told anything, so I'm going to use [571:48] the free ones. [571:50] And of course, if your account is old or [571:52] if you have run out of the AWS credits, [571:55] these prices are going to apply to your [571:57] usage depending on which operating [571:58] system you are going to use. In my case, [572:00] I'm not changing anything. [572:02] Key pair for the first instance, this is [572:05] instance A. I'm going to create a new [572:07] one, and I was told to use instance_A [572:11] instance_A_key [572:14] for the name. [572:19] And as you can see, it has been [572:20] downloaded to my laptop. [572:24] For network settings, I'm going to click [572:26] edit. I want to make sure that it's [572:27] going to be [572:28] in the custom VPC to be able to use the [572:31] security group. So custom VPC. [572:34] And for the subnet, I want it to be in [572:36] the public subnet, sub subnet [572:38] one_public. [572:40] And enable the assignment of an IP [572:44] address, [572:45] public IP address, and I'm going to [572:47] select an existing security group, and [572:49] that would be SGA. [572:54] And there is nothing else that I'm told [572:57] to do. Just a quick review, instance_A, [573:01] Amazon Linux, [573:03] T2 micro, free tier eligible, [573:05] the key pair as instructed, I've used [573:08] the same name. Network settings, custom [573:11] VPC, and the subnet is subnet one [573:13] public. [573:15] Security group is SGA. So I've done [573:17] everything as instructed. [573:21] Are we done? No, we are not done. We [573:23] still need to create a second instance, [573:26] and we are given the [573:29] details for that one as well. So I'm [573:30] going to do instance_B. [573:34] I'm going to copy this one, it will help [573:36] me [573:37] do things quicker. Amazon Linux [573:40] and T2 micro, and for the key pair, I'm [573:42] going to create a new one, but this is [573:45] going to be instance_B [573:48] key. [573:50] And create, and you will see that it has [573:53] been downloaded as well. So I have [573:54] instance_A key and instance_B key both [573:58] downloaded to my laptop. I can click [574:00] here or click the folder and it will [574:02] bring it up. It will open the folder and [574:04] I will see where that is. But in my [574:06] case, I'm sure that it goes [574:07] automatically into the downloads folder. [574:10] In your case, most probably it's going [574:12] to be also in the downloads, but you [574:13] need to go and check that. Or when you [574:15] see something like that on Windows, just [574:18] click on the folder and it will open it [574:20] up on the side to you, so you will know [574:21] exactly where it went. [574:24] Network settings, I'm going to do edit, [574:26] custom VPC, [574:28] and for the subnet, again the same [574:32] thing, the public subnet. So both they [574:34] are going to be in the same subnet, [574:35] which implies they are in the same [574:37] availability zone. How did I know? [574:39] Subnets do not extend beyond an [574:41] availability zone. [574:43] Select an existing security group, and [574:45] I'm going to go in this case with [574:46] security group B. [574:48] And there is nothing else, quick review, [574:51] instance_B, [574:52] it's Amazon Linux, T2 micro, and the [574:56] name of the key, custom VPC, it's in [574:59] public subnet one, and this one, see? [575:02] Always there is something that you may [575:04] forget. After nine or 10 years now with [575:07] AWS, and I still rush things. [575:09] So please be patient and don't rush [575:11] things. Of course, as you grow in your [575:14] career or as you grow in your cloud or [575:16] network or anything, you will know that [575:17] in the cloud, we actually do not usually [575:20] work with manual stuff. We build [575:23] scripts, infrastructure as code using [575:25] Terraform or CloudFormation, and we [575:28] submit these codes, and it has [575:31] everything we need to do, and we don't [575:32] need even to log in to the console. [575:35] But, that we will learn as we go. [575:38] So, security group B, everything looks [575:40] fine, [575:41] and the IP address is enabled, [575:43] everything is cool, so let's launch the [575:45] instance. So, now I have the two [575:46] instances created as per the [575:49] specifications I have been given, and [575:51] this is what usually a cloud engineer [575:53] would be doing, whether it is manual or [575:56] through the Terraform script [575:59] or CloudFormation script, you will be [576:00] building infrastructure resources so the [576:03] developers can use them, and the [576:05] application architects and application [576:07] engineers and the software engineers can [576:09] use it to test and deploy software. [576:13] All right. [576:14] So, now we have the two instances, [576:16] hopefully, up and running. Let me just [576:18] minimize this a little bit. So, I have [576:20] instance A, instance B. What do we need [576:22] to do now? Verify that the correct [576:24] security group is associated with the [576:25] correct instance. So, I need to find out [576:27] that SGA is with instance A, and SGB is [576:31] with instance B, and that's very easy to [576:33] do. So, all I need to do is click here, [576:35] and under the security tab, this is for [576:37] instance A, I'm going to scroll down, [576:40] and I will find that security group is [576:42] SGA. [576:44] And if I switch this tab, I'll find that [576:48] security group on instance B is SGB. So, [576:52] all good. We have the security groups, [576:54] we have everything, so now it's time for [576:55] us to start testing. So, what we have [576:58] achieved now is I have instance A, [576:59] instance B, and I have applied SGA on [577:02] instance A and SGB on instance B, and [577:05] they are both in the same subnet. [577:10] Okay, so what do we need to do? From [577:12] your laptop, from your machine, you need [577:14] to try and SSH into instance A, and can [577:18] you do that? Yes or no? And why? [577:21] So, from your laptop, this is SGA. From [577:24] my laptop, [577:28] through the big eye, the beautiful [577:29] internet, and of course, this is all [577:32] inside AWS, [577:35] we need to try and SSH into instance A. [577:38] So, I'm going to send SSH request [577:40] through the security group A. [577:43] Would that reach the instance and be [577:46] successful or not? That's what we need [577:47] to test. In your case, you will do it in [577:50] the command prompt if you are using [577:52] Windows. Forget about PowerShell for [577:54] now. Command prompt, CMD, as we have [577:56] seen in other labs. [577:58] And in my case, or if you have a Linux [578:00] machine, you're going to do it from the [578:01] terminal, or you need to get into the [578:03] Linux console and do it from there. [578:06] But, let's grab the command first. So, [578:09] I'm going to go into instance A. I'm [578:11] going to click on connect, [578:13] and SSH client, [578:15] and here are the commands. So, this is [578:17] the command that I need to see if it [578:19] works or it doesn't work. [578:21] So, let's try. I'm going to go back to [578:23] my terminal, I'm using Mac. [578:25] Okay, so now just clear. [578:28] So, here we go. Let's paste the command, [578:31] and I'm going to hit enter. [578:37] What do you think will happen? [578:40] Why are we waiting? [578:44] So, nothing is happening. What do you [578:45] guess is happening? [578:47] So, the question was, [578:49] are you able to make it? Are you able to [578:52] connect? [578:53] And if yes or no, why? [578:56] What do you think? [578:57] What do you think the reason is we are [578:59] unable to get [579:01] a response, [579:03] and we are just waiting, and we'll keep [579:04] waiting and waiting and waiting, [579:07] and it will time out. The request is [579:09] going to time out. [579:10] If you ever get a time out, that [579:12] indicates [579:14] for some reason, the request has not [579:16] reached the SSH server on the instance, [579:20] and that's why you did not get a [579:21] response. [579:22] If the request reached the SSH server, [579:25] you're going to get a response, and it [579:27] could be a positive response or a [579:28] negative response. [579:30] But, if it times out, as you can see [579:32] here, [579:34] that means [579:36] it has timed out because the security [579:38] group, for some reason, or the security [579:40] in general, blocked it. In our case, it [579:43] must be the security group. [579:45] Let's go back to the VPC, [579:47] and let's look at This is instance A, so [579:50] it must be SGA. [579:52] So, let's go back to the security [579:53] groups. I clicked on the VPC, I'm now in [579:55] the VPC dashboard, [579:57] and if you look at SGA, let me just [580:00] shrink this down a little bit, or maybe [580:02] just minimize this a bit. [580:04] So, SGA, [580:07] here we go. [580:10] SGA on the inbound, [580:13] let's take this one up. [580:15] It has no rules whatsoever, no rules. [580:18] So, definitely it's not going to allow [580:20] SSH in, it's not going to allow ICMP, [580:22] it's not going to allow anything. [580:25] Let's verify. [580:28] So, let me try and ping the IP address [580:31] of the instance, which is 3.140.186.254. [580:35] So, 3.1 [580:38] 40. [580:40] 186.254. [580:46] Request time out, request time out, [580:48] request time out, request time out. [580:50] Of course, and if you try anything else, [580:52] it will not work because it's not going [580:55] through the security group, it does not [580:57] reach the instance. The response to ping [581:00] must come from the instance. The [581:01] response to SSH must come from the [581:03] instance, and if the request is not [581:05] making it to the instance, the instance [581:07] doesn't know anything about it. [581:09] And why it is not reaching? Because the [581:12] security group is dropping it. So, if if [581:14] we go back here, no, I can't, and we [581:16] know why we can't. [581:20] So, if we SSH from the instance to [581:23] instance B, can we? And why? And the [581:26] answer is, of course not. You want to [581:28] try it? Let's go ahead. [581:30] Remember that the two security groups [581:31] are identical. So, if we look at SGB, [581:34] which is this here, [581:37] on the inbound, same thing, nothing. [581:41] You want to try it? Okay, fine. [581:43] Let's verify. So, I'm going to go back [581:45] to instances, [581:47] and this time I'm going to go to [581:49] instance B, [581:50] and I'm going to click on connect, take [581:53] the command, this is for instance B, [581:56] and I'm going to try [581:58] SSH, [581:59] and the same scenario is going to [582:01] repeat. [582:04] So, different IP address, different [582:06] instance, [582:07] security group has exactly the same [582:08] configuration. So, you're trying to do [582:10] the same thing with the same [582:11] configuration. What do you expect will [582:12] happen? [582:13] It's going to be the same result, for [582:14] sure. [582:16] So, leave it to time out, and let's go [582:18] back and see what do we need to do now. [582:21] Add the SSH from anywhere to the inbound [582:24] rules in SGA and SGB. All right. So, I'm [582:28] going to go back to the VPC dashboard, [582:30] and this is SGB. Let's do B first. Edit [582:33] inbound rules. [582:35] I'm going to add a rule that is going to [582:37] allow SSH, very specific, [582:40] and I was told from anywhere, and we can [582:43] write here [582:45] allow [582:46] SSH inbound [582:48] from anywhere. [582:50] These descriptions will be helpful as [582:52] the number of security groups and rules [582:54] you have will grow to let you know what [582:56] is this rule doing exactly. So, save [582:58] rule, [583:00] and that was Need to double-check that [583:02] was in the inbound direction, [583:04] and that is taking place now. So, it's [583:06] IPv4 SSH TCP, port 22 from anywhere. So, [583:10] we need to do the same, as instructed, [583:13] for SGA. [583:15] So, that's the inbound, nothing in here. [583:17] Edit inbound rules, add rule, and also [583:21] we're going to go do SSH [583:23] from anywhere, and again, the same [583:25] thing. [583:26] Allow [583:28] SSH inbound [583:31] from anywhere. Okay. [583:34] Save rule. [583:36] Make sure that it has taken place. So, [583:38] SGA, [583:40] and look at the inbound, and it looks [583:42] like it is configured as expected. All [583:44] right. So, what do we need to do now? [583:46] So, that is done. [583:48] SSH into instance A. [583:50] Can you? Let's figure out. So, I'm going [583:53] to go back to the tab of the instances. [583:55] I'm going to go to instance A. [583:57] So, let me grab instance A, click on [584:00] connect, [584:01] and SSH client, let me go to the last, [584:04] and copy it. Now, [584:08] see? [584:09] The request now. [584:12] Oh, this is B, sorry. So, B, before it [584:14] timed out, [584:16] we have [584:18] put the rule in, and now it has been [584:19] accepted, so yes. [584:22] And of course, we have a problem. It's [584:24] unprotected private key file. [584:26] So, let me clear this one. As per the [584:28] instruction, I need to try A now. [584:32] So, see, the response is very quick [584:34] because it has reached the instance. [584:36] Yes, and then we get the same error, [584:38] unprotected private key file. So, what [584:41] do I need to do? We need to do the [584:44] chmod, [584:46] and for the key name and all that. So, [584:48] instead of typing, I'm going to copy it. [584:50] We need to do this in order to make the [584:52] key private, not public. So, I'm going [584:54] to go back, [584:56] paste, [584:57] and hit enter, [584:59] and then try the SSH again. The up and [585:01] down arrow repeat the commands, [585:04] the previous history, I mean. [585:07] So, this one looks like it's going to [585:09] work now. And as you see here, let me do [585:11] a clear. [585:13] I am now in the instance as the user [585:15] EC2-user [585:17] on the IP address 172.31.4.157. [585:22] How can we tell that this is the right [585:24] IP address? Let's go back to the [585:26] instance. [585:28] Click here. [585:30] And look at the private IP address [585:32] 172.31.4.157. [585:36] 172.31.4.157. [585:38] So, now I'm in instance A. So, this was [585:41] successful. Exit. [585:43] And what we need now is we need to try [585:45] to SSH B and see if it works. [585:48] So, this is it's SSH and this is still [585:51] A. [585:53] This is B. [585:54] 3.148.115.161. [585:57] So, this is instance B. [585:59] Enter. [586:02] And again, the same problem. We need the [586:04] chmod command. [586:06] So, I'm going to Let me just grab this [586:08] one up. [586:10] And let's do a clear. [586:12] I'm going to repeat. [586:15] And chmod, the only difference is this [586:18] used to be key B. I'm trying to save [586:21] time, but if you wanted to know the [586:22] exact one, then you can go here. I can [586:25] go to instance B. [586:27] Connect and copy. [586:32] And then go back. [586:35] So, I'm going to delete this completely. [586:38] Just hit enter and get an error. Oh. [586:41] Exit. [586:43] Quit. [586:48] Control C. [586:49] Yeah. [586:50] So, here I am. [586:51] I'm going to do control V. [586:55] Enter and then repeat the SSH. [586:58] And now it should work without errors. [587:00] See? Let's clear. All right, so [587:03] hopefully that is clear. [587:06] What else do I need to do? [587:09] SSH into instance B. Can you? Yes, I [587:11] can. So, we could do both of them. [587:17] We are still with firewalls as network [587:20] devices and we're going to look at [587:23] another example in AWS cloud, which is [587:25] the network access control list, [587:27] abbreviated knuckles or NACLs. [587:32] So, the knuckle or the network access [587:34] control list is again a layer four [587:37] firewall. It doesn't understand the [587:39] upper layers, the application and so on. [587:41] And it applies at the subnet level. [587:44] Before we proceed and we continue, [587:46] please note, the network ACLs part is an [587:49] optional part for those who are not [587:52] getting into cloud engineering, who are [587:54] not getting into network engineering and [587:57] network security. So, that is optional. [587:59] You have already knew what a firewall is [588:02] and what it can do by learning the [588:04] security groups. [588:05] So, if you are not planning to [588:07] specialize in one of these three [588:09] specialties, I think DevOps and ML Ops [588:11] to an extent are also included, then you [588:13] can skip this part. But if you are going [588:16] to learn the AWS cloud and you're going [588:18] to build infrastructures in the AWS [588:20] cloud, no matter what your role is, even [588:22] if you are a developer, then network [588:25] access control lists are very important [588:27] because this is part of the security [588:30] and depending on what you are [588:31] developing, it can be a mandate, not an [588:35] optional thing to configure and lock [588:38] down your network ACLs. All right. [588:41] The network ACL is a virtual firewall [588:44] that functions at the subnet level. [588:47] Remember we discussed the security [588:49] groups and we said that security groups [588:51] apply at the instance level, at the [588:53] virtual machine level. [588:55] Now, we are talking about the subnet [588:58] level. So, whatever is going to be [589:00] allowed through the firewall, in or out, [589:04] that will be at the subnet level. [589:06] Whatever is going to be blocked from [589:08] getting in or going out, it will apply [589:10] to all the virtual machines in that [589:12] subnet. So, this is very important to [589:14] note. The scope of the ACL is the subnet [589:18] with everything inside that subnet. [589:22] So, the network ACL decides what goes [589:25] into the subnet and what comes out of [589:27] the subnet. [589:29] The network access control list rules [589:32] are numbered, unlike security groups [589:34] where we just created rules, these ones [589:36] have numbers. [589:37] And the inspection, when there is some [589:39] traffic and we need to decide, the [589:41] network ACL needs to decide whether to [589:43] allow it or deny it, it starts the [589:45] investigation at the lowest numbered [589:48] rule and then the next until a match is [589:51] found. Once a match is found, it stops [589:53] the search and then a decision is made. [589:58] And we can configure allow and deny [590:00] rules. [590:01] Here's an example. [590:03] I have rule 50, rule number 50, rule [590:06] number 90, rule number 100 and then an [590:09] asterisk. [590:10] This one is an explicit deny. If no [590:12] match is found, then there is a deny at [590:15] the end. [590:18] Parameters or variables that we [590:19] configure, the type of traffic, [590:21] SSH, HTTP, all ICMP, all TCP, all UDP [590:25] and so on, the protocol, [590:28] what is the port or port range and what [590:31] is the source. So, this one, for [590:32] example, is for inbound rules. [590:35] If it was outbound, it will be [590:36] destination. And then we have allow or [590:38] deny. So, what is the action if there is [590:41] a match. [590:43] The security group functions at the [590:45] virtual machine level. [590:47] And we are saying that the network ACL [590:49] functions at the subnet level. [590:52] Where does it take effect? And the [590:54] answer is it's at the implied router. [590:56] Remember we said each subnet is [590:58] automatically connected to the implied [591:01] router. [591:02] So, the best location to oversee the [591:05] entire subnet is not to be inside the [591:07] subnet. It is configured at the implied [591:10] router and it functions at the implied [591:12] router. [591:15] The impact of the network ACL is applied [591:18] or applicable to all instances in the [591:20] respective subnet. So, for example, [591:23] if on this [591:24] network ACL, we said there is no [591:28] permission for any HTTP to go into the [591:31] subnet. [591:33] But here I have a web server. So, this [591:35] was a Let's say a database server, [591:37] but this was a web server, a website. [591:41] And the website is listening on port 80, [591:44] which is by default HTTP. If you deny [591:46] HTTP, it will apply to all the [591:49] instances. For this one, it doesn't [591:51] matter. It's a database and it functions [591:53] at a different port, not HTTP 80. [591:56] But for this one, what you have just [591:58] done by denying HTTP to go into the [592:01] subnet, you have denied any traffic from [592:04] reaching this web server. That's why [592:06] this will be broken. [592:08] Having a network ACL configured, you [592:10] need to make sure that at the network [592:13] ACL, you apply the generic traffic that [592:16] should be allowed or denied across the [592:18] subnet. [592:19] Then at the security group level, you [592:22] can confine, you can refine the allow [592:26] uh statements to what this virtual [592:29] machine should receive and then the rest [592:32] will be implicitly denied. [592:35] Directions of traffic. [592:37] If the traffic is going into the subnet, [592:41] so coming from the router and it should [592:43] pass through the firewall to go into the [592:45] subnet, this is inbound. Ingress to the [592:49] subnet. [592:50] If the traffic is coming out and it [592:52] should pass through the firewall to go [592:54] to the router and then somewhere else, [592:56] that is outbound from the subnet. So, [592:59] inbound and outbound are from the [593:02] perspective of the subnet. [593:06] In security groups, we said they were [593:07] stateful. Stateful means if one if [593:09] traffic is allowed in one direction, its [593:12] response will make it through in the [593:14] opposite direction even if there are no [593:16] rules to allow it. [593:19] In ACLs, it's completely different. It's [593:22] stateful. [593:24] So, you want to SSH into a server, then [593:27] you have to allow through the ACL SSH [593:30] in the inbound to the subnet where the [593:32] server is. [593:33] You have to allow the response from the [593:36] virtual machine or the instance [593:38] going out to the user again. [593:41] So, you have to allow both directions, [593:43] otherwise it will not function. [593:46] So, if we want to allow traffic on the [593:48] inbound, let's say we want to allow all [593:50] traffic in the inbound, then what we [593:52] need to do is we're going to have [593:54] a rule numbered all traffic [593:57] from all sources allow. If you don't do [594:00] this, it's going to hit the explicit [594:02] deny and it will be denied. [594:04] And in the outbound direction, you have [594:06] to have a rule that will allow traffic [594:08] as well. Here it's allowing all traffic [594:11] to all destinations. [594:12] If you don't allow it, it will hit the [594:14] explicit rule. Do you have to do allow [594:16] all, allow all? Of course not. You have [594:17] to lock it down to what is permissible. [594:20] This is a wide open network ACL on the [594:23] inbound and outbound direction and this [594:25] is not a good security practice, [594:27] although it is the default in AWS. [594:32] Why do we need the network ACLs if we [594:34] already have security groups? [594:38] We add an extra layer of protection at [594:41] the subnet level. [594:43] So, you have the security group at the [594:45] virtual machine level and you have a [594:46] second layer of defense at the subnet [594:49] level. [594:51] Also, if you would like to deny specific [594:55] traffic, let's say we figured out after [594:57] investigation that there is a specific [595:00] range of IP addresses [595:02] coming from a specific country and that [595:05] is malicious that always tries to hack [595:07] into our website or our network or our [595:10] VPC presence. [595:12] We would like to deny that traffic [595:14] completely and allow the rest of the [595:16] internet. [595:17] So in that case then since we can do [595:19] deny and allow, I can have a rule in the [595:23] inbound to deny the range for any port [595:26] for anything [595:27] and then afterwards, let's say the first [595:30] one is rule number 100, the second will [595:32] be rule 110 or 200 and it will allow [595:36] traffic from anywhere else. [595:40] Also, if you want to block IP ranges at [595:42] the subnet level [595:44] and you are working on a compliance [595:46] heavy environment where they need [595:48] multiple layers of protection or [595:50] firewalls. [595:55] Let's go ahead to the AWS console and [595:58] have a look at the network ACLs, how [596:01] they are configured, what parameters are [596:03] there and what are the default settings [596:06] in the default network ACLs in AWS. [596:10] So here I am in the AWS console. I want [596:12] to go to the VPC dashboard and I want to [596:14] go under security and here is network [596:17] ACLs. [596:19] So we have an ACL. Here is the ID of the [596:22] ACL, no names and here's another one. [596:25] This one is applied to four subnets. [596:27] This one has applied to three subnets. [596:29] I'm still in Ohio. [596:32] It's a default network ACL, so which [596:35] means created by AWS. I did not create [596:38] it. [596:39] And this one is in the default VPC [596:42] and this one is in the custom VPC. So [596:44] let me go ahead here and write down [596:47] some labels that will help me. [596:51] Custom VPC [596:53] and this one is [596:56] default [596:58] VPC. Always the tags or the labels, they [597:00] will help you as you work through [597:03] uh your exercises and projects because [597:06] you want to quickly identify the [597:08] resources that you would like to check, [597:10] troubleshoot, manipulate, edit and so [597:12] on. [597:13] Okay, so let's look at the default VPC [597:16] network ACL. [597:17] And here is the ACL. Let's look at the [597:21] inbound rules. [597:25] Here you'd see at the inbound, all [597:27] traffic, all protocols, all ports from [597:30] all sources is allowed. [597:33] So all the traffic coming inbound [597:35] through this ACL is going to be allowed [597:37] inbound, no matter where the source it's [597:40] coming from is. [597:42] And on the outbound [597:49] rule number 100, all traffic, all [597:51] protocols, all ports to all [597:52] destinations. Outbound means it's [597:55] leaving the subnet to a destination. So [597:57] all destinations, so that means the [598:00] virtual machines on this subnet can send [598:02] traffic to anywhere on any port. [598:04] Basically, the inbound and outbound by [598:06] default does not filter anything at the [598:09] network ACL level. Is this a good [598:10] security practice? The answer is no. You [598:13] need to lock it down. You need to [598:14] identify what is allowed outbound, what [598:16] is allowed inbound and lock it down to [598:19] that and don't be generous when it comes [598:21] to security. [598:23] And this VPC network ACL is applied to [598:26] three subnets and these are the subnet [598:28] IDs and these are the default subnets in [598:31] the default VPC which we did not create [598:33] them. [598:35] How about the other one? So this is a [598:37] default network ACL in a custom VPC. [598:40] Let's see how different that would be. [598:43] So actually on the inbound, there is no [598:45] difference. It's exactly the same. [598:48] And on the outbound, there is no [598:50] difference. It's exactly the same. [598:53] Please note that it is [598:56] the destination in the outbound, the [598:58] destination IPs and the destination [599:00] ports like in security groups. [599:03] For the inbound, it is the destination [599:05] ports [599:07] in the subnet, in the virtual machines [599:09] in the subnet, but the source is where [599:11] it came from outside the subnet. So the [599:14] source in the inbound is where it came [599:18] from, from the outside to the subnet. [599:22] And this one applies to four subnets and [599:24] these are the subnets that we created, [599:26] subnet two, three, four and subnet one [599:28] public. Remember in custom VPCs, there [599:31] are no default subnets. You have to [599:33] create the subnets. So these are the [599:35] ones that we created. [599:38] Now if I want to associate a VPC network [599:43] ACL with a subnet, then you can go into [599:45] subnet associations, you can edit and [599:47] then you can identify which subnets are [599:49] going to use this ACL and which will [599:52] not. [599:53] Since I have only one ACL all the [599:55] subnets will have that ACL applied to [599:58] them. So it's like route tables. If you [600:00] don't create custom route tables, there [600:02] will be one main default route table for [600:05] the VPC [600:06] and that will apply to all subnets in [600:08] the VPC. Same thing for the ACLs, it's [600:11] one default ACL per VPC that allows all [600:14] the traffic in and out and it will apply [600:16] to every subnet that you create unless [600:19] you start creating your own custom ACLs [600:23] and you start associating them with the [600:25] relevant subnets that you want. All [600:27] right? So these are default settings. [600:30] Network ACLs don't filter anything. So [600:32] this is how it is. [600:34] Let me just go back. [600:37] What if I need to add a rule or change a [600:39] rule? [600:40] You can edit. So this is on the inbound [600:42] direction. Where do you want the rule to [600:44] be? Please remember that the inspection [600:47] always happens when there is some [600:49] traffic coming in into the subnet. This [600:52] is inbound. Coming into the subnet [600:54] then it will always start the inspection [600:56] from the lowest numbered rules. [601:00] So if you want to add a rule that is [601:02] going to be inspected first, you have to [601:04] add a rule number that is lower, not [601:06] higher. So 50 for example and then allow [601:10] or let's let's say that this one is [601:11] going to deny SSH from a specific IP. So [601:15] let's say deny [601:17] and we're going to add 100.1.1.10/32. [601:22] So that's a specific IP that should not [601:26] process or should not access SSH into [601:29] the into their subnet. So when we look [601:32] at the rules now, you'll find that it [601:34] has been sorted according to the rule [601:37] numbers. Let me just minimize this a [601:39] little bit [601:41] so I can drag it up and you can see it. [601:46] All right, so I'll keep it [601:48] large. Inbound rules, it has a new rule, [601:52] 50 [601:53] and that's for SSH TCP [601:58] port 22 and the source is this specific [602:01] IP will be denied. [602:03] Now what about the rest? What if another [602:05] a different source IP tries to SSH? Then [602:09] this rule will not match, then it will [602:12] skip to the next rule which is allows [602:15] all traffic. So anybody else will be [602:17] able to SSH [602:19] and anybody else will be able to do all [602:22] the other ports and even this IP address [602:25] can do HTTP, can do ICMP, can do a lot [602:29] of things but not SSH. [602:31] So doing so and the fact that we can [602:35] have deny rules more specific, we can [602:37] put the denies at the top [602:39] and then [602:41] the rules that will come after will [602:43] define what is allowed. So this is how [602:47] flexible network ACLs can be. So [602:50] hopefully this is clear and you have [602:51] seen how we can edit rules and we can do [602:53] the same thing for the outbound as well. [602:56] So you can do edit rules for the [602:58] outbound and then you can add what's to [603:00] be denied and what's to be allowed. [603:03] Please remember that network ACLs are [603:05] not stateful. [603:08] They are stateless. So hopefully this is [603:10] clear and that was a quick walk through [603:12] into network ACLs. [603:19] All right, let's now do some hands-on [603:23] practice where we are going to [603:24] demonstrate the fact that the network [603:26] ACL is stateless and we'll show that we [603:29] have to configure both sides of a [603:31] communication in order for that to work. [603:35] We'll also show the rule numbers and [603:37] their priority [603:39] and some other stuff. So let's find out [603:41] what exactly we are going to do here. [603:45] If you don't have this done earlier, [603:48] please create two security groups, [603:50] security group A [603:52] and security group B and ensure they [603:54] allow all traffic inbound and outbound [603:56] on all ports. [603:58] Basically, what we are trying to do here [604:00] is we are trying to show the impact of [604:02] network ACLs. [604:03] We're not going to examine what the [604:05] security groups can or cannot do. That's [604:07] why we need to have them wide open and [604:11] they are not going to block any traffic [604:12] in or out. So if a blockage happens, [604:15] this is because of the network ACL. [604:17] If any traffic succeeds is also because [604:20] of the network ACL. So we can focus on [604:22] the network ACLs and show their features [604:25] and what the inbound and outbound rules [604:27] impact is in network ACLs. [604:31] So in my case, I'm going to go into the [604:33] custom VPC. All the work will be done in [604:36] a custom VPC. [604:39] And I'm going to go ahead and look at [604:40] the security groups and I have SGA and [604:42] SGB. So all I need to do is to make sure [604:45] they allow all traffic inbound and all [604:47] traffic outbound. [604:49] So here I had them do some traffic, not [604:51] everything. So I will edit inbound [604:53] rules. [604:55] I'm going to delete all the rules [604:58] and I'm going to follow the instruction [605:00] allow all traffic [605:02] from any source. [605:04] That's inbound. [605:08] All right, and I'm going to go back on [605:11] the same one. [605:13] Verify that it allows all traffic from [605:15] any source on the inbound. [605:17] And then I'm going to go on the outbound [605:19] rules and do the same thing. [605:22] Check. [605:23] It's actually allowing all traffic from [605:25] only one IP address, but I want it from [605:28] everywhere. [605:32] So, if I do a final check, always a good [605:35] idea. [605:37] On the outbound, it allows all traffic [605:39] from any source and on the inbound [605:43] it allows all traffic from any source as [605:46] well. All right, so we are good for SGA [605:49] for security group A. [605:51] For security group B, [605:53] inbound, [605:55] also we have some selective allows, so [605:58] we're going to delete delete add rule [606:02] all traffic [606:04] from any source. [606:06] Save. That's the inbound. We need to do [606:08] the same for the outbound, so I'm going [606:09] to go again into SGB. [606:14] Just verify that inbound is correct [606:16] before we do the outbound. [606:19] Outbound rule. [606:21] And there are no rules whatsoever. [606:24] And we need to add a rule and that will [606:26] be all traffic [606:29] from any source. [606:31] And save. I didn't put any descriptions, [606:33] but it's a good idea to put descriptions [606:35] because it will help you find out as the [606:38] number of rules grow, why did you add [606:40] that specific rule? [606:42] Okay, so we did SGA and SGB. [606:45] Step number two, create two EC2 [606:47] instances, instance {underscore} A and [606:49] instance {underscore} B in the public [606:51] subnet subnet {underscore} one public. [606:55] Create a key pair for each instance and [606:58] use the names instance {underscore} A [607:00] {underscore} key and instance [607:02] {underscore} B {underscore} key for the [607:04] key pair names. [607:07] Ensure that a public IP address is [607:09] assigned to each instance [607:11] and associate instance A with SGA and [607:14] instance B with SGB. [607:17] So, in my case, I have these two [607:18] instances created. I'm going to show you [607:21] how they look like and I'm going to [607:23] verify that they are associated with SGA [607:25] for instance A and SGB for instance B. [607:29] Also, I will show you that we have a [607:30] public IP for each and I have already [607:32] done the keys as well. [607:34] So, if you haven't done it, please go [607:36] ahead and do it. And for me, I'm going [607:38] to show you what I have. I'm going to go [607:40] into the instances [607:43] all the EC2 instances and you can simply [607:45] do that EC2 and then right click open in [607:48] a new tab. I have it open already. [607:54] So, here I have two instances, instance [607:56] A and instance B. They are both in the [607:58] stopped state. So, what I will do now is [608:00] I'm going to start them both [608:03] because we need to use them. [608:08] If we need to verify what configuration [608:10] they have, [608:11] this is instance A. [608:12] So, it has a public IP. It has a private [608:15] IP. [608:17] And if we go in under security, [608:19] you'll see here that SGA is allocated to [608:22] instance A and you see that on the [608:24] inbound it allows everything from any [608:27] source and on the outbound allows [608:29] everything from any source as well. [608:37] If you want to connect to to this [608:39] instance, [608:41] you'll find that the instance A [608:42] {underscore} key pem [608:45] is the key and we need to do the [608:49] key to make it private if you are using [608:51] Linux or Mac. [608:53] And this is the command to use in order [608:55] to connect. [608:57] All right, so this is instance A and [608:58] instance B is exactly the same [609:00] configuration, but with instance B and [609:02] the key name is instance {underscore} B [609:04] {underscore} key. [609:07] And if you verify quickly, [609:09] security group SGB [609:12] and it does have [609:15] details, public IP, private IP. [609:19] And we have we can look at the key pair [609:22] name from here. So, instance B key {dot} [609:25] pem. [609:26] And here is the command if you want to [609:27] SSH into the instance, all right? And [609:29] let me check the state of each instance [609:32] and they should be up and running right [609:34] now. [609:36] So, all done. [609:40] Now, let's do the first test. ICMP test [609:43] using ping to the public IP addresses. [609:46] What is the instruction? So, now I have [609:48] the two instances, instance A and [609:50] instance B up and running. This is with [609:52] SGA. This is with SGB. Both are in the [609:54] same subnet and we're going to do some [609:56] ICMP tests now. So, from your laptop, [609:59] ping the public IP address of instance A [610:01] and instance B. Can we and why? [610:07] Let's go ahead and [610:09] get the public IP address of instance A. [610:12] So, here is the public IP address of [610:14] instance A. Copy it. [610:16] This is copied. I'll go I'm going to go [610:18] into my terminal. In your case, you'll [610:20] go into command prompt if you're using [610:21] Windows. So, let me do a ping. [610:25] And you can see that it works. [610:27] If I try to B, I'm going to stop it. Let [610:30] me go into B. [610:34] And copy. [610:36] Go back. [610:37] Ping. [610:40] And it works. [610:41] So, now let let's go back to the [610:43] instruction. Can you? Yes, I can. Why? [610:46] First of all, the security groups SGA [610:49] and SGB, they're not filtering any [610:50] traffic. [610:51] How about the network ACL? [610:53] We haven't checked that. We don't know. [610:56] So, I need to make sure the subnet one [610:58] public is associated with it which ACL. [611:01] I need to go and look at the inbound and [611:04] outbound rules of that ACL in order to [611:06] be able to respond and say why. So, [611:09] let's go under network ACLs in the VPC. [611:13] Security, network ACLs. [611:16] We have only two network ACLs. This one [611:18] is the custom VPC one. So, let me click [611:21] on that. [611:23] Let's verify that it is associated with [611:25] public subnet one, subnet one public and [611:29] it's associated with this ACL. [611:33] So, let's look at the inbound rules. [611:36] Inbound rules in the ACL, [611:39] they deny SSH in, [611:41] but they allow all other traffic. [611:45] That's what's happening right now. [611:47] So, let's bring it to the default. The [611:49] default usually is [611:51] that it allows everything in from any [611:54] source [611:55] and everything out to any source. [611:58] Okay, so this is the default on the [612:01] outbound and this is the default on the [612:03] inbound. So, why did the ICMP ping work [612:06] even when we had the SSH denial rule? [612:09] Because I was sending ICMP and that's [612:10] why it is still working. [612:13] As you can see, it is still running to [612:16] instance B. [612:17] If I stop it and I start it again, it [612:20] will still work because the ICMP is [612:24] allowed through the network ACL [612:27] through the allow every traffic in and [612:28] out and also on the security groups [612:30] allow all traffic in and out. [612:33] In the network ACL, block ICMP inbound [612:36] from any source. [612:38] So, block all ICMPV4 inbound from any [612:41] source. Okay, let's go ahead and do it. [612:43] This is the network ACL. I'm going to do [612:45] edit. [612:47] And I'm going to do add new rule. To add [612:51] the rule above [612:53] 100, so it will be investigated first, [612:56] or below 100, so it will be investigated [612:59] after the allow all traffic. [613:02] Let's try both. Let me try and add it as [613:05] 150. [613:06] And I'm going to say this is for [613:09] ICMP IPV4 [613:13] from anywhere denied. [613:16] So, when the inspection happens, 100 [613:19] will be inspected first and it says [613:21] allowed. [613:22] 150 [613:24] will stop ICMP specifically from [613:27] anywhere. [613:30] So, let's go ahead and look at the ACL [613:33] again at the inbound rules. And this is [613:35] how it looks like. So, this one will be [613:37] investigated first, [613:39] second, [613:40] and third. If this one has a match, it [613:44] will not go to the second. It will make [613:46] a decision, allow, and it will continue. [613:49] If it did not allow here, then the deny [613:52] will take effect. So, let's find out if [613:55] the first one is going to be used or the [613:56] second one. [613:58] As you can see, the ping is still [613:59] ongoing. 120, 122, 124, 126, and so on. [614:04] So, the ping did not even take effect [614:07] because the allow at the top [614:10] was the one that was considered and this [614:13] proves that rule numbers are extremely [614:15] important and if one match is obtained [614:19] from the lowest numbered rule and to the [614:22] next one to the next one, once a match [614:23] happens, [614:25] the investigation aborts with the [614:26] decision of that rule. [614:28] So, let's do one thing here. Let me go [614:30] again on edit and what I will do is I [614:33] will make this 50 only. [614:38] So, the deny rule will be above the [614:40] allow all traffic. [614:44] So, this is how it looks right now. And [614:46] denied. So, let's go ahead and check. [614:49] You'll see that the rule or the ping has [614:51] stopped. Why? Because now it has [614:54] investigated the first rule, which is [614:56] ICMP denied. [614:59] And that's why it stopped. If I remove [615:01] that rule, everything will work again. [615:05] And let's try one thing more before we [615:07] change it. So here I was pinging, this [615:10] is the IP address of instance B, the [615:13] public IP address. Let me try the other [615:15] one, this one. This is for A. [615:19] It will not work as well. Why? Because [615:21] the network ACL is blocking ICMP from [615:25] anywhere to go anywhere into this [615:27] subnet. [615:28] So A, instance A and instance B are in [615:31] the same subnet. So whatever the network [615:33] ACL decides applies to everyone in the [615:35] subnet. If it was allowed, then [615:36] everything everyone is allowed. If it [615:38] was denied, everyone is denied. [615:42] So what happened to the ping? It stopped [615:43] when we blocked it with the rule number [615:45] 50. With the 150, it did not stop it. [615:49] From your laptop, try to ping again to [615:51] instance A and instance B's public IP [615:53] addresses. It's not working, we tried. [615:56] Okay, let's do one more thing. [615:58] Instance A and instance B, we tried from [616:01] the outside and we saw the impact of a [616:03] network ACL rule. [616:04] What if I block ICMP [616:07] inbound and I block ICMP outbound [616:10] and I try to SSH into instance A and [616:12] ping instance B private IP. So they are [616:15] both in the same subnet. Is that going [616:18] to involve the network ACL or not? If [616:21] the two instances are within the same [616:23] subnet, will the traffic go up to the [616:25] implied router where the network ACL is [616:28] and then come back or would it flow [616:30] internally with complete ignorance of [616:33] what the network ACL does? [616:35] We need to block ICMP ping from any [616:38] source inbound and outbound and we are [616:41] going to use rule number 50. [616:43] And we are going to allow all other [616:45] traffic inbound and outbound with rule [616:48] 100. So I think for the inbound we [616:51] already have this done. So let's do it [616:53] on the outbound. [616:54] So for the inbound, I have rule number [616:56] 50 denying ICMP from anywhere [616:59] and I have rule 100 allowing traffic [617:01] from anywhere. On the outbound, I need [617:03] to do the same. So I'm going to edit [617:06] and I'm going to add rule number 50. [617:11] And this will be for ICMPV4 [617:15] from anywhere and that would be deny, [617:17] not allow. [617:18] ICMP version 4 from anywhere [617:21] uh deny. [617:23] So when we look at it, it will look like [617:25] this. [617:26] So ICMP in and out of the ACL is going [617:28] to be blocked. However, any other [617:31] traffic from any source will be allowed. [617:34] That's how it is now, inbound and [617:36] outbound. All right, what do we need to [617:38] do? [617:39] So this is done. SSH into instance A. [617:42] Sure. So I'm going to go into instance [617:45] A. [617:46] Get the SSH rule from connect SSH client [617:50] and I'm going to copy this. [617:52] So let me stop this failing ping. I'm [617:54] going to clear the screen and then SSH [617:58] into instance A. [618:03] Yes. [618:09] And here we go. I'm going to clear the [618:10] screen. [618:12] So now we are into instance A. I'm going [618:14] to [618:15] elevate the permissions to the root [618:18] level, super user. [618:20] Okay, what do I need to do now? [618:23] From instance A, use ICMP ping to the [618:25] private IP of instance B. [618:27] So I want the private IP of instance B. [618:33] Instance B [618:35] the private IP is this guy right here [618:38] and I'm going to ping it. [618:42] And it is working. [618:46] So the network ACL in the subnet where [618:49] both instances A and B exist is blocking [618:52] ICMP inbound and blocking ICMP outbound [618:56] from anywhere. However, [618:59] when I'm inside [619:01] instance A, I'm at the prompt of [619:03] instance A and I try to ping instance B [619:07] the traffic is successful, which implies [619:10] that the network ACL has not been [619:13] checked at all. It has not intervened in [619:16] this communication [619:18] and the reason is that you need to keep [619:20] in mind, when will the traffic from the [619:22] subnet go through the router? [619:25] It will only go through the router. Let [619:27] me draw it here. [619:29] It will only go through the router [619:31] when the traffic needs to leave the [619:33] subnet or if the traffic from outside is [619:35] coming into the subnet. [619:37] In our case [619:40] this is all local to the subnet. [619:43] So the traffic goes out and goes in [619:46] here. The response goes out and comes in [619:48] here. So the network ACL is not involved [619:51] at all. The implied router is not [619:52] involved at all. That's why it was [619:54] successful. So this is a very important [619:57] thing to keep in mind as well. [620:02] So we looked at the rule numbers, but we [620:04] find let's find out what is this about. [620:06] SSH from your laptop into instance A. [620:08] Can you? Why? Yes, I can and I know why. [620:11] SSH from your laptop into instance B. [620:13] Can you? Why? Because the network ACL is [620:15] allowing it. What else? [620:18] Now on the default network ACL in custom [620:20] VPC, add a rule to block SSH from [620:23] anywhere with rule number 50. All right. [620:27] I'm going to go into the network ACL [620:29] and I'm going to add a rule [620:34] that will Let me make sure that whether [620:37] we need this one or not, but let me add [620:38] that rule first. [620:40] Add a new rule, let's say it's going to [620:42] be 75 or 80, 70. [620:46] Should block SSH [620:50] from anywhere [620:51] and that should be a deny. [620:54] Save changes. [620:57] So now there is an allow all traffic, [620:59] which is number 100 deny SSH which is [621:02] number 70 [621:04] and deny ICMP which is number 50. All [621:07] right. [621:09] To block SSH from anywhere, we'll do it [621:10] number [621:11] uh 50. I cannot do it because 50 is [621:13] taken. Okay, so let's proceed and see. [621:16] Try to SSH again into instance A and [621:17] instance B. Can you and why? Let's find [621:20] out. So now I'm going to stop this. [621:23] See, I'm not connected at all and 143 [621:27] 142, this is not running anymore. I lost [621:29] the connection. The SSH connection is [621:31] lost. [621:32] So what do I need to do? I'm going to [621:33] open a new terminal. [621:39] So shell new window [621:41] and from here I want to try and SSH into [621:45] instance A again. So let me close this [621:46] one. [621:48] Terminate and I want to SSH into [621:50] instance A. [621:52] Go back, instance A, connect [621:55] copy [621:57] and control V. [622:00] I need to go into [622:02] the right folder first where the key is. [622:06] CD downloads. [622:08] That's where my key is. [622:10] And then I'm going to do control V and [622:13] SSH. [622:14] And do you think it would work? [622:16] I don't think so because rule number 70 [622:20] is where the SSH blocked and rule number [622:22] 50 is ICMP blocked. So it will hit [622:24] number 70 before it goes to 100 that [622:27] allows everything and that's why I won't [622:29] be able to. [622:31] Control C. [622:33] So I couldn't because the network ACL is [622:35] blocking it and that's why I couldn't. [622:38] From your laptop, use ICMP to ping the [622:40] public IP address of instance A. Can you [622:43] and why? [622:44] In my case, I'm not going to be able to [622:47] because I have rule number 50 and rule [622:49] number 50 is denying ICMP from anywhere. [622:51] That's why I will not be able to. [622:54] However, if we remove rule number 50, [622:57] then we will be able to ICMP [623:02] ping, but we are not going to be able to [623:04] SSH into the in [623:06] So that's the case here. All right. [623:08] Network ACLs are stateless. So this test [623:11] is going to show us that fact. In the [623:13] custom VPC network ACL [623:15] allow all inbound traffic from any [623:18] source. Okay. So let me go and clean up [623:20] that one. So we're back to the ACL. I'm [623:23] going and this is inbound. I'm going to [623:25] edit. [623:27] I'm going to allow all traffic from all [623:28] sources. So I'm going to remove the [623:30] deny, remove the other deny and this one [623:32] will take care of allowing all traffic [623:34] from any source. [623:37] What do I need to do? [623:41] Delete the rule in the outbound that [623:43] allows all outbound traffic. But before [623:45] I do this, let me check [623:48] if I will be able to SSH before we do [623:52] the the delete rule and then we will [623:54] find out after removing that if we can [623:57] or we cannot. So let me from here try [623:59] the SSH first to make sure that it works [624:02] and after I make sure that it works, [624:03] then I can try. Yes, it works. [624:07] So now I know that it works. I'm going [624:09] to exit. [624:10] So I'm back to my prompt. Clear. [624:14] Back on my laptop. [624:15] Now I will do what was requested, which [624:17] is remove the rule that allows all [624:20] outbound traffic. So I'm going to do [624:21] edit [624:23] and I'm going to remove this and this. [624:25] So the only rule that exists is the [624:27] explicit deny all. [624:31] As you can see now on the outbound, I [624:32] have only the deny rule and on the [624:34] inbound, I have allow all. [624:37] Why are we testing this? Because I will [624:39] show you that if the traffic is allowed [624:40] in one direction, but the other [624:42] direction is blocked, then the entire [624:45] result or the whole result, the end [624:46] result would be the traffic is blocked. [624:49] Let's verify this. Go back and I'm going [624:52] to try and SSH again. [624:55] And this will not work. Why? Because it [624:57] reaches the instance, but the instance's [624:59] response is blocked at the network ACL. [625:02] Why did it go through the network ACL? [625:04] Because my laptop is connected to the [625:05] internet. So, that is outside the subnet [625:08] where the instance is, so it has to go [625:10] through the ACL. [625:12] The general rule is if the traffic [625:13] leaving the instance is going outside [625:17] the subnet where the virtual machine or [625:19] the instance is, it has to pass through [625:21] the router. That means it has to pass [625:24] through the network ACL of that subnet. [625:29] Okay, so it will time out and it will [625:30] not work. [625:31] For obvious reasons, it is not allowed [625:34] because it was blocked. [625:36] All right. What I will do now is I'm [625:38] going to go and clean up the network [625:40] ACLs and make it again like the default. [625:43] Allow all traffic in, all traffic out. [625:46] All right, so inbound looks good. [625:47] Outbound, I'm going to bring back the [625:49] rule that we have removed because [625:51] otherwise, nothing will be flowing in or [625:54] out of this subnet. [625:55] So, I'm going to use rule number 100 for [625:58] all traffic. [626:03] All traffic, all sources allow. [626:07] And just to verify, can I SSH? I should [626:10] be able to. [626:13] Yes, I can and that is enough to make [626:15] sure that it went back to normal. Clear [626:18] and we are good to go with this hands-on [626:21] lab. [626:25] In module nine, we are going to learn [626:27] important [626:29] IT services [626:31] and observability as well. It's good to [626:33] have the infrastructure up and running [626:35] that you have built or the network and [626:36] so on, but it's more important [626:39] to know that it's functioning properly. [626:41] So, you need to have monitoring in place [626:44] to monitor the infrastructure or the [626:46] network or whatever you have built in [626:48] real time. [626:49] Make sure it is performing as expected [626:51] and if not, [626:53] then send you notification or alerts. [626:56] Also, for compliance reasons and for [627:00] troubleshooting purposes, you need to [627:02] have logs. You need to have the history [627:04] of events that happened in your [627:06] infrastructure or application or network [627:09] and these are called logs. [627:11] Also, we are going to introduce the [627:13] domain name system or the domain name [627:15] service, the DNS. [627:16] When you type www.cnn.com [627:19] or google.com in your browser, [627:22] that is not how the internet works, [627:24] right? This is a name. [627:26] All the internet only relies on IP [627:29] addresses. So, what would translate the [627:33] www.google.com [627:35] that you type, which is easier to [627:36] remember, [627:38] into an IP address? That is the DNS. So, [627:40] we're going to introduce that as well. [627:43] And we are going to have an introduction [627:45] to databases. So, we have mentioned data [627:48] in a database. Why do we need a [627:50] database? What are the types of [627:51] database? All of this we are going to [627:53] learn here and we are going to end up [627:55] with a very important training, [627:58] which is how to draw professional [628:01] architecture drawings. [628:03] So, all of this in this module, lots of [628:06] stuff to learn. So, let's start with [628:08] DNS, domain name system or domain name [628:11] service. [628:14] As we know, websites, all the internet [628:16] use IP addresses. However, it is much [628:19] easier [628:20] to remember names than remembering IP [628:23] addresses. Imagine if you had to [628:25] memorize the 15, 20, 30 common websites [628:28] that you go to all the time and you had [628:30] to maintain and memorize their IP [628:32] addresses, which would be a nightmare. [628:34] For example, here we have a web server, [628:36] www.dolphinedacademy.com [628:39] or dolphined.com and this is the [628:41] corresponding public IP address. [628:43] When you want to go to dolphinedacademy, [628:45] you're not going to type the IP address [628:46] because you don't know it and you're not [628:48] going to search for it, but you know [628:50] that it's called www.dolphined.com [628:53] or maybe you have it saved in your [628:55] preferred domains. [628:57] So, you click on that and then magic [628:59] happens in the background to find out [629:01] the IP address and then a packet will be [629:03] formed and that will be the destination [629:05] IP address in the packet. [629:09] And since it is easier to remember names [629:11] than IP addresses, the domain name [629:13] service are the translator, the [629:15] interpretation of domain names into IP [629:18] addresses. That is what DNS is all [629:21] about. [629:22] So, here's an example of a DNS server. [629:25] Let's say the server of the DNS, the IP [629:28] address is 1.1.1.1, just hypothetical [629:30] example. [629:32] And it will maintain a database and here [629:33] is a snippet of the database. [629:35] dolphined.com, this is the IP address. [629:38] example.com, this is the IP address. [629:40] marketing.abc.net, [629:42] this is the IP address. And of course, [629:43] it has a huge database that involves all [629:46] of the known domains and subdomains in [629:49] the internet. [629:52] So, if you want to visit dolphined.com, [629:56] what you need to do is [629:57] you are going to use the internet and [629:59] you are going to use DNS. But, how would [630:02] your laptop know which DNS IP address to [630:05] send the request to? It's called DNS [630:07] query. [630:09] Any client that will be configured, your [630:11] phone when it connects to Wi-Fi, your [630:14] laptop when it connects to Wi-Fi or any [630:16] other network, it will have a DNS server [630:19] configured and this is automatic from [630:22] the Wi-Fi device. [630:23] So, you will get an IP address and you [630:25] will get also the DNS configuration. Or [630:27] maybe it is static configuration on your [630:29] laptop or your device. [630:31] So now, when you want to go to [630:32] dolphined.com, you go in your browser [630:35] and type dolphined.com. Now, in the [630:37] background, the browser is going to [630:38] formulate a request, a DNS query, [630:42] and it will send it to the IP address of [630:44] the DNS server configured. [630:46] Can I please have the IP address of this [630:49] subdomain, www.dolphined.com? [630:52] Now, the DNS will check its database to [630:55] find out that it has it and here is the [630:57] IP address. So, it's going to respond [630:59] and say, here we go. The DNS response, [631:03] the IP address requested is such and [631:05] such. [631:06] Now, the browser and the IP stack on [631:09] your machine, they know the IP address, [631:11] the destination IP address, [631:14] and they will form the packet and send [631:16] it to dolphined.com. Of course, the [631:18] internet is going to forward that [631:20] because as we knew and as we learned [631:22] that the internet knows how to get to [631:24] any public IP address anywhere in the [631:27] globe. [631:30] Now, how can I find out on my laptop, [631:32] whether it is Windows or Linux or Mac [631:34] OS, how can I find out the DNS [631:37] configuration? What's the DNS server [631:38] that I'm using? [631:40] And also, how can I find out the IP [631:43] address of a specific DNS? Let's say [631:45] that I want to find out what is [631:47] www.dolphined.com. [631:49] What's the IP address corresponding to [631:50] it? Or cnn.com or google.com. [631:53] Then, you can use the command nslookup [631:57] and the name or the domain or subdomain [631:59] you would like to look up. [632:01] If you would like to find out about the [632:03] IP and the DNS information in your [632:05] machine, if it is Windows, you can use [632:07] ipconfig /all. [632:11] If you are on a Linux system, depending [632:13] on what type of Linux system, which [632:15] distro are using, then you can do cat [632:18] for the etc/resolv.conf [632:21] file. Cat means show me the content of [632:24] that file [632:26] without opening or editing the file. [632:28] Linux also, systemd-resolve [632:31] --status or --status. [632:34] This is for systemd-based systems. If it [632:37] is network manager, like Red Hat for [632:39] example, real, nmcli, [632:42] all of these are going to give you the [632:43] same thing. What is the DNS information [632:45] that you are using? What's the DNS [632:47] server that you are relying on? All [632:49] right. So, these are good stuff. DNS [632:52] server and here's the DNS server as well [632:54] for Linux and this one would show the [632:56] domain. Whether it is Windows or Linux, [632:58] the nslookup will show the IP address of [633:01] this domain or subdomain that you have [633:04] typed. [633:10] Let's go ahead and do um demo and show [633:13] you DNS in action on an AWS Linux EC2 [633:17] instance. [633:20] So, we need to have a Linux instance [633:22] in AWS. [633:24] It needs to be in a public subnet [633:27] and we need to ensure that it has a [633:28] public IP. [633:30] We are going to associate with that [633:31] instance while creating it a security [633:33] group that allows all traffic inbound [633:34] and outbound and we have one that does [633:37] that. We are going to SSH into the [633:39] instance from the console and then we [633:41] are going to start the testing. So, [633:43] let's go ahead and create the EC2 [633:45] instance with this specific criteria and [633:48] SSH into the instance. [633:50] So, we are going to go into instances [633:53] and then create instance or launch [633:56] instance. [633:58] I'm going to call it testing DNS. [634:05] I am going to choose AWS Linux. [634:08] T2 micro is fine. Key pair, I'm going to [634:11] choose one of the key pairs that I have. [634:14] In case if you don't have one, please [634:16] create one. You know how to deal with [634:17] them now. I'm going to choose this one, [634:19] which I've used before. [634:21] For the network, I want to make sure [634:23] that it is in the custom VPC, the VPC [634:26] that I have created and I know [634:27] everything about, [634:28] and in a public subnet as requested. [634:32] And I want to make sure that [634:34] the auto-assign public IP address is [634:36] enabled. [634:38] For the security group, I'm going to [634:39] select one that I have, which allows all [634:42] traffic in and out SGA. [634:48] And that's it. Let me just go back [634:51] quickly and confirm that I've done [634:53] everything right. It appears Linux [634:56] and T2 micro [634:59] key [635:00] custom VPC [635:02] public subnet and enable and I created [635:06] or selected existing [635:08] a security group. [635:10] So, I'm going to launch it. [635:13] And once I launch it, I'm requested to [635:16] connect to it [635:18] through SSH or using SSH. [635:21] So, what I'm going to do is I'm going to [635:25] So, once this is [635:31] highlighted in blue or colored in blue, [635:33] I can click on connect and I can use SSH [635:36] to connect. [635:38] So, let me try from the outside. [635:41] Uh, [635:42] here is the instance connect. [635:44] I'm going to use EC2 instance connect [635:46] instead of SSHing from my laptop. I'm [635:48] going to do it through the console. [635:52] Connect. And you will notice that it [635:54] will open a new tab [635:57] for the connection and it shows me here [635:59] what is the public IP and what is the [636:01] private IP. [636:03] And here you go. I'm connected. [636:06] Elevate the permissions to root. [636:09] So, as you can see here, it changed from [636:10] EC2 user, which is the user we used to [636:12] connect [636:15] using SSH and now I am root. So, I have [636:17] all the privileges that I have. Let's [636:19] find out what we need to do. [636:21] So, all of this is done. [636:24] Check the DNS server on the instance. [636:27] How? [636:28] We can use the cat ETC resolve.conf or [636:33] we can use the systemd-resolve [636:35] --status. So, let's find out. [636:41] So, cat ETC resolve [636:46] .conf. [636:49] And if you look here, this is the line [636:51] we're looking for. Name server is [636:53] 172.31.0.2. [636:55] So, this the DNS server is an IP [636:58] address, the second [636:59] usable IP address in the subnet [637:02] and this is [637:03] the name server. So, all the queries are [637:05] going to go into this IP address DNS [637:08] queries as the server. And that server [637:11] from AWS [637:13] or that DNS server from AWS, if it knows [637:15] the answer, it will respond. If not, it [637:17] will query the internet, find the answer [637:19] and send it to you. [637:22] Or we could have done also the [637:23] systemd-resolve [637:28] --status. [637:32] And it gives me the same information [637:34] that we have received here. So, if you [637:35] look at this [637:37] and you look at this, it's exactly the [637:38] same answer. [637:40] We are now sure that there is a DNS [637:43] configured on the machine and that's how [637:45] we can get to the different domains on [637:47] the internet. So, for example, if I do [637:49] dig www.google.com [637:56] in the answer section, you'll find that [637:59] this domain maps to [638:02] this IP address 17142.250.190.68. [638:09] And also I can do NS lookup [638:13] for the same domain. [638:16] And it should give me [638:18] a similar answer. Look at this IP [638:20] address and look at this IP address, but [638:22] the NS lookup will give you that in a [638:24] different format. So, here is the DNS [638:28] and here is the IP address of [638:30] google.com. [638:32] Also, it gave me the IPV6 address of [638:35] google.com. So, it resolved both IPV4 [638:37] and IPV6. [638:40] So, we did this step already, DNS [638:42] lookup. Oh, actually it's [638:44] NS lookup, not DNS. So, forget about [638:46] this D. NS lookup. So, now we need to [638:48] influence a change in how the local DNS [638:51] sees www.google.com. [638:55] The dig command, let me clear this. The [638:58] dig command [638:59] goes straight into the DNS and finds the [639:02] IP address and goes out. But if we use [639:04] ping, for example, www.google.com [639:10] it is working and it is responding, but [639:12] the ping, what it does is it checks [639:14] local files, local DNS files first and [639:18] if not [639:19] then it will query the DNS server. [639:23] Ping does that. [639:25] So, here when I ran ping it translated [639:28] www.google.com into this IP address. [639:32] Let's now do one thing. Let's do nano [639:35] and here is a file where I can define [639:37] hosts. [639:38] ETC hosts. [639:40] So, I'm going to go below and I'm going [639:42] to do 10 or [639:45] 172.31.0.55 [639:49] maps to www.google.com. [639:53] So, what I am doing now is in a local [639:56] DNS file and I'm going to define a local [639:59] IP address, a private IP address [640:01] 172.31.0.55. [640:07] Control X to save. [640:09] Yes to confirm that we need to save the [640:11] change and hit enter. [640:13] Now, if I do ping, what happens? Let's [640:15] find out. [640:17] You'll find that instead of going to [640:19] this IP address 142.250.190.36, [640:23] which was working [640:25] now it's going to a completely different [640:27] IP address. Let me stop this, control C. [640:30] It's going to the 172.31.0.55, [640:32] which is the one in the hosts file, in [640:35] the ETC/hosts file. [640:38] Whereas if I do dig [640:40] www.google.com, [640:42] it will not check any local files. It [640:44] will go straight into [640:46] the DNS and it gets me the correct IP [640:49] address. [640:51] There are ways that for some of the [640:53] tools like curl and ping that you can [640:56] influence locally what some domains [641:00] would look like. [641:02] Whereas dig will always go to the DNS [641:04] server and get the correct information. [641:06] So, we did the change and [641:10] that worked and we did ping [641:13] and it used the IP address in the ETC [641:15] hosts file. Whereas if you do dig, it is [641:17] going to use the one from the DNS, which [641:19] is the correct one and that is how dig [641:22] works. All right, hopefully that [641:24] clarifies at a basic level how the DNS [641:27] works. In AWS cloud, there is a service [641:30] called Route 53. Let me show it to you. [641:33] So, if I go here and I type Route 53 [641:38] if I right click on this this is a DNS [641:41] service that can be used even for big [641:44] corporates [641:45] if they would like to host their domains [641:48] and details in AWS. You can register [641:50] domains and you can create hosted zones, [641:53] basically records in these domains to [641:54] tell what www.dolphinet.com [641:57] means, what marketing.dolphinet.com [641:59] means, what example.com means and so on. [642:03] So, you can [642:05] rely on AWS completely [642:08] to [642:09] provide you the DNS server in the cloud. [642:12] But we are not going to dive deep into [642:13] this because this is beyond the [642:15] fundamentals. All right? Hopefully that [642:17] was clear and thank you for watching. [642:23] Let's now talk about monitoring, [642:25] alerting and logging and why these are [642:28] important and what can we use them for. [642:33] Monitoring is watching the system [642:35] metrics in real time for health, [642:38] performance and security. So, monitoring [642:40] in real time means as the events happen, [642:45] as the status changes, as the [642:47] performance degrades or enhances, that [642:50] means monitoring in real time. So, you [642:51] are recording in real time what's [642:54] happening in the system. And if you have [642:56] a monitoring tool that's like an eye on [642:59] the system, then that can tell you, for [643:01] example, if that was a virtual machine, [643:03] what's the CPU utilization, what's the [643:07] disk space taken, what's the network in [643:09] and out traffic and so on. So, it can [643:11] give you a lot of things and these can [643:13] help in the health, in the performance [643:16] and in the security of the systems. So, [643:18] monitoring can be monitoring security, [643:20] performance or health or all of that [643:22] together. [643:23] So, here's an example from my macOS. [643:26] There is a tool called Activity Monitor. [643:29] I'm going to show it to you right now. [643:31] So, as you can see here, we have the CPU [643:33] utilization, CPU time and we have also [643:35] memory information about the memory for [643:38] the different applications that I'm [643:39] running. [643:40] We have energy, we have disk, we have [643:42] network. So, we have a lot of things [643:44] that we can see about this macOS, this [643:47] laptop in real time and the applications [643:50] running and their statistics, what CPU [643:52] they are taking and all that stuff. [643:54] So, this is monitoring for my system, [643:57] for my laptop. That is what is being [643:58] monitored right now. [644:00] In Windows, you have something called [644:03] Task Manager, which I'm going to show [644:05] you in the demo as well. Something [644:06] similar to this that will be about your [644:09] laptop or your server. It will tell you [644:11] about the resources, the utilization of [644:13] the resources, the percentages. So, for [644:15] example, here on the left hand side, if [644:16] anything is close to 70, 80, 90%, that [644:19] means it's taking a lot of resources and [644:21] also I have it here and as a graph at [644:24] the bottom [644:25] that shows if it's working fine or if [644:28] any is taking more than it should. CPU [644:31] utilization, the percentage of the CPU [644:33] and how many threads and so on. These [644:35] are metrics for the monitoring. and [644:37] using these metrics like CPU [644:39] utilization, I can find out if [644:40] everything is okay or not. Memory [644:42] utilization, disk space, um network in, [644:46] network out. All of these are metrics [644:48] that will tell me, by looking at them, [644:51] how is the system doing from that [644:53] perspective. Then alerting, notification [644:56] basically. So, getting notified when [644:58] some pre-identified events happen or [645:01] thresholds are crossed is a good thing. [645:04] That's what alerting is. [645:06] So, it could be performance-related, [645:07] could be health-related, or [645:08] security-related. For example, if [645:10] someone is trying to SSH into an [645:13] instance and it doesn't pass, it doesn't [645:15] succeed, and it fails repeatedly, I need [645:19] to know someone is trying to hack my [645:20] systems, for example. [645:22] If the CPU utilization of one of the [645:24] critical server reaches 80% or 90%, I [645:28] need to be notified even if it is at [645:30] 3:00 in the morning because that is a [645:32] critical thing. That will affect the [645:35] response time, that will affect the [645:36] performance of the server and [645:38] application, and that will cause a lot [645:40] of issues when users will start to [645:42] complain. [645:44] One of the examples where you can be [645:46] notified in AWS is when you have a [645:48] budget alarm. [645:50] So, basically, you tell AWS, "You know [645:52] what? If I am getting the consumption is [645:55] expected to cross or be higher than [645:59] $3.60 [646:01] a month, [646:02] please send me an email or send me a [646:05] notification." And here is an example of [646:06] a notification that I have received when [646:09] the cost the budgeted amount for the [646:12] month, I don't want to spend more than [646:13] $6, but please let me know when I reach [646:15] 60% of that. So, I was told that it's [646:18] going to get to four uh $4.84 [646:22] if you keep the same utilization for the [646:25] month. [646:26] So, this is an example of notification [646:28] where I was informed based on a [646:30] configuration I have done about this [646:33] event. [646:34] If it didn't cross the threshold, I [646:36] wouldn't have any emails or anything. [646:38] Similarly for security, similarly for [646:40] performance. [646:42] Then we have logging. Logging is an [646:44] archive, uh storage of events or errors [646:48] related to a system. [646:50] So, if you are logging, for example, who [646:52] had accessed your account, who had [646:54] created EC2 instances in your account, [646:57] who had deleted EC2 instances in your [646:59] account, if you can find these logs, if [647:01] a problem happens, then we can go back [647:04] to the logs and find out who [647:06] did what and at what time, to what [647:08] service, and who deleted and or who [647:10] created and so on. So, this is good both [647:13] for auditing if you are in a business [647:15] that requires compliance [647:18] and also for troubleshooting if we need [647:21] to find out the reason for the problem [647:23] that happened or the outage that [647:24] happened. [647:26] And in AWS, we have a service called [647:28] CloudTrail. [647:30] Any logins, any sign-ins, any creation [647:33] of virtual machines, any deletion of [647:35] virtual machines, any creation of [647:37] subnets, VPC, route tables, security [647:40] groups, network ACLs, all are going to [647:42] be logged here. Any action on AWS [647:45] services in your account is going to be [647:47] logged here with the time it has [647:49] happened, who did it, which user, and [647:52] what was the event source, and so on. A [647:55] lot of details. And if you click one of [647:57] these links, you will find that out. [647:59] Let's look at this service. So, I'm [648:01] going to go here and type CloudTrail. [648:04] And I'm going to open a new tab. We have [648:06] so many tabs open now, but let's go into [648:09] this service. And this is enabled by [648:11] default in your account, in any AWS [648:14] account, and you don't pay for it. [648:16] So, if I look here, if I click here and [648:18] I look at the event history, and this is [648:21] of course about my account and this is [648:23] the account ID, you'll find here that [648:26] send SSH public key, and here it has the [648:29] date, who did it, [648:31] and EC2 instance and the ID of the [648:33] instance that was affected with that. [648:35] And if we click on that, you'll find [648:37] more details. So, you'll find the [648:39] timestamp, who did it, the user, what [648:41] was the event name, event source, event [648:44] ID. [648:46] You have here the instance ID and the [648:49] details of the event. I don't want to [648:51] drag you into what this means right now, [648:54] but this is a lot of information that is [648:56] very useful when we need to troubleshoot [648:59] or find out what has happened and who [649:02] did it and so on. And those events are [649:04] kept by default for 90 days free of [649:07] charge. After 90 days, they are purged. [649:10] And if you want to keep them, you can [649:12] export them and save them in a storage [649:15] that you will pay for. [649:16] Also, we have a service called [649:18] CloudWatch, and this is [649:21] for monitoring in your account and for [649:24] logging in your account and for alerting [649:26] as well. So, it has as you can see, it [649:28] has insights, metrics, alarms, [649:31] dashboards, and services. So, let's have [649:33] a look at this service, CloudWatch. [649:37] For example, if I go into metrics, all [649:39] metrics, scroll down a little bit, [649:41] you'll find here [649:42] EC2, for example, virtual machines. And [649:45] if I click on that, [649:47] I have [649:49] metric data available. If I start [649:52] scrolling, as you can see here, for [649:54] example, this is the CPU utilization [649:56] average [649:57] on EC2. So, you can see that the CPU [650:00] utilization is low right now, but it has [650:03] gone up to 6 uh percent. [650:07] If we keep going, network average, [650:10] network in average, the traffic going [650:12] into the instance, the average. [650:15] And we have also the network packet out [650:18] average, network packet in average, [650:22] network out average. So, you have lots [650:24] of details about what's happening for [650:26] this instance. [650:28] So, that is for the metrics. What else [650:30] can I see from CloudWatch? If I go back [650:32] to the dashboard, you can create alarms. [650:38] So, I can create alarms. The alarms and [650:40] the alarm will watch for a single [650:42] metric, for example, the CPU of the [650:44] virtual machine. So, I can monitor the [650:45] CPU, the average CPU of the virtual [650:47] machine, and I can instruct it if it [650:49] goes above 75% send me a notification, [650:52] for example. That is possible also to do [650:54] in CloudWatch. [650:56] Then we have CloudWatch logs. So, I can [650:59] send the logs from all my applications [651:01] and the errors from all the applications [651:03] and the events that happen, and I can [651:05] save it in a log group into CloudWatch. [651:09] So, CloudWatch is the core or the heart [651:12] of the monitoring as far as AWS is [651:14] concerned. So, why is it important? [651:16] Let's go back and find out. The [651:18] importance of monitoring, alerting, and [651:20] logging [651:21] for security perspective, you need to [651:23] know if someone is attacking or probing [651:25] your system. If someone is trying to [651:27] break into your system or scanning your [651:29] system for attacks. [651:30] You need this monitoring, alerting, and [651:33] logging for troubleshooting if you want [651:35] to fix things faster in a proactive [651:37] manner when something goes wrong before [651:40] the users start to complain. [651:44] For performance, you need to monitor [651:46] your performance and spot slowness [651:48] before the users do [651:50] because you want to make sure that they [651:52] are going to have the right response and [651:54] the right performance. For compliance, [651:56] the logs are very important because we [651:58] need to keep records of what's happening [652:00] in the infrastructure for audits and [652:02] policies. So, these are many, many [652:04] reasons why we need to make sure that [652:07] monitoring is in place, alerting is in [652:09] place, and logging is also in place. [652:12] Example use cases, CPU usage goes over [652:16] 80%, I need to be notified. Someone [652:18] tries to SSH into a virtual machine [652:21] repeatedly and it they don't succeed. A [652:24] part of the code or the application code [652:26] fails to run. I need to have that error [652:28] sent into logging or maybe a [652:30] notification based on that. [652:32] Website response time is going down, I [652:35] need to know about that as well as it [652:37] happens. [652:38] A web server runs out of disk space. I [652:41] need to find out before that starts to [652:43] impact the performance or the user [652:45] experience. [652:49] Example tools, Windows Task Manager, [652:51] macOS Activity Monitor, AWS CloudWatch [652:54] for monitoring, alerting, and logging, [652:56] and AWS CloudTrail for logging. [653:00] We talked a lot about databases, but we [653:03] didn't dig deeper into what a database [653:05] is and why do we need it. [653:07] To understand the importance of [653:09] databases in applications or in IT, [653:12] think about a pizza shop. So, imagine [653:16] you are running that shop and you need [653:17] to keep track of the customer orders, [653:21] who ordered what, and maybe the customer [653:22] phone number or name. [653:25] Ingredients used, deliveries, and [653:28] payments. [653:30] And if you want all of that written down [653:33] in a logbook, that is going to be your [653:35] database. [653:36] And that may run for a small pizza shop, [653:40] but for a popular pizza shop that has so [653:43] many branches, a franchise, people can [653:45] order online and deliveries and all [653:47] that, there is no way one person or even [653:51] a couple of persons or three people will [653:53] be writing down all of that manually. It [653:55] has to be in the application. It has to [653:58] be in a persistent storage that will [654:00] keep this data. [654:02] So, if we shift now into IT, the [654:04] database is an organized collection of [654:06] data that can be easily stored, [654:10] searched, updated, and retrieved by [654:13] software. So, the application can write [654:15] in the database, can search the data in [654:18] the database, can update the data in the [654:20] database, and can retrieve data from the [654:22] database. And even if the application [654:25] fails or whatever, the data in the [654:27] database is going to persist, and we [654:29] usually take copies, we call it backups. [654:31] So, in case if the database fails, we [654:33] can retrieve or restore from the backup [654:36] into a new database. [654:40] One might ask, "Okay, but I can do this [654:42] in Microsoft Excel. I can have all the [654:45] data about the customers and the orders [654:47] and what pizza they ordered and how many [654:49] and how much they paid and all that [654:51] stuff in an Excel sheet." And the answer [654:54] is it's okay, fine. You can do it in an [654:55] Excel sheet or in a Word file, but [654:57] again, scaling [655:00] how easy it is to search? Wouldn't [655:02] application be able to read the Excel [655:05] file [655:06] or ask the Excel file for a specific [655:08] information and get the proper response [655:10] or does it have to search the Excel file [655:13] every time it needs to get a part of the [655:15] information? So, we need a system that [655:18] can receive a short question, look [655:22] through a database engine into the data [655:25] and then respond with the answer. So, [655:27] the system itself, the database itself [655:29] is going to take care of that. [655:31] We may think of database are like super [655:33] powered spreadsheets and they have the [655:36] search capability within. So, no need [655:39] for us or for the application to search [655:41] by itself. [655:43] Why do applications need databases? [655:46] I think we have mentioned that already, [655:48] but let's summarize it. [655:50] So, applications, they need to store the [655:52] user data like usernames, messages, [655:55] customer orders and so on. So, the user [655:58] interfaces with the application and the [656:00] application writes into the database and [656:02] gets a confirmation to that. [656:04] E-commerce sites storing customer [656:06] orders, customer preferences, customer [656:09] refunds and so on. [656:11] Hospitals will need to store the patient [656:13] records. [656:14] Banks will store banking transaction or [656:17] financial transactions. [656:20] With databases, it's always called an [656:22] input and output or write and read [656:24] operations. When you write to the [656:25] database, the application will write to [656:28] store data. So, the user for example [656:31] goes on dolphinet.com, buys one of the [656:34] bundles and now this is going to store [656:37] the order information in the database. [656:40] Receive a confirmation and then confirm [656:43] to the client that everything is okay. [656:44] So, your order is processed and here is [656:47] your access or this is what you will [656:49] get. [656:50] So, this is for the right operations. [656:52] But also we can do query operations or [656:55] read operations. For example, I go on [656:57] amazon.com and I need to find out my [657:00] orders for the past 3 months because [657:02] there is one item I need to reorder it [657:04] again. [657:06] So, now the application logic will [657:07] understand what you want as you click on [657:10] orders, 3 months, show me the history. [657:13] It will query the database and ask for [657:15] the history of your orders in the last 3 [657:18] months. [657:20] Gets the answer, prepares how the answer [657:22] would look like in a nice way on the [657:24] page and then you will get that in your [657:26] browser. [657:28] There are types of database. They're not [657:30] all one type. [657:32] So, there are relational databases where [657:34] the data is sorted out in tables. An [657:37] example database that are relational, [657:39] PostgreSQL, MySQL and SQL Server. [657:43] NoSQL database examples, MongoDB and AWS [657:46] DynamoDB. [657:48] In-memory database, very fast. Redis is [657:51] the best example. [657:52] And time series, we have Influx, Amazon [657:55] Timestream. So, we have many types of [657:57] database. The most common one is the [658:00] relational one, but also the NoSQL is [658:04] gaining popularity. An example of a [658:06] relational database, it's exactly a neat [658:08] table. So, for example here we have the [658:10] order ID, [658:12] customer name, [658:13] the pizza, which type, the quantity and [658:16] the price paid. So, this is an example [658:19] that would be stored in a database and I [658:21] can search it and I can find it at the [658:23] end of the day. [658:25] How can we read and write from a [658:27] database? [658:29] This is following something called SQL, [658:31] structured query language. So, using [658:34] SQL, you can write and read from [658:37] database, especially the relational [658:38] database. So, it allows applications to [658:40] talk to the database, read or write [658:42] using simple queries. And here are [658:44] examples. [658:45] So, if I have a table with the name [658:47] order. So, a database with the name [658:49] orders [658:50] and this is the information in the [658:52] table, [658:53] then I can do a query to find [658:56] information from the database. [658:58] Select and this is SQL command. [659:01] Select [659:02] asterisk from the table orders where [659:06] customer equals Bob. [659:09] So, what is it that I'm finding here? [659:10] Can you find me in the table with the [659:13] name orders, [659:15] search all the items and find me the [659:18] entries or the record where the customer [659:21] equals the name is Bob. [659:24] So, this is the customer field and this [659:27] is Bob. So, basically the output for [659:29] this one is going to be this row. [659:32] So, this query will request the database [659:33] show all orders in the table named [659:35] orders where the customer is Bob. [659:40] Again, for the same table, I can [659:43] do other queries will be around how many [659:46] pizzas has Bob ordered. So, if I'm [659:49] looking for this [659:51] from Bob. [659:52] Or what's the total revenue today? So, I [659:55] want the collection of the prices paid. [659:58] Or show all orders with pepperoni pizza. [660:01] So, these are examples of if you build [660:04] the code to do these functions, then you [660:06] can easily go open the application, [660:08] click show me all the revenue for today. [660:11] Or show me how many pepperoni pizza were [660:14] ordered or how many packs of mushroom [660:18] were used today in the ingredients or uh [660:20] cheese or whatever. So, databases, the [660:23] good thing about them is they can be [660:25] integrated with applications and they [660:27] are persistent. Persistent means they [660:29] are going to maintain the data even if [660:32] issues happen in the infrastructure, the [660:34] data will still be there. Even if the [660:36] application fails, the data will still [660:38] be there. As long as I have the right [660:41] way or the right process of backing up, [660:44] of taking copies or snapshots from the [660:46] database on a regular base, so such that [660:49] even if the database fails, the [660:50] infrastructure fails, I can take that [660:53] data, populate it in a new database and [660:56] restore the functionality of the [660:57] applications. [660:59] So, databases are extremely important [661:01] and this is an integral part of any [661:04] infrastructure that you are going to [661:05] work on. Be it for AI, be it for machine [661:09] learning, be it for cybersecurity or [661:11] anything. Always, always, always you [661:13] will need a database. [661:18] Let's do a hands-on demo [661:21] on a database called SQLite and this is [661:24] available online for free and that is [661:27] why we're going to do it. Of course, as [661:29] you learn uh through the cloud, there [661:31] will be a lot of AWS services or Azure [661:33] services or Google services that are [661:35] databases and you will get the chance to [661:38] work with them in applications and in [661:40] projects. Now, we're going to only show [661:43] you the database part, but there's no [661:45] application to communicate with the [661:46] database. We're going to do the [661:47] application role manually basically in [661:50] this case. [661:52] So, here is the page for the [661:54] SQLiteonline.com [661:57] and this is free. You can go ahead and [661:59] use it. [662:00] So, what we need to do is we need to [662:02] build a table like this one, a table [662:04] that has ID, name and city as the [662:07] columns or the parameters. [662:10] IDs are going to be 1 2 3. For ID 1, the [662:13] name will be Alice and the city is New [662:15] York. [662:17] For ID 2, the name is Muhammad and the [662:19] city is Cairo. For number 3, the name is [662:22] George and the city is London. So, how [662:25] can we do this using SQL? So, what we'll [662:28] do is we're going to have this SQL [662:32] statements or script and let me tell you [662:34] what that is all about. [662:37] So, delete the table if it exists and [662:39] the table name is customers. And then [662:41] create table customers. This is because [662:43] we are testing. [662:44] And there will be three parameters. ID [662:48] is integer, so it will be a number. Name [662:51] is text and city is text. So, this is [662:54] only identifying what information to [662:55] expect in each one of these column or [662:59] data uh for the columns. [663:01] So, until now all we did is we just [663:03] created an empty table. Now, we need to [663:05] populate it. [663:07] Insert into customers. So, after [663:10] creating the table, I want to insert [663:12] into it [663:14] the values 1 Alice, New York. So, [663:18] basically I'm entering a row into this. [663:22] I'm going to repeat it to enter 2 [663:24] Muhammad and Cairo and then I'm going to [663:27] do 3 George and London. So, we are [663:30] entering rows or records in the [663:32] database. [663:33] Once I have entered that and we confirm, [663:35] let's query it. Let's [663:37] send a query, ask the database to find [663:39] me a specific piece of information using [663:42] SQL and find out if it understands it [663:44] and if it gets me the right information. [663:46] So, what we'll do is select from [663:47] customers. Show me the full table [663:49] because we are not specific on what [663:51] exactly. [663:53] I'll also do select from customers where [663:55] ID equals 1. So, I expect to see this [663:58] row. [664:01] I can also do select from customers [664:03] where name equals George. [664:05] So, I expect to see this row. So, let's [664:08] go ahead to SQLite and play with this [664:11] information. [664:13] All right. So, here is the SQLite [664:16] website. Let me just make this a little [664:18] bit bigger. [664:21] And [664:23] let's remove this completely. [664:25] Here it shows you if you had any tables, [664:28] and here I have only a demo table, as [664:30] you can see. [664:33] And we are going now to start creating [664:36] our table. [664:37] So, let's go ahead, and I'm going to [664:39] copy [664:40] from the text that we have gone through. [664:43] And I think it doesn't like this one, so [664:45] let's do a normal [664:47] code. [664:48] This is the table [664:50] that it's going to create, and as you [664:52] can see here, it doesn't exist. If I [664:54] click run, [664:55] we'll have a customers table here, as [664:57] you can see. [664:58] And then the columns are ID integer, [665:00] name text, and city is text. [665:04] This is what we have right now. Okay. [665:06] So, now if I want to view items from the [665:09] table, what do I do? [665:11] So, I can do the first query that we [665:13] have looked, which will show me the [665:15] entire table. [665:17] And if I click run, [665:19] it will show me here, as you can see. [665:21] Hopefully, it is [665:23] a bit visible. Let's do if I can do [665:26] white background. [665:28] Yeah, I think this one is clearer than [665:30] the previous one. So, this is going to [665:32] be select from customers, and here is [665:34] the table fully, because I didn't [665:36] specify what exactly I'm looking for. [665:38] Whereas, if we do this query, so select [665:41] from customers where and we put the [665:43] information here, and I run it, [665:46] then as you can see, I want where the ID [665:49] equals one, and the ID equals one is in [665:51] the first row, which is Alice and New [665:54] York City. [665:56] If I do where name equals George, [666:00] equals [666:01] George, [666:03] and we hit run, [666:05] oh, I put this wrong. [666:07] George, [666:09] and I hit run, you'll find that the [666:12] third row for George and London is the [666:15] one that appears. [666:16] So, this command that we are typing [666:18] here, usually it's going to be encoded [666:21] or programmed into your application [666:23] code. Let's say if this was for a [666:26] school, and the user would like to know [666:28] the grades or the GPA. [666:30] So, in the user interface, it will be [666:32] like check your GPA or check your grade. [666:37] Whereas, when that is clicked, in the [666:39] code itself, there will be a select from [666:42] the table for that subject. So, select [666:45] from the grades table where the subject [666:47] is chemistry, and the user is [666:51] let's say George, or maybe Sarah. [666:54] So, it will find that out, and you will [666:56] see it. So, the UI or how you see it is [666:59] completely different than what happens [667:01] between the application and database. [667:02] So, hopefully, this was a simple [667:04] example. [667:06] And if you want to delete this table [667:08] right now, all I need to do is the drop [667:11] table if it exists. And if I click here, [667:15] and if I run it right now, look at this [667:16] side. Run, and the table is gone. So, [667:19] there is no table anymore, and this is [667:22] an actual database engine available [667:24] online, and we can play with it. What [667:27] happens in real in reality is there will [667:29] be application code interfacing with the [667:31] database. Hopefully, this clarifies how [667:34] the databases work. [667:38] Let's now train on how to draw [667:41] architecture drawings or diagrams in a [667:43] professional way. In order to do that, [667:45] we are going to practice on how we can [667:47] draw such um [667:50] good-looking architectural drawing that [667:53] represents a VPC in AWS with some [667:56] requirements. [667:58] So, what do we have here? We have AWS [668:00] region US East 1, North Virginia. [668:03] A VPC with cider block 10.0.0/16. [668:08] And then in availability zone 1A, we [668:11] have a public subnet and a private [668:13] subnet. [668:15] And these are the IP address ranges for [668:16] the subnets. [668:18] Security groups, web server one, and a [668:20] database. [668:22] And then we have [668:25] public subnet two and private subnet two [668:27] in availability zone two, which is 1B. [668:30] And here are the ranges for them. And we [668:33] are giving also the root table [668:36] information for both of them, [668:38] or for all of them, with the IGW, [668:40] implied router, internet, and users. And [668:44] of course, the VPC [668:46] stretches across the different [668:48] availability zones available. So, how [668:50] can we draw this, and where do we get [668:52] the icons from, and how does it end up [668:55] being good-looking or representative of [668:57] your skills and understanding? This is [669:00] what we're going to learn now. [669:02] All right, so let's open this website. [669:05] app.diagrams.net, [669:07] or you can do draw.io. [669:10] Both of them are going to take you to [669:12] the same website. [669:15] This is an online drawing tool, used to [669:17] be called draw.io, d r a w.io, [669:21] and now it is app.diagrams.net. [669:24] Once you get to this website, it will [669:26] ask you, "Where do you want to save your [669:28] diagrams to? Do you want to save it to [669:30] your device, to OneDrive, to Google [669:32] Drive, and so on?" I'm going to save it [669:34] to my device, and it will ask you which [669:36] folder, where exactly do you want to [669:38] save it. [669:40] And I'm going to create a new diagram. [669:43] And you can change the storage if you [669:45] wanted later on. [669:46] Because I have already decided where it [669:48] will be saved, it did not ask me for the [669:50] folder or the directory, but in your [669:52] case, it will ask you where on your [669:54] laptop do you want to save it. So, in [669:55] that case, you save it to downloads, you [669:57] create a new folder and call it [669:59] drawings, architectures, solutions, use [670:03] cases, whatever. So, now I'm going to [670:05] create a new diagram. [670:08] And I will start with a blank diagram. [670:10] Of course, here you can do a flow chart, [670:12] you can do organizational chart, you can [670:14] do a lot of types of diagrams, but in [670:16] our case, I think blank would make more [670:18] sense. And click on create. [670:21] Now it's asking me where exactly it will [670:22] be saved. I'm going to save it under [670:25] downloads, and I will call it testing, [670:27] for example. [670:29] All right, so this is basically where we [670:32] can draw. And as I mentioned, [670:35] what we need to draw is this. So, let's [670:37] start with the AWS region, US East 1, [670:40] and then we are going to create the VPC, [670:42] the availability zones, and then we can [670:44] come and look again for the details. So, [670:47] on the left pane, on this side, let me [670:49] make this a little bigger so you can see [670:50] it. [670:51] I can type what I want. So, for example, [670:53] I want AWS icons. [670:56] So, here you have the 2025 open library, [670:59] and you have a 3D one. So, I'm going to [671:01] go with this one. And as you can see [671:03] here, we have groups, we have analytics, [671:06] depending on which services you want. [671:08] So, you can have all of that. If you are [671:10] not sure where the icon you want [671:12] exactly, so I'm going to mention or type [671:15] region. [671:18] And here you can see that there is an [671:19] AWS region. Here is another one. So, I'm [671:22] going to select this one. When you see [671:24] this cross, that means you can drag it [671:26] around as you wish. [671:28] So, you can drag it around your canvas, [671:30] and if you expand, the uh canvas is [671:32] going to get bigger. So, is it one page [671:34] or more pages? Usually, try to confine [671:36] it to one page. Don't try to make it [671:38] multiple pages. It will be easier for [671:41] you to save it, to print it, and so on. [671:44] And I'm going to, as you can see, when [671:46] at the corner, when this shifts into an [671:49] arrow, then you can shift it this way, [671:51] you can shift it that way if you want, [671:53] as you wish as well. [671:56] So, this is the region, and it was US [671:59] East 1. Double-click on the text, and [672:01] now I can write US East [672:04] 1. [672:05] All right, so this is the region. What [672:08] do I need now? I need the two [672:09] availability zones. So, I can write [672:12] availability zone. [672:15] And you have here availability zone, and [672:18] this one is also availability zone. So, [672:19] what I will do is I'm going to grab this [672:21] one, [672:22] and I am going to put it here. [672:28] And I'm going to drag it [672:30] to the end. [672:33] And for the availability zone, click or [672:36] double-click [clears throat] on the [672:36] text, and I can write [672:39] US East 1A. [672:44] And the second one, I'm going to click [672:45] on this, [672:47] and [672:48] command D to duplicate it, [672:50] and I'm going to drag the other one [672:52] below, and this will be by [672:54] double-clicking on the text, 1B. [672:56] So, this is the availability zones, 1A [672:58] and 1B. [673:00] Now, what do I need? I need the VPC. [673:03] VPC, [673:04] and here is the drawing for the VPC, and [673:07] you have the purple one, and you have [673:09] this one as well. I'm going to drag this [673:11] one, [673:12] and I can change the color. Let me leave [673:14] this one. I dragged the wrong one. [673:18] So, the VPC [673:20] stretches [673:22] across the availability zones, as you [673:25] know. [673:27] And I'm going to [snorts] make it [673:29] bigger, so we can accommodate the [673:31] different Okay, so I'll make it this [673:34] way. Drag this one [673:37] this side. [673:38] And this is availability zone one and [673:41] availability zone two. You know what? I [673:43] think it's better to do the availability [673:45] zones in a different way. [673:47] The reason why, I'll tell you, [673:50] because I don't want the writing for the [673:53] availability zone to get in the way of [673:57] stretching [673:59] the VPC. [674:01] So, what I will do is for this one, [674:04] see what happened? I cannot click the [674:06] other availability zone. Why? Because a [674:08] layer is in front of it. The VPC is in [674:10] front of it. So, what I will do is I [674:12] will click on the VPC, [674:14] I will click on the VPC, and then send [674:17] it to back. [674:18] That will allow me to get So, these are [674:21] like layers. When you are unable to [674:23] click one of them, that means the other [674:25] one is in front of it in terms of [674:27] layers. So, what you need to do is click [674:29] on the one that is holding it [674:32] or not allowing you to get to it. [674:34] And [674:35] right click and then to back, that means [674:37] send it or make it a backward layer, [674:40] send it backwards. So, that will allow [674:42] you to view or to touch or to move the [674:45] other one. [674:46] So, what I will do here is I'm going to [674:47] move this [674:49] this way like the other one. [674:52] And this is going to be availability [674:54] zone 1B and I can [674:57] make the region a little bit bigger. [675:00] No, only the region, not everything [675:01] else. [675:03] So, I'm going to move all of this down [675:05] now. [675:07] And [675:09] that makes the availability zones [675:13] I can see them. [675:16] And I can see the VPC as well and it [675:18] also signifies that the VPC can extend [675:22] across availability zones. So, this is [675:24] what we see right now and it is what I [675:27] wanted to see here. [675:29] What we can do is I can now click on the [675:31] mouse, hold hold the mouse the mouse [675:33] button down [675:35] and I'm going to move [675:37] these inside to the back a little bit. [675:41] And to the bottom a little bit so it [675:43] doesn't [675:44] conflict with this text. What you can do [675:47] also is if you do control B, this is [675:49] going to be [675:51] uh dark or uh bold also here. I want it [675:54] to be bold. And here, I want this to be [675:56] bold. Oh. [676:00] Okay, so we have all of them. Of course, [676:01] you can change the colors if you want. [676:03] So, this one for example, I can make it [676:05] green if I want it. I can fill it. This [676:07] is the fill and this is the line. If you [676:10] don't want to fill it, then I can [676:12] reverse what I did and I can put a color [676:15] for the line a different color if you [676:17] want. So, I can make it green. Apply. [676:20] And I can also make this [676:23] the line a bigger size. So, see the line [676:26] size is getting bigger now. [676:29] For this one, I'm going to do the same [676:30] thing. [676:33] And I'm going to make it bigger as well. [676:37] And drag this a little bit up. [676:40] Of course, the color and your taste [676:43] might not be like mine. I mean, I'm not [676:45] thinking actually about what will look [676:47] good and what will not look good in [676:48] terms of colors now. But, I'm thinking [676:51] that you can distinguish it by looking [676:54] that they have different colors, which [676:56] means they are not the same and they [676:58] have they represent different things. [677:01] So, for this one, also make it a little [677:03] bigger and now it's a different color [677:05] and also for the region, I can make it [677:09] anything, red for example. [677:12] And it's up to you. You can also change [677:14] the text color to be different. So, now [677:15] we have the VPC [677:18] and we have the availability zones. Let [677:19] me shrink this one a little bit to this [677:22] side and expand this a little bit to [677:24] this side. So, what do we need now? We [677:26] have the VPC, the region. I need the [677:28] internet, right? So, let me just type [677:30] the internet. [677:32] And here you have multiple selections of [677:34] the internet. Select the one that you [677:36] like. [677:37] So, this becomes the internet and of [677:39] course, I can move all of this. I can [677:42] highlight all of it. [677:44] Move it [677:46] to the right. [677:50] To the borders. [677:52] And [677:53] then I can write users. So, whatever you [677:57] want [677:58] to draw, you can [678:01] type it in the search and it will give [678:03] you the different icons or shapes that [678:05] can represent that. So, these could be [678:07] the users that are going to be using the [678:09] infrastructure from the internet. [678:12] All right, so what do we need now? I [678:14] need to have public subnets in [678:16] availability zone 1A and private subnets [678:19] in availability zone B. [678:22] So, let's go back and check. Two public [678:24] subnets and two private subnets. [678:26] One public, one private in each [678:28] availability zone. [678:31] So, let me do public [678:34] subnet. [678:36] And here it is. [678:41] So, again, this is blocking. So, I'm [678:43] going to push it back the VPC [678:47] to be able to get [678:49] the subnet. [678:51] So, push this one to back. [678:54] Push the region to back so I can get to [678:57] back. So, now [678:59] the VPC also. [679:02] All right, so here's what I'll do. [679:08] Okay, I'll move this one out. [679:11] Move this one out. [679:13] Now, [679:14] take the region, [679:17] put it back. [679:20] And take the VPC [679:22] and put it back as well. [679:26] So, this one I'm going to bring it in. [679:32] This is the public subnet [679:34] one. [679:36] And then I need a copy of this. [679:40] Control D. So, this is going to be [679:43] public subnet [679:46] two. [679:47] Then we need private subnet. [679:54] And here is the color. [680:03] So, we need private subnets [680:06] one [680:08] and [680:11] I'm going to copy it. Control D. [680:15] Into [680:16] public subnet two. [680:22] Private subnet two, I'm sorry. [680:24] Okay? And then we drag this one down. [680:29] And we drag this one down as well. [680:33] All right. What else do we need? [680:35] I think it would make more sense maybe [680:37] to put the internet and the user on this [680:39] side. [680:41] The reason being that we are going to [680:43] put the internet gateway here towards [680:45] the internet [680:46] and I want the two public subnets to [680:48] show as if they are closer and directly [680:51] connected to the internet. Whereas the [680:53] private are behind and they are hidden [680:55] from the internet. We need now to put [680:58] the VPC cider as 10.0.0/16, [681:01] which is fine. [681:03] And then we start putting the ciders for [681:07] the [681:08] subnets as well. [681:10] So, I'm going to place 10.0.10.0/24, [681:13] 10.0.20.0/24 [681:16] and the cider block here. So, let's do [681:18] that. [681:19] When you click anywhere, you can open a [681:21] text and then you can write what you [681:23] want. So, this is 10.0.0.0/16 [681:28] and this is the VPC cider. [681:31] So, let's add the word [681:33] cider. [clears throat] [681:36] Okay, and 10. [681:40] 10. [681:42] And this one, remove it. [681:46] And put a bold and I can place it in [681:50] here. [681:52] Then I need a copy of this, which would [681:55] be the subnets. So, 10.0 [681:59] .10.0/24 [682:01] for public subnet number one. [682:07] And I'm going to move it a little bit [682:09] behind the name of the subnet. [682:11] And then another one that will be dot [682:16] 20.0. [682:17] So, this is going to be dot 20 [682:20] .0/24. [682:22] So, I'm going to place this one here. [682:25] And a little bit up. [682:29] Okay, now let's see what the private [682:33] ones are going to be. [682:35] So, the private is 100 and 200. [682:39] I'm going to do [682:41] 200 [682:44] and I'm going to do [682:47] 100. [682:51] Okay, so 100 is private subnet one. [682:54] 200 is private subnet two. [682:59] Okay, what else do we need? [683:03] I need to put an instance in the public [683:05] subnet with a security group around it. [683:07] This is called web server one. This is [683:09] called web server two. That's easy. [683:12] So, here I'm going to go and click on [683:15] instance or write instance. [683:18] Uh [683:19] let me write EC2. [683:21] So, EC2 instance. [683:27] Okay, this is [683:29] uh I wanted the instance only without [683:34] instance. [683:38] All right, I'm going to scroll down and [683:40] look for it. It's under compute. [683:45] And I want the empty one, the one that [683:47] doesn't have any text inside. This one. [683:50] Okay. [683:51] So, this is an instance. [683:55] And a similar one on the other side. So, [683:57] control D or command D copies or make a [684:02] makes a copy of what you are working on. [684:05] Or what you are highlighting basically. [684:06] And a security group. [684:10] Group. [684:12] So, you have multiple ones. I can [684:16] probably take this one, let's say. [684:20] I'm going to take it out. I'm going to [684:22] resize it so it fits within the subnet [684:25] and around the the instance. [684:28] I need to make it a little bigger, so [684:30] I'm going to drag this a little bit [684:32] down. [684:34] And let's see. [684:38] Probably we need to move the instance a [684:39] little bit down as well. [684:42] Uh, [684:43] drag this a little bit down a little bit [684:46] more. [684:47] Yeah, and then I need to write that this [684:50] is web [684:51] server one. [684:57] And then using the arrows, I can adjust [684:59] it and I can do control B to make it [685:01] bold. [685:02] And control D [685:04] I need the same thing on the other side [685:06] and I need the security group on the [685:08] other side as well. Of course, you can [685:10] change the colors to your liking and to [685:13] your taste. [685:16] And this shouldn't be a problem. [685:19] And I can move the instance a little bit [685:21] down. Of course, the security group is [685:22] coming on the way. So, I'm going to [685:24] bring this a little bit down and then [685:25] bring this back. [685:27] Use the arrows to adjust it. [685:31] So, now I have a security group and the [685:34] web server one and this is web server [685:36] two. Okay, so the text is going also [685:39] to be over it. So, I'm going to to drag [685:42] this one out [685:44] and make it two. [685:47] And then take this one back. [685:49] Use the arrows to adjust it. [685:52] And we are good to go so far. Okay. What [685:55] do you need now? I need to have the [685:57] implied router and the internet gateway. [685:58] So, internet gateway. [686:02] And here we go. [686:04] This is will be at the border of the [686:06] VPC. Resize it [686:08] to look good. And this will be at the [686:10] border of the VPC and that is how it [686:12] connects to the internet. [686:14] And then I need implied router or I will [686:17] just say router. And this is the icon of [686:19] the router. [686:21] Again, I'll take it out. Resize it so it [686:24] fits in between. [686:26] I need to connect the router to the [686:29] internet gateway. So, when you hover [686:30] over the icon, you will see that there [686:32] is an arrow and if you click on the [686:34] arrow [686:36] then see it connected it to the router. [686:39] Same thing, if I need to connect the [686:40] subnets [686:44] the subnet [686:46] into the router, then I can click on the [686:49] arrow. [686:50] No, not this one. Don't drag it. [686:53] I need the subnet only. [686:55] And I'm going to click on the arrow and [686:57] then adjust it. [687:01] Okay, so now this subnet is connected to [687:03] the router. [687:04] And if I click on this subnet as well, [687:08] I'm going to connect it to the router. [687:10] So, just click on here and you can [687:13] adjust it a little bit. [687:18] So, I'll make it a little longer. Drag [687:20] it. [687:25] So, we can move this a little up [687:28] with arrows. [687:29] And same thing for this subnet. [687:33] And use the arrows again [687:35] to connect it here. [687:38] And we can make this [687:40] move up a little bit so it's in line [687:42] with the other one. [687:44] Or close to being in line with the other [687:46] one. [687:48] All right. [687:51] Okay. [687:52] I think it's close. [687:54] Maybe if I move it to the side a little [687:56] bit. [687:57] Bring it here. [688:01] And then use the arrows to align it with [688:03] the other one. [688:04] I think it looks good now. And the last [688:06] subnet [688:07] also needs to connect here. [688:10] So, I'm going to connect it in here. [688:15] Uh, [688:16] doesn't look as good because of the [688:18] distance. [688:20] So, we can drag this a little bit to [688:22] this side and it becomes better and we [688:24] can drag this one as well. So, the lines [688:26] are now looking much better. Okay? So, [688:29] I've connected [snorts] all the subnets [688:30] into [688:32] the implied router and the implied [688:33] router is connected to the internet [688:35] gateway. [688:37] All right, so this looks okay to me now. [688:40] What we are missing now is the route [688:43] tables. That's what we are missing now. [688:45] I need the destination and target and [688:48] the names of the route tables. And once [688:49] we are done with that, that means we [688:51] have done the entire thing and you have [688:53] built an architecture drawing that looks [688:56] good for a fundamentals level. This is [688:59] excellent, not only good. [689:01] So, we need to insert a table. [689:03] So, I'm going to type table [689:06] and you'll see different ones here. So, [689:08] I'm going to click on this one. Let me [689:10] drag it out. [689:13] And we need only two columns, not three. [689:16] So, what I can do is I can [689:18] click on [689:22] the it's in the arrange and probably [689:24] this one. [689:26] Yeah. Okay. And also I need to delete an [689:29] arrow. [689:31] So, I'm going to go into arrange again. [689:35] And I'm going to delete a row. [689:38] But I didn't want to delete this one. [689:40] Let me delete the last one so it will [689:42] maintain this one. Okay, and we we need [689:44] to type the text destination [689:48] and target. Of course, all of them are [689:51] going to have the 10.0.0.0/16. [689:56] And this is going to point to local. [690:00] And the internet ones are going to have [690:03] 0.0.0.0/0 [690:07] which will point to [690:09] the internet gateway. [690:11] IGW. [690:14] Let me go back. [690:18] Yeah, I got it right. [690:20] So, let me go back here. [690:23] We don't need this row. [690:27] So, I'm going now to [690:30] put this as [690:33] This is for public [690:36] uh, subnet. [690:38] So, we have public RT and public RT the [690:41] same. [690:44] I'm going to double double click here [690:46] and then write public [690:48] RT [690:50] and make it bold. [690:55] So, this one applies to both and what I [690:57] can do now is I can highlight the entire [691:00] thing [691:03] and then drag it to the left so we'll [691:05] have space on the right hand side as [691:07] well. [691:09] And I can drag it a little bit more. [691:12] So, we'll have public route table as [691:14] well. Okay, so I need a copy of this [691:17] table. [691:21] Okay. [691:27] It is replicating. [691:30] Not the entire table. It's replicating [691:32] the [691:33] the row and this is not what I want. So, [691:36] I'm going to replicate this first. [691:39] Public route table and this one I need [691:42] to replicate. Not I need the entire [691:45] thing to be replicated. [691:48] So, let's see how we do this. [691:52] Copy [691:53] and [691:55] paste. Okay. [691:59] So, here is the other one. This is [692:04] and public route table. Of course, now I [692:07] have started a new page and I didn't [692:08] want to do that. So, what I will do is [692:10] I'm going to shift everything into the [692:13] same page. [692:15] Just drag it and then take it to the [692:17] left a little bit. [692:20] So, now we are back to one page only. [692:24] And this one bring it closer. Now, what [692:27] we need is we need to to do the private [692:30] subnet tables. So, I'm going to do a [692:32] control V again. [692:33] But this is going to be without the last [692:37] row cuz it doesn't have access to the [692:39] internet. [692:40] And I can change the color, of course. [692:43] I can choose not the font. I want the [692:47] table color. [692:50] Style. So, I can do the fill to be [692:54] uh, [692:55] let's see. Fill. [692:58] Uh, [692:58] let's make it blue. [693:03] But with a little practice, we can [693:05] figure out why it's not taking the [693:07] color, why it's not changing the color. [693:10] But anyways, what I need now for the [693:12] private, I need private route one and [693:15] private route table two. So, I'm going [693:17] to have different names for them. [693:21] So, private [693:24] RT one [693:27] and make it bold [693:30] and drag it to here. [693:33] And then control D. [693:36] Drag it out and number two. [693:40] And take it to the other side. [693:43] And guess what? We have now [693:47] the full drawing that we wanted to do. [693:50] Although it changed the direction of the [693:52] internet, but that is okay. That's [693:54] perfectly fine. And actually it makes [693:57] no difference because here I have the [693:59] two public subnets facing the router and [694:01] the IGW closer to the internet. So, as [694:04] if we shifted that 90° [694:07] to the right. [694:09] And that is how we have but the [694:10] availability zones here were horizontal. [694:12] If we shift it 90°, they are going to be [694:15] vertical and it will make the same [694:17] drawing. Now, I need to find out why [694:19] it's not taking the fill color. And once [694:22] we're done with that, then all is good. [694:24] All right. So, let me click on this. [694:28] Click on the table and I don't want the [694:30] fill to be auto. [694:34] I want it to be solid and I want it to [694:35] be a different color. [694:38] So, let's try blue. [694:42] Okay. So, blue is good. [694:45] And now, okay. So, now Oh, okay. It does [694:49] one cell at a time. [694:51] I think it does one cell at a time, not [694:53] all the table. [694:55] So, this one I'm going to do it blue as [694:58] well. [694:59] Yeah. All right. So, we figured out why [695:02] it was not taking it. So, we have to [695:04] highlight one cell. That is not the case [695:06] when I'm working on um [695:09] on the app that I have on my laptop. But [695:11] anyways, we figured out. It's very easy [695:14] if you play around [695:15] to figure out what are the different [695:17] things are. So, now you have a a full [695:20] drawing. [695:22] Looks very professional. [695:24] And it shows that you understand what is [695:27] an availability zone because here we are [695:29] extending the VPC across availability [695:31] zones. So, you understand that the VPC [695:33] is confined to a region. [695:34] You understand that the region has [695:36] multiple availability zones and [695:37] availability zone is also confined to a [695:39] region. But the VPC can stretch and have [695:42] workloads across availability zones. So, [695:45] this is clear. [695:46] When I look at it, I understand that you [695:49] understand what you are drawing. And it [695:51] looks professional. You are using [695:52] different color to signify that you have [695:55] different items. Route tables, different [695:57] route tables, different colors. Same [695:58] route table, same color. [696:00] So, this shows that you know what you [696:03] are doing. It shows the IP addresses. It [696:05] shows the name of the web servers if you [696:07] have one assigned. We have a wrong line [696:09] here that we can delete. I'm only [696:11] missing one thing, [696:14] which is the database and the security [696:16] group in the private subnets. Once I [696:18] have this, I think we would have [696:19] completed everything and this will be [696:22] your first architecture drawing. Of [696:24] course, you can start with simpler ones [696:26] if you want, but now I showed you how to [696:28] build a complex one. If you get to that [696:30] skill level, excellent, perfect. If you [696:33] don't, you need to look up to getting to [696:35] that level, but you can start with one [696:37] availability zone, one subnet, implied [696:41] router, IGW, one VPC, small VPC and all [696:43] that. You can start with that and then [696:45] you grow your skills as you go. But [696:47] let's put the database and the security [696:48] group and we are good to go. So, here [696:51] I'm going to type [696:53] RDS. That's the name of the database in [696:55] AWS. [696:56] And I'm going to take this icon. [697:00] Let's take it out. I can change the [697:03] color. I can make it blue. [697:07] Yeah. And I can make it smaller so it [697:09] can fit under [697:12] the [697:14] security group. So, we need one here. [697:17] And we need one here. [697:19] And then I'm going to go back and [697:21] security [697:24] group. [697:26] And let's grab this one so it it's [697:29] different than the other one. And let's [697:31] change its color to blue for example [697:33] also. I like blue. [697:36] Resize it to fit in. [697:41] I think this should be enough. [697:45] See? Yeah. [697:47] And you can always use the arrows for [697:49] sensitive distances. [697:51] Control D so I can have another copy. [697:53] Move it to the other side. [697:55] And use the arrows again to adjust it [697:58] within the subnet. [698:00] And we are good to go. Believe it or [698:03] not, [698:04] congratulations on building your first [698:06] architecture drawing. And nothing stops [698:09] you from expanding into other pages if [698:11] it is going to be big, but it will be [698:13] very hard to accommodate it and make [698:15] sure that it's visible within documents. [698:18] Now, you are done and you want to export [698:21] it or you want to save it. So, I can [698:23] export it [698:24] as PNG, JPEG, [698:28] SVG if you want, PDF. You can do all of [698:31] it. If you do PNG, you can click here to [698:34] make it transparent background. So, you [698:36] can take the drawing, put it on a [698:37] PowerPoint presentation if you are going [698:40] to present and you include it in your [698:42] PowerPoint or take it without a [698:44] background and put it as well in your [698:46] documents. So, it will not have a grid [698:50] or anything that will show in the [698:52] document. It will only show the diagram [698:54] on the background, which is the document [698:55] itself. That's it. And if you do export, [698:57] it will ask you, "Okay, what's the name? [698:59] Where do you want to have it?" And [699:01] that's it. So, that's all what you need [699:03] to do in order to build a professional [699:05] drawing. [699:07] This is not only limited to AWS, by the [699:09] way. Let me cancel. Now, if you want [699:12] Azure [699:13] icons, you can have Azure icons. If you [699:15] want GCP icons, you can have GCP icons. [699:19] So, GCP icons. You can have Google Cloud [699:23] icons. If you want Cisco icons, if you [699:25] want to to build something for [699:27] networking, you will find everything. [699:29] Cisco [699:30] and you'll have Cisco icons. Juniper. [699:35] They don't have Juniper. [699:37] So, there are [699:38] icon libraries that you can download and [699:41] use it as well. And of course, they have [699:43] the general ones as well. They have the [699:45] drawings, the rectangles, the circles, [699:47] the triangles and so on. These are [699:49] general purpose ones [699:51] that you can use if you want. Arrows and [699:53] so on. And the more you draw, the more [699:55] you get familiar with it. So, [699:57] Kubernetes, I think it will have also. [700:00] Kubernetes. [700:02] It does have Kubernetes icons. Docker [700:05] has some of them. Uh [700:07] Terraform, let's see. [700:09] Um not many. Or maybe HashiCorp. [700:14] HashiCorp. [700:18] No, it doesn't. But you can look for [700:20] libraries and you download them and use [700:22] them if you want. [700:45] In module 10, we are going to look at [700:48] many IT tools or technologies that we [700:51] use and they are extremely important [700:54] when it comes to modern IT. The IT of [700:57] the cloud, the IT of DevOps, the IT of [700:59] AI and machine learning and so on. [701:01] This is not going to turn you into a [701:03] master of these technologies and tools, [701:06] but it will tell you why you need to [701:09] learn them and what you can do with them [701:12] at a very high level, very basic, very [701:14] simple without any complications. [701:16] When you decide on your next career [701:18] steps, you will know up front what [701:20] technologies and tools you would like to [701:22] master in order to be well prepared and [701:25] well-rounded for the role that you are [701:28] going to choose. All right? So, let's [701:31] go ahead and start our section. [701:33] So, let's start with a Linux overview. [701:37] First of all, Linux is [701:39] I would say 95% [701:42] running all the servers on the internet [701:44] today. [701:45] I'm talking about the server side. I'm [701:46] not talking about the users that are [701:48] using Windows. I'm talking about servers [701:51] that are running AI, that are running [701:52] the cloud, that are running DevOps, that [701:54] are running a lot of things in the cloud [701:56] in modern IT. And these are based on [701:58] Linux. [702:00] That is why [702:01] I am personally an advocate of learning [702:04] Linux as opposed to Microsoft Windows [702:06] Server. You will be well equipped [702:10] with Linux, with the right skills to [702:12] start learning Docker, to start learning [702:14] Kubernetes, Terraform, Git and GitHub [702:17] and a lot more technologies that are all [702:20] based on Linux primarily. [702:23] I know some of what I mentioned may run [702:25] on Windows, but that is not what is used [702:28] in production. That is not the core in [702:30] production. And as I mentioned, we are [702:32] talking about 95% of the internet runs [702:35] on Linux. [702:36] Again, this is only a high-level [702:38] overview to show you how you would deal [702:40] with it and how it works. Is it command [702:43] line interface or is it graphical user [702:45] interface? And what would you do for [702:47] simple tasks in Linux? [702:52] So, why learn Linux? [702:54] Linux runs most of the cloud and [702:56] internet systems, servers and [702:58] cybersecurity tools today. [703:01] DevOps and cloud careers heavily demand [703:04] Linux skills. So, you need to know Linux [703:06] well and also, in order to build the [703:10] skills in other technologies like Docker [703:12] and containers and Kubernetes and all [703:14] that stuff and Ansible and so on, you [703:16] need to know Linux [703:18] to a decent level where you can learn [703:20] these technologies and work with them [703:22] because at the end, they all work on CLI [703:24] and they are all dependent on Linux [703:26] commands and Linux operating system. [703:30] Learning Linux paves the way to learn [703:32] the other stuff. We talked about that. [703:34] It is free. So, you can start learning [703:36] Linux without having to invest in a [703:38] license or buy subscription or anything [703:41] like we do with the Windows. You don't [703:43] have to do that with Linux. [703:47] Linux administrator is a good quick [703:49] entry point in IT as I mentioned. So, if [703:51] anyone would like to get quickly a job [703:55] in IT, it won't be the highest pay that [703:57] you should be aiming for, but at least [703:59] you can enter and have a funding source [704:02] to fund the rest of your education. And [704:04] at the same time, learn IT and grow [704:07] within. The minimum Linux knowledge that [704:10] you need will be creating, deleting, and [704:13] navigating folders [704:14] and working with files and permissions. [704:16] Basically, to be capable of dealing with [704:19] the file system, the files, the folders, [704:21] the permissions, the users, the groups, [704:25] assigning and creating users, assigning [704:27] permissions, and all that stuff. So, [704:28] this is all important. Using the [704:30] terminal shell and the common commands [704:32] and install and tune packages, [704:35] this will be the minimum that you need [704:37] to know. [704:38] And this is enough to get started. You [704:40] can add more skills as you go or [704:41] whenever you need to learn something new [704:43] for a new technology, then you can go [704:45] add that to your tool set in Linux and [704:48] then continue. [704:51] If you are planning or if you want to [704:54] get into IT as a junior Linux [704:56] administrator, then the number one [704:59] enterprise preferred Linux certificate [705:02] is the Red Hat Certified Systems [705:04] Administrator. [705:06] So, this is a certificate you may spend [705:09] after this course maybe another [705:11] um 1 and 1/2 to 3 months depending on [705:13] the time that you are going to allocate [705:15] and you can prepare for the exam. The [705:17] exam a little bit on the hefty side. It [705:19] costs about 350, 400, 450 dollars [705:21] depending on where you are. [705:24] But, that would give you the seal that [705:27] you are certified in Linux and you can [705:29] start your job as a junior Linux [705:31] administrator or junior technical [705:33] support engineer. [705:35] Don't make that your goal, but that [705:37] could be a tactical or a milestone [705:40] towards your goal. [705:41] So, if you want, you can do this. And of [705:43] course, there is one equivalent one [705:45] also, the LPIC certificate, but I think [705:49] that Red Hat is more [705:51] widely known at the enterprise level. [705:54] The other one is picking up towards the [705:56] cloud. [705:57] Either one will give you enough [705:59] knowledge about Linux that you can learn [706:02] any distribution. You can learn Ubuntu, [706:03] you can learn Red Hat in this [706:05] certificate, you can learn Kali Linux or [706:08] anything else depending on what you will [706:09] specialize in after this course. [706:15] When you work with Linux, you are [706:17] working with a command line interface. [706:19] So, it's not a graphical user interface [706:21] where you click on things and right [706:22] click and open and and and delete and [706:25] all that stuff as we do in Windows and [706:27] and Mac OS. [706:28] It is more on the command line. [706:30] So, some common commands that you will [706:32] definitely use. [706:34] Who am I? If you would like to check [706:36] which user you are logged in to the [706:38] Linux system. PWD, if you would like to [706:41] know where exactly in the file system [706:42] you are. Are you at the root? Are you in [706:44] the Linux practice subdirectory? Are you [706:46] in the application one folder? Where are [706:49] you exactly in the system? [706:52] LS [706:54] to list files and folders [706:56] and CD to change directory. [706:58] CD can help you change directory so you [707:00] move deeper into the file system or you [707:03] move up into the file system. You can [707:05] create directories with make directory [707:08] and you can do cat in order to print [707:11] file content. Basically, read for me the [707:12] file and print it on the screen. [707:14] And use the touch command in order to [707:16] create files. You can nano to edit [707:19] files. [707:20] And you can echo if you would like to [707:21] redirect a specific sentence into a [707:24] file. So, you want to create a file and [707:27] then you can start adding information [707:29] into that file or appending information [707:31] to what is in the file using the echo [707:33] command and redirection. [707:36] We are going to go ahead and do a demo [707:38] and that would be the most helpful way [707:41] to [707:42] get an idea on how Linux works and what [707:45] to expect when you are dealing with the [707:46] CLI. [707:50] Let's go ahead and demo [707:53] Linux and use some commands in a very [707:56] simple scenario that will give you a [707:58] feel of how Linux is and how you work [708:01] with it and some basic commands as I [708:03] mentioned that are very common and you [708:05] will use them frequently when you are [708:07] learning cloud or you're learning any of [708:09] them modern IT skills. [708:12] So, what's the objective? We want to [708:14] learn how to navigate, create, and [708:16] manage files and folders in a Linux [708:18] system. [708:19] And the scenario, imagine that you have [708:22] been hired or you are in an internship [708:24] as a junior [708:26] support technician or systems [708:28] administrator. And the team lead that [708:31] you are assigned to will ask you to [708:32] explore the Linux server and do some [708:34] basic file and folder operations to get [708:36] used to the environment. [708:38] In order to achieve that, the simplest [708:40] thing, I'm not going to ask you to [708:42] create a VM on your laptop or anything. [708:44] We are going to create an EC2 instance [708:46] in a public subnet in AWS with a public [708:49] IP address. [708:50] It will be associated with a security [708:52] group that will allow SSH inbound from [708:55] anywhere. Very easy. Let's go ahead and [708:56] create this before we start the [708:58] commands. So, here we go. I am right now [709:01] in my account. I'm going to go ahead, [709:04] launch an instance, and let's call it [709:07] Linux [709:10] training. [709:12] And it's going to be an AWS Linux. [709:16] Amazon Linux 2023 or AL2023. [709:22] T2 micro. We don't need a powerful [709:25] instance for this. I'm going to use an [709:26] existing key pair. If you don't have an [709:28] existing one, please create one and [709:30] download it and know where it was [709:32] downloaded. [709:34] And network settings. [709:36] We're going to do with a custom VPC. [709:39] I want to make sure that it's going to [709:40] get a public IP address and I want to [709:43] make sure that it is in a public subnet. [709:45] And I'm going to use an existing [709:47] security group and I have one, SGA. This [709:50] allows all traffic in, all traffic out. [709:54] Okay. So, a quick review just to make [709:56] sure that everything is right. Public [709:57] subnet. It will get a public IP address [710:00] in the custom VPC. It has a key and it's [710:03] T2 micro and Amazon Linux. And I'm going [710:06] to go ahead and create it. [710:11] After we'll create it, we'll connect to [710:12] it because we need to start working with [710:15] Linux. [710:17] So, I'm going to click on the ID to get [710:19] into the instance. [710:21] Click on connect and in this case, I'm [710:24] going to use the EC2 instance connect. [710:27] Click on connect. [710:34] And as you can see, we have a public IP [710:35] address and a private IP address. [710:38] Connected to the instance [710:40] and [710:41] I'm going to elevate my permissions with [710:43] a super user. So, as you can see on the [710:45] left-hand side that this is easy to use. [710:48] But if I want to know for sure, [710:50] I can ask who am I? [710:53] And that will tell me that you are easy [710:55] to user. [710:56] When I do the sudo SU, [710:59] this is going to change. So, let's find [711:00] out. Who am I? [711:03] Now, it will tell me that you are the [711:04] root. Root means the most powerful, the [711:07] super user in the system and you have or [711:09] you can do [711:11] all permissions and all that stuff. Of [711:13] course, in in Linux, usually when [711:15] someone tries to change into a super [711:18] user, there must be some authorization [711:22] done because not everyone should be [711:24] allowed to do that. But the default in [711:25] AWS is there is no password, there is no [711:28] permissions to claim the root privileges [711:31] or permissions. [711:33] All right. So, find out your username. [711:35] We did the who am I? Where in the file [711:37] system are you right now? So, in order [711:39] to do that, we need the PWD or print [711:43] working directory. [711:45] So, I'm going to do PWD. Let me know [711:47] where I am. [711:49] And this tells you that you are under [711:50] home and under the directory home folder [711:54] of easy to user or the home folder [711:57] directory of the EC2 user. [711:59] List the files and folders in the [712:01] current directory and that is using the [712:03] command LS. [712:05] So, I'm going to do LS [712:06] and I don't have anything right now. [712:10] Create a new folder for your work and [712:14] this is going to be the Linux-practice [712:17] folder. And the command to do that is [712:19] make directory. [712:21] So, let's do that. Make directory and [712:23] then Linux [712:26] practice. [712:27] That's the folder. [712:29] When we do LS again, you'll find that we [712:31] have now a folder called Linux practice. [712:34] Move into the new folder. So, from [712:36] home/ec2-user [712:38] path or the place in the directory, you [712:41] need to move into you move deeper into [712:43] the file system. So, basically, [712:46] we have home. [712:49] And under home, we had a folder called [712:51] user. [712:53] Now, under user, we created a folder [712:56] called Linux [712:58] practice. [713:00] And [713:01] when I started, [713:03] I started right here. Now, I need to [713:06] move one step in the system and get into [713:08] this directory. How can I do this? Using [713:11] the change directory command, Linux [713:13] practice. [713:17] And after we do this, we need to find [713:19] out where in the file system we are. So, [713:21] we are going to use PWD to confirm that [713:24] we have moved in the system. So, I'm [713:25] going to do CD and then Linux [713:29] practice. [713:32] LS. [713:33] I don't have anything. And if I do PWD, [713:36] it will tell me that See, before I was [713:39] here and now I have moved one step into [713:42] the system, deeper into the system, into [713:44] a a folder called Linux practice. [713:48] Create a file. How can I do that? Touch [713:50] hello.text. So, when you do LS, we don't [713:53] have anything. Let me clear this. [713:56] And now I need to create a file called [713:59] hello [714:01] .text. [714:03] If I do LS again, [714:04] we have a file now. [714:06] the hello.text [714:08] And if we do cat [714:10] hello [714:11] .text, this will show me if the file has [714:13] any content, it will print it here. But [714:16] as you can see, the file is empty. I [714:17] don't have anything here. List the [714:19] folder content, we saw that. [714:22] All right, what's next? Write something [714:24] into the file and we can use echo hello [714:26] world. So, this is going to print as an [714:30] output hello world, but this means [714:32] amended or append the hello.text file. [714:35] So, add it to whatever is in the [714:37] hello.text file. [714:41] So, echo and [714:43] double quotes hello world [714:48] and then [714:52] hello.text file. [714:55] Now, if we [714:57] cat the content of the file again, [714:58] you'll find that after it used to be [715:00] empty before [715:01] when we did here, we didn't get anything [715:04] and now we are getting the text in the [715:05] file. [715:10] We did the cat, edit the file. So, we [715:13] can use the nano editor in order to edit [715:15] the file. Let's try that one. [715:20] So, nano hello.text [715:24] and here I'm inside the file and as you [715:26] can see the sentence that we have added [715:28] and I can say here [715:30] how are you doing today? [715:34] And then do control X. [715:36] Yes to save the changes and enter to [715:39] exit. [715:40] Now, if we repeat the cat, [715:43] you'll find that we have the two [715:45] sentences in the file. [715:50] Okay, create a subfolder inside the [715:52] folder. [715:54] Subfolder called notes inside the [715:56] folder. [715:59] So, we're going to create make dire [716:01] notes. [716:03] If I do LS, now I have two things. I [716:05] have a folder, different color, and I [716:07] have the file hello.text. [716:13] Where in the file system are you? [716:15] We're going to move the file hello.text [716:18] into the notes folder. [716:20] All right, so do PWD. I'm still where I [716:22] am in the Linux practice. [716:25] We're going now to move the file [716:27] hello.text. [716:29] I would like to move it from the [716:31] location where I am right now into the [716:33] notes folder. [716:35] So, I'm going to move it into notes. [716:37] LS, I don't have the file anymore. [716:40] If I go into notes [716:43] and do LS, I'll find that the file is [716:45] here now. [716:47] Now, once we are done, we can delete the [716:49] hello.text file. We don't need it [716:50] anymore. That was just the practice that [716:52] we wanted to do. So, I'm going to remove [716:55] the file hello.text. [717:03] Remove regular file. [717:05] Yes. [717:06] LS, remove hello.text. [717:14] Now, the file is removed. [717:18] Now, let's get out of the notes [717:19] directory because I need to delete it. [717:21] So, you can move one level up in the [717:23] file system [717:24] by doing CD space dot dot and as you can [717:27] see, we moved from notes into Linux [717:29] practice. So, I moved one level up in [717:32] the system. [717:33] And if I do LS here, I'll find that we [717:35] have notes. So, we can do remove [717:37] directory, delete the directory notes. [717:40] And if I do LS, I don't have it anymore. [717:42] So, I'm going to move one level up again [717:44] and now I'm back into the home directory [717:46] of the EC2 user [717:48] and we can do remove directory Linux [717:52] practice. [717:54] LS and we don't have it anymore. [717:57] All right, so delete the hello, delete [717:58] the directory and delete the Linux [718:01] practice. And as a good practice, always [718:03] if you don't need the instance anymore, [718:05] terminate it or at least stop it so you [718:07] don't [718:08] face any surprising charges. So, I'm [718:11] going to go back. [718:12] I don't need this anymore [718:14] and I'm going to get here and instance [718:16] state terminate [718:19] and we are good to go. [718:24] Now, let's [718:25] do bash scripting or bash overview. What [718:29] is bash? Why do we need it? Why it is [718:32] always a requirement or a skill required [718:35] when you apply to cloud engineering, to [718:38] DevOps, to programming, to Linux [718:40] administration, to ML ops, to SRE, to [718:43] platform engineering, anything, you will [718:45] need to work with bash scripting at [718:47] least as a scripting language. [718:51] So, what is bash? Bash stands for Bourne [718:55] Again Shell. [718:56] That's the abbreviation for bash. It's a [718:58] command line interface and a scripting [719:00] language for Linux. So, it's only for [719:03] Linux. [719:05] It lets you talk to the computer, [719:07] automate tasks, and chain commands [719:09] together to get powerful things done. [719:12] So, instead of you going into the [719:13] command line, typing one command at a [719:16] time, [719:17] you can have them in a script and you [719:19] can apply that script, for example, when [719:22] the virtual machine is booting up. You [719:23] can install things and you can configure [719:25] things. [719:27] When you want to automate the backups, [719:29] for example, you want to take a copy of [719:31] your database [719:32] every night at 1:00 a.m. for example. [719:36] So, instead of you waking up and doing [719:38] that manually, why don't you put in [719:41] a script [719:42] and schedule it so it runs every day at [719:45] 1:00 a.m. And you will be sleeping and [719:47] you can also ask for an alert or a [719:50] notification that was done successfully. [719:53] All of that is done using bash script. [719:55] So, it's one of the core skills when you [719:58] are working with Linux systems for [720:00] automating tasks on these Linux systems. [720:04] Why learn bash? It's the default shell [720:06] in Linux [720:07] and automate boring tasks [720:10] used in DevOps, cloud, and cybersecurity [720:12] heavily and it's fast and lightweight. [720:16] Now, let's look at common use cases for [720:18] bash so you can get your head around why [720:21] do you need to learn it. So, we'll look [720:23] at the tasks and what would bash do for [720:26] me in that case. [720:27] So, you want to automate routine stuff. [720:30] Starting virtual machines at 7:00 a.m. [720:32] in the in the morning, switching them [720:34] off [720:36] at 6:00 p.m. in the evening, [720:38] doing backups for the virtual machines [720:40] or for the database, a lot of things [720:42] that can be done. So, routine tasks like [720:44] backups, deleting temporary files every [720:46] day. So, that can be done without you [720:48] having to worry about it. Schedule it [720:50] and forget about. [720:52] Cloud setup. So, launch and configure [720:54] EC2 instances. Not only launch and [720:57] configure. So, you can download things, [720:59] install packages and and so on. [721:02] Security and monitoring, it can help you [721:04] scan logs for failed logins and that [721:06] will be helpful for the security [721:08] specialist or the consultant to find out [721:11] if you are or you were under attack. [721:14] Installing packages and software, [721:16] multiple packages in one script as [721:18] opposed to you going and do typing a [721:21] command and then waiting until it [721:23] finishes and then typing the next one [721:25] and until it finishes, you can just pass [721:27] them as a series of commands and it will [721:29] do them one by one as the virtual [721:31] machine boots. [721:33] Report generation. You can use it to [721:35] pull, for example, disk usage and send [721:38] an email or email these reports. [721:41] Which modern IT roles will require you [721:44] to have bash because you will use it in [721:46] that role. So, if we start from IT [721:49] support, network engineers, [721:51] technical support, sysadmins, all of [721:54] them will need bash because they need to [721:56] fix files, manage files, generate [721:58] reports, troubleshoot via CLI, create [722:01] and manage users. [722:03] For DevOps engineers, it will be very [722:05] helpful to automate the CI/CD tasks and [722:08] also server management and creating [722:10] cloud scripts to bootstrap the virtual [722:12] machines with the right packages or the [722:15] right software that you need. [722:17] For cloud engineers, [722:19] for user data scripts, [722:21] basically passing that, as you'll see in [722:23] the demo, passing a script to the [722:25] virtual machine when it runs, so it will [722:27] download and install packages and maybe [722:30] services that you need and it will start [722:32] them as well [722:33] as the instance boots, so you don't have [722:35] to wait until it boots and then you go [722:37] in SSH and then you start typing one by [722:40] one of the commands. [722:42] So, user data scripts, provisioning EC2 [722:44] and startup tasks. [722:47] For cybersecurity analysts, it will help [722:49] with the log analysis, it will help with [722:51] automating tools that are used and also [722:53] for network scans. [722:56] And for sysadmins, automate system [722:58] health checks, backups, and updates. So, [723:00] these are just examples. Of course, when [723:02] we talk about DevOps engineers, that [723:04] means SRE engineers and platform [723:07] engineers also they need it. Cloud [723:09] engineering also definitely will need [723:11] it. Network engineer, [723:14] developers, they will need to have an [723:16] adequate level of bash because [723:18] many of these tasks, you'll find that [723:20] other roles as well need them. [723:24] A lot of the jobs that I see in the US [723:27] and that is the reference for me that I [723:29] use to find out where things are going, [723:31] they will ask to know bash [723:34] or PowerShell or Python. [723:37] Rarely I would see that this and this [723:40] and this, but they want one of the [723:42] three. [723:43] So, let's compare them and find out. [723:46] What's the positioning of bash? Why is [723:47] it more popular? What's the positioning [723:49] of PowerShell? And if I learn bash, why [723:52] do I have to learn Python? So, this is [723:54] very important and I get this question [723:56] day in day out from people who don't [723:58] want to learn Python and they keep [724:00] pushing back and say, "I know Bash. I [724:02] can live with Bash. I don't need Python [724:03] for anything." Actually, you do. [724:07] From an operating system focused [724:08] perspective, Bash is for Linux, [724:10] PowerShell is for Windows and now it is [724:12] cross-platform. Python, of course, [724:14] that's a coding language. It can work on [724:15] Windows machines or in Linux machines as [724:18] long as it has the right runtime. [724:21] For the syntax, this is very simple, [724:23] Linux commands basically. [724:25] Uh for PowerShell, it's verbose a lot. I [724:28] mean, the commands are much more [724:30] difficult, I would say, than Bash, but [724:33] they are powerful. If you learn them, [724:34] you learn them. [724:36] For Python, it's a programming language. [724:38] So, the code is clean and it's very [724:40] easily readable. [724:43] Bash is best for native Linux tasks and [724:47] automation on Linux systems. [724:49] And, of course, PowerShell is for [724:51] Windows and Active Directory. [724:53] Whereas Python, it's full-featured [724:56] applications, anything you want. So, you [724:57] want to automate integration for an [725:00] application, for example, when someone [725:02] uploads an image on a website, then [725:04] Python will sense that and then will do [725:06] some tasks based on that that cannot be [725:08] done with Bash. [725:10] So, you have to have coding in that [725:11] case. [725:12] Learning curve, easy for beginners. [725:15] Usually, you learn Bash after you learn [725:16] Linux. [725:19] And PowerShell is slightly steeper than [725:22] learning Bash. [725:24] And for uh Python, it's a programming [725:26] language. [725:27] How is it used in AWS? [725:29] Bash is excellent for EC2 user data [725:32] scripts. [725:33] PowerShell is less common in AWS. And [725:37] Python, of course, when it comes to [725:39] writing programs that will interact with [725:41] AWS services and automate things based [725:44] on events that happen in these services. [725:49] Learn Bash first for system-level tasks [725:51] and then learn Python later for more [725:53] complex automation or data manipulation. [725:56] So, Linux, so you do the fundamentals, [725:59] you learn Linux to an adequate level and [726:01] be confident with Linux, then learn [726:03] Bash, then learn Python. That would be [726:06] your automation/operating [726:09] system [726:10] path in order to get a job in, let's [726:13] say, 4 months. And if you finish the [726:15] RHCSA as well, [726:16] you will find entry-level jobs with [726:18] these skills and then you can take it [726:20] from there up. Python automation is very [726:23] hot everywhere. [726:25] Don't stop at Bash and say, "I'm good. I [726:27] don't want uh programming languages." [726:30] Take your time, learn it, and if others [726:33] have done it, you definitely can do it. [726:35] All right? Hopefully, this is clear. [726:40] Let's look at a demo where we are going [726:42] to bootstrap. Bootstrap means you will [726:44] initialize the instance. You will create [726:47] the instance, but then you will stuff it [726:49] with some script to initialize it in a [726:52] proper way. This is called bootstrapping [726:53] the instance. [726:55] So, we are going to use a Bash user data [726:57] script to bootstrap an Amazon EC2 Linux [727:00] instance. Let's find out what we are [727:02] going to do. [727:03] We need to set up an EC2 instance in a [727:05] public subnet and make sure its security [727:07] group allows port 80 inbound at least. [727:11] And we're going to pass the following [727:13] script to install Apache as it boots up. [727:15] I'm going to add from my side as well. [727:18] Let's do SSH as well. So, allow [727:20] SSH and 80 inbound just in case. [727:24] If it's not working, we need to get into [727:26] the instance and find out what happened [727:27] exactly. [727:29] So, we're going to pass the following [727:30] script to install Apache as it boots up. [727:33] What is the script? [727:35] This is at the top to define that we are [727:38] going to use or we are going to use the [727:39] Bash shell or a Bash script. Then we are [727:41] going to update the indices and all that [727:44] on the operating system. We're going to [727:46] use DNF install -y httpd. We're going to [727:49] install Apache, which is a web server [727:52] engine. [727:54] We're going to do systemctl [727:56] start httpd. So, after installing [727:59] Apache, we need to start it. [728:02] And then enable httpd such that every [728:05] time you are going to reboot this [728:07] machine or stop it and restart it, [728:09] Apache is going to be restarted as well [728:12] with the instance. [728:14] So, all of that is going to install [728:16] Apache and that's it. [728:18] But then, [728:20] let's also have a simple webpage [728:23] that would say welcome to my EC2 [728:25] instance. So, this is HTML. This is the [728:27] echo command. We have seen it before. [728:29] And here are the double quotes to [728:31] delimit the [728:33] text [728:34] in question. [728:35] And we are going to output that into a [728:38] file index.html [728:40] at this path var www html. This path [728:46] within Apache [728:47] is where the root document or the [728:50] index.html or the root of the website [728:53] exists. So, if you want to have a [728:55] webpage and you have designed the HTML [728:57] for that page, you need to place it in [729:00] this folder [729:01] in order for users, when they come in to [729:04] your uh website on port 80, they will be [729:08] able to see that page. So, if you want [729:10] it to be seen, this is where you place [729:11] it. [729:12] And this is what we are going to do in [729:13] our case. [729:15] Let's go ahead and create the instance [729:17] and then we'll deal with the script. [729:19] So, here I am in [729:21] EC2. [729:22] I'm going to do this in a slightly [729:24] different manner. [729:25] First of all, I'm going to do every [729:27] command manually. [729:29] And I will show you the result and then [729:31] we'll do it with user data so you will [729:33] see the difference yourself. [729:35] So, launch instance. [729:37] And we're going to do it without [729:39] bootstrapping first. So, web testing, [729:42] for example. [729:46] Amazon Linux. [729:47] And it needs to be with a key. So, I'm [729:50] going to use again a key that I have for [729:52] SSH. [729:54] Network settings. [729:56] I'm going to use the custom VPC. [729:58] And I'm going to use the public subnet. [730:01] And I'm going to make sure that it has [730:02] an IP address. For the security group, I [730:05] have one that is widely open. It allows [730:07] all traffic in, all traffic out. In your [730:10] case, at a minimum, you want to have on [730:12] the inbound SSH from anywhere and HTTP [730:16] inbound from anywhere. [730:19] I'm not going to do anything extra than [730:21] this. [730:22] And I'm going to start. If I wanted to [730:24] have the user data or the script passed [730:26] to the instance, you click on advanced [730:28] details and you scroll all the way down [730:31] and this is where you paste it. It's [730:32] called user data and that's the script [730:35] or you can have it in a file and upload [730:36] it here. [730:38] So, I'm going to create this instance [730:39] without any user data or anything. [730:42] And I will show you that [730:44] we can achieve what I'm being told. So, [730:47] why do I have to use a script? So, let's [730:49] find the difference and that will tell [730:50] you the importance of Bash scripting. [730:53] So, what we'll do now, [730:55] let's go back to the instances. [730:59] And I'm going to select this one. [731:04] Okay, it's running now. Connect. And I'm [731:06] going to use EC2 instance connect and [731:08] click on connect. [731:11] If at this stage you are unable to open [731:13] this black screen and find out the [731:16] prompt, that means you have a problem [731:18] with your security group inbound rules. [731:20] Go fix it. [731:21] And you will get an error that maybe SSH [731:23] is not available or something. So, this [731:25] is based on SSH inbound in the security [731:28] group. If this is not working, you have [731:30] a problem in your security [731:30] [clears throat] group. [731:32] All right, let's go ahead and do sudo [731:33] su. [731:35] And what do we need to do? I need to do [731:36] DNF [731:38] update [731:41] -y. [731:44] So, this will update the system. It may [731:46] take a little bit of time because the [731:47] instance is still booting up. [731:55] All right, so it's working now. And then [731:57] DNF [731:59] install [732:01] -y httpd. This is the Apache service. [732:05] So, as you can see, a lot of things are [732:06] happening now, installing many things. [732:09] Then we do [732:11] systemctl [732:13] start httpd. [732:15] So, start the service. Now, if I can do [732:18] systemctl [732:20] status [732:21] httpd, show me the status, [732:23] you'll find that we have this service [732:26] right here [732:28] and it shows me that it is running. [732:32] And the last command, systemctl enable [732:35] httpd. So, each time [732:38] when the instance is booted, the httpd [732:41] will be started. Apache will be started. [732:42] Okay, fine. [732:44] What did we achieve? [732:45] I typed the five or six or eight [732:47] commands [732:48] and now I should have Apache up and [732:50] running. How do I find out? Apache [732:52] listens or works on port 80 by default. [732:55] So, I'm going to take the public IP [732:56] address. [732:58] I'm going to open here [733:01] a browser. [733:02] And you can write 80 or just leave it to [733:04] the default. By default, it's port 80. [733:08] And you can find out here that it's [733:10] telling me it works. I didn't put any [733:13] script or file. So, this is by default [733:15] from Apache. If I want to add a script [733:17] that I need, [733:19] then I can do [733:20] echo [733:23] and then [733:25] hello from Apache. [733:30] And then I have to redirect it into [733:34] var [733:36] www html [733:40] index. [733:42] html. [733:47] You can cat to check. [733:49] So, I can cat and then I have all of [733:51] this copied. [733:53] Paste and it shows me hello from Apache. [733:57] So, now if I go back [733:59] if I reboot [734:00] it will tell me hello from Apache. Maybe [734:03] you can't see it. It's small, but hello [734:05] from Apache. So, now it works. What's [734:07] coming from a default page in Apache in [734:10] the same folder and now I have replaced [734:13] that with hello from Apache. [734:15] All right. So, this shows you that we [734:18] could do it without any bash scripting. [734:20] Why on earth do I need to learn bash [734:22] scripting? Let's find out. So, let me [734:25] go back into instances and I'm going to [734:27] launch another instance, but this time [734:29] I'm going to do it with the bash script. [734:33] So, let's do web [734:34] testing two. [734:38] It's going to be Linux [734:39] and same size. Key pair, I'm going to [734:42] use the same key pair. If you are using [734:44] EC2 Instance Connect, you don't even [734:45] need a key pair, but that's fine. [734:49] Same VPC. [734:51] So, I'm going to do same everything, but [734:52] I will pass the script to it. Enable [734:55] security group. [734:59] Security group, I'm going to use the [735:00] same. [735:01] And advanced settings, click on the [735:04] triangle. [735:05] Scroll all the way down. [735:07] And then we're going to copy the script [735:08] that we have in the file. [735:10] And I'm going to paste it here. [735:12] One very common problem here is [735:16] sometimes when you copy from PDF files [735:18] or Word files and you paste here, the [735:20] line delimiters, they get scrambled. [735:23] They get mixed. They get confused. So, [735:25] what I usually do is either I'll copy it [735:27] and put it in a notepad, for example, [735:30] uh like basic text editor [735:32] and adjust it or I will do what I'm [735:35] doing right now. So, I'm going to go [735:37] into every line at the beginning. [735:39] Then [735:40] backspace and then hit enter. So, that [735:43] confirms that I have a line break [735:46] after every command and each one of them [735:49] is going to be considered a separate [735:51] line [735:52] and they are not mixed up. [735:54] Also, the comments that we have here, [735:56] they are of no use. If you want to [735:58] remove them, that's perfectly fine. It's [736:00] just for you in the documents to find [736:02] out what this was for and to find out [736:05] that it is a separate line, each one of [736:08] them. [736:09] Okay. So, this is the most common [736:11] problem that I see with my students when [736:13] they are working on bash scripts with [736:15] user data. [736:16] Especially if they're copying from PDF [736:18] files. [736:19] So, launch [736:21] instance. Let me just double check we [736:23] have everything set right. [736:27] It's always good to double check as [736:28] opposed to waiting and testing and [736:30] troubleshooting and then you figure out [736:31] you forgot something. Custom VPC, public [736:33] subnet, public IP and security group [736:36] allows everything and we have the bash [736:37] script as well. [736:39] So, now I can go grab a cup of coffee. I [736:42] don't need to wait for the instance or [736:44] connect to the instance or type any [736:46] commands. If these commands with the [736:48] with the line delimiters, they are done [736:50] right into the script the virtual [736:52] machine will boot up and will start [736:54] execute these commands line by line [736:58] and the start of it states that it is a [737:00] bash script. [737:02] So, that should all be working without [737:05] us intervening. [737:07] Okay. Let me close this completely and I [737:10] don't need the previous one anymore. So, [737:13] now we have a new instance [737:18] which is web testing two. This one, this [737:22] is the one initializing. So, this one I [737:24] don't need it anymore. I can go ahead [737:25] and terminate it [737:27] to not forget it later on and be [737:29] confused about which one I'm using. So, [737:31] this one I don't need it and this is the [737:33] one that is initializing right now. [737:36] Let's refresh. [737:37] If the bash script will download a lot [737:39] of packages and it has a lot of steps, [737:42] then you need to be a little patient [737:44] because if it takes time when you type [737:45] the commands, it will take time when [737:47] they are automated and running on their [737:50] own. So, let's try. [737:53] Here is the public IP address. I'm going [737:55] to copy it [737:57] and I'm going to check and see if this [737:59] works. So, paste it and hit enter. [738:03] And as you can see, welcome to my EC2 [738:05] instance. So, it didn't say it works [738:07] or it worked. It has taken the statement [738:10] in the echo and that was done with HTML [738:13] delimiters to enlarge the size a little [738:15] bit. So, that's why you can see welcome [738:16] to my instance. [738:18] Which is exactly the statement that we [738:20] had here in the file. So, you can see [738:23] with scripts, that is one task. I mean, [738:26] that is one example, not everything that [738:28] you will do. If you're not working with [738:30] virtual machines, maybe you need to take [738:33] the backup of the disk of the virtual [738:35] machine and do a copy or a backup every [738:38] night. [738:39] So, scheduling and scripting will help [738:41] you do that. Maybe there are some [738:43] states. Read the logs and if this [738:45] happens, do this. So, there is complex [738:48] logic that can be built with bash [738:50] scripts, but this tells you the value of [738:52] automation, although it is a basic [738:55] example, not a complicated example. [738:58] So, it shows the power of scripting in [738:59] cloud automation and zero clicks [739:01] whatsoever. I did not even SSH into the [739:03] instance. I just checked from the [739:05] website and everything was working. And [739:07] that is the power of scripting and [739:10] automation, which is why everything is [739:13] going towards automation. AI is also [739:15] doing faster automation and so on. All [739:17] right, hopefully this was clear. Don't [739:19] forget to terminate your instance if you [739:21] don't need it anymore. [739:25] DevOps engineering, site reliability [739:26] engineering, platform engineering and [739:28] DevSecOps. Four [739:30] very crucial areas in IT as it relates [739:34] to IT in general and software [739:35] development in particular. It doesn't [739:37] mean that you're going to be a developer [739:39] to work in one of those areas. This [739:41] module will help you understand what [739:43] these areas are, their importance and [739:46] how they relate to one another. So, [739:49] let's go ahead and get started. So, [739:50] let's start by exploring what's SDLC is, [739:53] software development life cycle. When a [739:56] team or a company would like to build an [739:59] application or build a tool, what is the [740:03] process? What's the workflow that from [740:06] the time the need or the requirements [740:09] and the planning were done all the way [740:11] until the code is done, tested and [740:13] deployed? This is called SDLC, software [740:16] development life cycle. So, let's go [740:17] ahead and explore that because it [740:19] relates to everything we're going to [740:21] talk about. [740:25] Any application or software goes through [740:28] several steps from the idea all the way [740:31] to deployment. We have, let's say, the [740:34] startup, the company or a business unit. [740:37] They have requirements. So, these [740:39] requirements are going to feed into a [740:41] team and that team will start doing the [740:44] planning. [740:45] And in the planning, they would say, [740:46] "Okay, this is what we need to build. [740:48] This is how much it will cost. This is [740:50] how much it will take. These are the [740:51] required resources and so on." [740:54] So, development team and project [740:55] managers and all that are assigned. They [740:57] start working on code and they start [741:00] collaborating in a repo in a repository. [741:03] Then we have the build and QA and [741:05] testing teams that are going to be [741:07] testing the code as it is developed or [741:11] after it is developed. [741:13] And depending on the manifests of tests [741:16] that needs to be done, they will find [741:18] out if there are any issues. If there [741:20] are issues, they will send feedback to [741:21] the developers and then iterate through [741:24] this until the software and the code is [741:26] ready. [741:27] So, this is true for any software [741:29] development. So, let's go go ahead and [741:31] find out what are these steps. [741:35] So, the software development workflow [741:37] will go through the following steps. [741:39] Planning. [741:40] Then we're going to go through [741:42] identifying the teams, the development [741:44] teams, assigning the jobs to them and [741:46] then they will start coding. [741:49] After coding or maybe during, depending [741:51] on which methodology they are going to [741:53] use, there will be building of the code [741:56] from the different developers. [741:58] Then performing testing in order to find [742:00] out errors or bugs or malfunctions in [742:03] the code. [742:04] And they will provide feedback to the [742:06] developers depending on what happens, [742:08] the results of these tests. [742:10] And after that, if these all errors or [742:13] all problems are solved, then we get [742:15] into the releasing and deployment. [742:18] Releasing means the software is ready or [742:20] the application is ready or the new [742:21] version is ready. And then deployment [742:23] means it gets implemented in production. [742:27] Then comes the operation and monitoring [742:29] phase and then this cycle repeats as we [742:32] enhance and add more features and so on. [742:34] So, this is called the SDLC, the [742:36] software development life cycle. [742:40] Of course, it is critical if we need [742:43] good quality software with less [742:45] problems, less errors. The more we can [742:47] automate in the steps, the better it's [742:50] going to be, the less errors we are [742:51] going to have, the faster it's going to [742:53] be released. [742:56] So, SDLC is a structured process used by [742:59] software development teams to do what? [743:01] To design, [743:03] develop, code, test, deploy and maintain [743:07] software. [743:09] And this will provide us a step-by-step [743:12] workflow or guide in order to be able to [743:15] manage the entire life cycle from the [743:18] planning all the way to monitoring and [743:20] iterating through this process again. [743:23] Benefits of following a workflow or a [743:26] process step-by-step [743:28] or SDLC, it will ensure that there is a [743:30] systematic approach to the software [743:33] creation across teams [743:35] and it will provide a way to measure and [743:36] improve the development process. We can [743:39] look at every stage or every step in the [743:41] workflow and find out if this is working [743:43] as expected or not. [743:45] And it allows for an accurate analysis [743:47] the different steps, which one is [743:49] working fine, which one needs [743:50] enhancement or improvement. [743:53] And depending on the methodology we use, [743:55] we can [743:56] test more frequently and build and test [743:59] more frequently to find errors or bugs [744:02] early in the process. [744:03] And of course, the SDLC also will [744:05] facilitate, if we do the automation, [744:08] it will facilitate faster software [744:10] delivery and higher software quality, of [744:12] course, which is going to yield better [744:15] user experience. [744:18] Of course, that is the goal. But let's [744:20] find out how was software development [744:22] done the old way. So, the old way, we [744:24] had the developers who are going to code [744:28] and build, then they're going to ship [744:30] the code over the fence, [744:32] do a handover or handoff to the QA and [744:35] testing teams. [744:36] They will do their testing and then they [744:38] will send it to the release team or the [744:40] release manager team and say, "Okay, we [744:42] have done all the tests. We need [744:43] feedback. Everything works fine. Now [744:45] it's time for you to decide with the [744:47] operations team when to release." And we [744:50] work with the operations team. Once it's [744:52] done, then it is handed off [744:54] to the operations team. So, as you can [744:57] see, this is more like silos. [744:59] They are working separate from one [745:01] another. [745:03] When each one finishes their work, they [745:05] will pass it on to the next one, to the [745:07] next one, and so on. [745:08] So, there is no collaboration. There is [745:11] no integration among the teams. [745:13] So, they were discrete teams. [745:15] Complex integrations, of course, because [745:17] if you are going to finish all the code [745:19] 6 months, 12 months, and then start [745:21] testing, we are going to have a long [745:23] list of issues. [745:25] Lots of bugs, of course, and definitely [745:28] a slow release process because we wait [745:30] until all the development finishes [745:33] before we start testing. We wait for all [745:35] the testing to finish before it is ready [745:37] for release. And we wait for the [745:40] scheduling in order for that we [745:42] deployed. So, that's [745:44] very slow release and features are not [745:46] going to be updated frequently. [745:49] In the new way, and in order to reach [745:51] our goal, the goal of automation, [745:55] less human intervention, less errors, [745:57] higher quality, faster releases, we need [746:00] collaboration among the teams and we [746:03] can't have the discrete teams that we [746:05] have looked at. [746:07] So, here we need to have an iterative [746:08] process. Maybe every [746:10] couple of days, we release, [746:13] or maybe multiple times a day, which [746:15] means we have to build and test more [746:16] frequently and we have to get software [746:20] ready more frequently. We have to deploy [746:22] more frequently and that's how we need [746:25] to enhance the user experience by adding [746:27] features in a stable software, highly [746:29] performing all the time. [746:32] So, we expect teams to collaborate [746:34] together and not to work in silos. [746:36] There is going to be continuous and less [746:39] complex integrations and errors, [746:42] consequently, are going to be detected [746:44] earlier. And this will yield a fast [746:46] release process, which is what we are [746:48] looking for. So, collaboration between [746:50] the teams or marrying the teams together [746:52] is an ultimate goal as opposed to [746:55] allowing them to work in discrete teams [746:57] in silos. [747:01] Now, let's look at the different models [747:03] and we are going to bring it from the [747:05] history all the way to where we are [747:06] right now. [747:08] There are different models to our [747:10] workflows that we can adopt or [747:12] processes, if you will, [747:14] in order to do the SDLC workflow. One of [747:16] them, which is legacy, is waterfall. [747:19] That's traditional. [747:21] So, in waterfall, we expect that the [747:23] development team is going to sit and [747:25] work for 6 months or 12 months [747:28] on the software and then when ready, it [747:31] will be shifted to testing. And when [747:32] ready, it will be shifted to operation [747:34] or release and then operations. So, this [747:36] is the old way, sequential methodology. [747:39] So, we look at the requirements, we look [747:41] at the design or design phase, [747:43] coding or development, building and [747:45] testing, deployment and operation and [747:47] maintenance and monitoring, and only [747:50] when this is done, then we can take new [747:52] requirements and we can work on a [747:53] different project. But of course, this [747:55] is [747:56] only or or can fit with uh projects that [748:00] have well-defined requirements. Today, [748:02] every day we need a new feature. We get [748:04] customer feedback and then we need to [748:06] build a new feature. [748:07] The fact that we can have all the [748:09] requirements up front with no changes [748:12] for 6 or 12 months is very rare to [748:15] happen nowadays. [748:17] Releases here are very slow, every 6 or [748:19] 12 months to have a release. [748:21] And the testing is done manually. So, [748:23] this is completely, as you can see, [748:25] waterfall is [748:27] completely off the goal that we had. [748:29] Manual testing and it only happens after [748:31] development is complete. [748:33] And operation teams will deploy the code [748:35] and of course, this is silos. And we are [748:37] talking here about operations team and [748:40] there is, whenever they have time, they [748:42] are going to look at the code and look [748:44] into deploying that. [748:46] Then evolved Agile. [748:48] And Agile is more of a [748:52] set of principles or um methodology. [748:55] It's not only about project management [748:57] that is used in software development. [748:59] Agile [749:01] is an iterative [749:03] and flexible software development [749:05] methodology. [749:06] Usually in Agile, we agree on a [749:09] milestone. Could be a feature, it could [749:11] be a release, and it it is divided into [749:14] sprints. [749:15] Let's say the sprint will be 2 to 4 [749:16] weeks. We are going to work [749:18] on code and every 2 to 4 weeks, we are [749:20] going to test and release. [749:22] So, the goal is to deliver working [749:24] software more frequently. [749:26] The waterfall had two issues. The first [749:28] one is it does not accommodate new [749:29] requirements during the workflow. [749:32] Second thing, it takes very long for [749:34] that [749:35] to complete before testing happens and [749:37] of course, a long list of errors and [749:39] bugs and all that will be discovered and [749:41] integration issues that needs to be [749:43] fixed and it takes a long time to be [749:44] fixed. [749:45] So, Agile said, "Okay, fine. We are [749:47] going to fix that. We are going to [749:48] iterate through the process. So, we are [749:50] not going to have one long process for [749:52] development workflow. Development is too [749:54] long and then testing is too long and [749:56] release and deployment is too long. We [749:58] are going to do that frequently and we [750:00] can gather new requirements and we can [750:02] add it into the new sprints, the new [750:04] milestones, and we can work on it, test [750:08] and everything, and release every 2 to 4 [750:10] weeks. [750:12] So, as you can see here, we have [750:13] planning, we have a plan phase, we have [750:16] design, [750:17] coding, building and testing, deploy, [750:20] and review, and then it repeats. So, we [750:23] can [750:24] launch or deploy and then we have again [750:26] planning, gathering new requirements, [750:29] designing, and so on. So, it is an [750:32] process that repeats at [750:35] high frequency or close intervals, so we [750:38] can release at close intervals as well. [750:41] And testing is continuous, but it's [750:43] semi-manual. So, it is very close to [750:45] what we wanted, but the testing is [750:47] semi-manual and also 2 to 4 weeks is a [750:49] bit long. So, we are still aiming for a [750:52] better solution. [750:54] And the release manager coordinates [750:56] development team and operations team to [750:57] work on the deployment, but of course, [751:00] it all depends on how available are the [751:02] operations team because Agile focuses [751:04] more on the development phase and not on [751:06] the operations phase. [751:09] So, the limitations in Agile, before [751:11] DevOps, of course, it was widely adopted [751:13] to make software development faster and [751:15] more responsive, as we explained. [751:17] However, Agile ended at the code handoff [751:21] to operations. So, once the code is [751:22] ready, [751:23] tested, and then release manager [751:25] coordinates the deployment, that's it. [751:27] So, is the operations team Agile? And [751:30] the answer was no. It did not transform [751:32] operations. It did not include [751:34] operations in the Agile process. And [751:37] that is a problem because now we have [751:39] a team that is collaborating, the [751:41] testing and QA and all that and [751:42] developers, but then the operation is a [751:45] different silo. [751:47] And operations team, because they are [751:48] not Agile, they still used slow manual [751:50] processes. [751:52] And this caused friction, of course, [751:54] between the development teams and the [751:55] operations teams. And that is what [751:58] necessitated finding out a new solution [752:02] to this, which is DevOps. [752:09] So, let's talk about DevOps. [752:11] DevOps increased the automation [752:15] and also married development, QA [752:17] testing, and operations. Brought all of [752:19] these and blended them in one ball. And [752:22] this is the team responsible for the [752:24] software delivery. [752:27] So, the problem before DevOps that Agile [752:30] created a fast dev, slow ops bottleneck. [752:33] So, we needed to fix that. [752:35] The code was ready every 2 weeks, but [752:37] ops teams deployed monthly or quarterly. [752:41] And developers and ops worked in silos. [752:43] These were the issues that we discussed. [752:45] So, what is DevOps? DevOps is a set of [752:47] practices, tools, and a culture mindset [752:50] that combines software development, [752:52] development, and IT operation. [752:54] It brings both of them as a [752:56] collaborative bigger team. It's a full [752:58] software life cycle investment. And it's [753:01] a team undertaking. It's not one person [753:03] that will decide I'm going to do DevOps. [753:05] It has to be [753:06] adopted and managed by the team. [753:09] And DevOps enables better software [753:10] development and delivery practices [753:12] because it's going to fix or solve the [753:15] bottleneck caused by the operations in [753:16] Agile. [753:17] And it accelerates the last mile of [753:19] continuous delivery. [753:22] So, that means DevOps did not cancel [753:24] Agile. However, it extended Agile beyond [753:27] dev into the deployment, infrastructure, [753:29] operation, monitoring, and maintenance. [753:33] And it brought automation, [753:34] collaboration, and shared responsibility [753:36] across the entire software life cycle or [753:39] SDLC, not only until the coding and [753:42] testing is done as Agile did. [753:45] Goals and benefits of DevOps. [753:48] Faster software delivery. [753:50] An improved collaboration between teams, [753:52] more reliable releases, so more [753:55] automation. [753:56] And automated testing, deployment, and [753:58] monitoring. That's the way we can have [754:01] better quality, better scalability and [754:03] performance, and [754:06] it will promote the collaboration among [754:08] the different teams involved in the [754:09] software delivery process. So, let's [754:11] look at the areas or practices that are [754:15] now considered under DevOps. [754:18] First one is continuous integration. [754:20] Every time the developers are going to [754:22] make changes to the code, they will [754:23] commit that code in a repository, GitHub [754:25] for example, [754:27] and that is going to automatically [754:29] trigger the build and test. So, every [754:32] time there are changes, build and test [754:33] is going to be run automatically, and [754:36] then we get into the continuous [754:37] delivery, which is once build and test [754:40] are done and feedback is done, [754:43] iterations have been taken care of and [754:44] no errors now, then software will be [754:47] ready for release into production. [754:50] Also, infrastructure as code, which is [754:53] scripting the configurations, all the [754:55] infrastructures that you build, the [754:57] resources that you need in [754:59] Terraform, for example, scripts or uh [755:01] Python scripts or maybe CloudFormation [755:03] scripts and so on. [755:07] Then we have automated testing to have [755:09] less errors and faster testing [755:11] processes. And then configuration [755:13] management, which is all about [755:14] centralizing and standardizing how the [755:17] software and the applications are being [755:19] configured and set up after they are [755:21] deployed. [755:26] Now, let's look at the first two [755:28] practices that we have looked at, the [755:29] continuous integration and the [755:31] continuous delivery, and we'll add to [755:32] that also the continuous deployment. [755:37] Taking a step back, CI/CD is all about [755:39] continuous integration, continuous [755:40] delivery, and continuous deployment. [755:42] And these are software development [755:44] practices in DevOps that are aimed at [755:47] automating software development [755:48] end-to-end, including the marriage [755:50] between the dev development and [755:52] operations. [755:54] This will yield better software, better [755:56] higher quality, faster releases, and [755:59] better user experience as well. [756:01] Let's look at CI. [756:04] So, CI or continuous continuous [756:06] integration refers [756:09] to the DevOps practice that is going to [756:12] trigger automatically a workflow [756:15] each time developers are going to commit [756:17] code changes. [756:19] So, developers, every time they commit [756:21] code changes, so they make changes and [756:23] they upload them or push them into [756:25] GitHub, [756:27] that is going to trigger the CI tools to [756:30] build and test. [756:32] And that is going to be the continuous [756:34] integration. So, automatically [756:36] triggering the build and test process [756:38] and the iterations and feedback until [756:41] the software is ready for release [756:43] in a staging the environment, this is [756:46] what CI is. [756:52] Now, let's look at the other part of [756:53] CI/CD, which is continuous delivery and [756:56] continuous deployment. Both are CD. [756:59] So, this is CI. [757:03] Continuous delivery means [757:05] then once the release, the software is [757:07] ready for release, ready to go in [757:08] production, there will be a manual [757:10] process, manual approval, manual [757:12] scheduling, and then it will go into [757:15] production deployment. [757:18] So, code changes [757:20] to a staging, testing, or production [757:21] environment after the code build step, [757:24] but with a manual approval, with a [757:25] manual process. [757:27] So, this is dependent on the team's [757:29] plans and decisions for release time, [757:31] changes need to be released. [757:35] In continuous deployment, changes that [757:37] pass all the CI, the build and test [757:40] steps [757:41] are deployed automatically without human [757:43] intervention. [757:45] And of course, because there is no human [757:47] intervention, [757:48] this is going to be risky, and that's [757:50] why it's not commonly used, not in the [757:52] critical applications at least. What is [757:54] more common is CI, continuous [757:56] integration, and continuous delivery, [757:59] releasing and making sure that it's [758:01] available, and once it is reviewed or [758:03] approved, then it will be deployed. [758:08] Uh question that I get frequently is, do [758:10] I have to be a developer, a full-stack, [758:13] a back-end, front-end developer in order [758:15] to be able to get in DevOps? And because [758:18] this is very important and it causes a [758:20] lot of confusion, I decided that let's [758:22] go ahead and discuss it in a video. [758:26] So, do you have to be a developer or a [758:28] programmer to work as DevOps engineer? [758:30] The short answer is no, you don't have [758:32] to. [758:33] But let's explain the two schools of [758:36] thought and the reason why there is a [758:38] lot of DevOps engineer jobs that will [758:41] expect you to be a developer. So, based [758:43] on the company, and it differs from [758:45] company to company and project to [758:46] project, the two schools of thought are [758:49] one expects you as a DevOps engineer to [758:52] be a professional developer, so you have [758:53] been a developer and then you got into [758:55] DevOps. [758:56] And the other one would say, we only [758:58] need you to have the fundamentals of [759:01] programming. [759:02] So, you have the logic, you know the [759:04] data types and data structures, and also [759:06] you can do scripting and you can do file [759:09] operations, like simple stuff using [759:12] code. And of course, Python would be the [759:14] easiest to learn in that case. [759:16] So, the short answer is you don't have [759:17] to be a full-stack developer or a [759:20] back-end developer, but you must know [759:23] the fundamentals of programming. [759:25] You must know how to write Terraform [759:28] scripts, bash scripting, [759:31] and you need to know [759:33] at least Python at the basic level. [759:38] Why do you need to have these [759:39] fundamental development or coding [759:42] skills? [759:43] Because you need it, you are going to [759:45] sit in meetings with developers. So, you [759:47] need to understand their lingo, what [759:49] they talk about. Also, you are going to [759:51] write automation scripts, whether it is [759:54] um bash scripts, infrastructure as code, [759:57] configuration management, or automation [760:00] through Python, all of these are going [760:02] to be scripting that you're going to [760:04] scripting skills that you will need. [760:07] And also, you may write scripts using [760:09] SDKs, Python is one of them. So, you can [760:12] deal with AWS and you can deal with [760:14] different infrastructures through [760:16] programs that you write in Python. Very [760:18] simple, this is not like when you need [760:19] to learn everything about Python and [760:21] become an expert. I'm talking about a [760:23] 6-to-10-hours course that will give you [760:25] all the required skills. So, don't freak [760:27] out [760:28] and don't leave potential and and shiny [760:32] careers just because you don't want or [760:35] you are scared to learn. [760:38] Also, for monitoring and alerting [760:40] scripts, you will need that as well. [760:43] And the recommended coding skills that [760:44] you need to have for DevOps, Python or [760:47] Go, Python has I think won the the deal, [760:49] so now it's Python and Python. [760:51] Bash or PowerShell, I would go with Bash [760:53] because most of the servers you are [760:56] going to deal with in the modern IT are [760:58] going to be Linux, and Terraform for [761:00] infrastructure as code, and Ansible for [761:02] configuration management. These will be [761:04] the ones that you need to learn. [761:08] As DevOps evolved, we found out there is [761:12] some area that has been overlooked by [761:14] DevOps, and that is once the software is [761:18] released and deployed. [761:20] Who looks after the reliability, the [761:22] performance, the availability, the [761:24] uptime, the capacity planning of the [761:26] infrastructure for the deployed releases [761:29] and the ones that are coming up? [761:31] Who's going to deal with incident [761:34] management? This is not DevOps. Who's [761:35] going to be [761:37] awake at 3:00 in the morning when there [761:39] is a problem trying to fix issues? [761:41] That is not DevOps. [761:44] So, DevOps overlooked these areas, and [761:45] that's why the evolution by Google for [761:48] the site reliability engineering emerged [761:51] or surfaced, and it has been out for [761:53] quite some time now, and it's gaining [761:55] more popularity. [761:57] Because it looks at the entire thing as [762:00] a system that needs to be reliable, [762:03] and it focuses on uptime, and it focuses [762:05] on a lot of other things. So, let's [762:07] contrast SRE to DevOps and see what are [762:10] the difference between them. [762:12] So, DevOps focuses more on the speed [762:16] than on the stability and reliability of [762:18] releases. So, we need to make sure that [762:20] they don't have bugs, there are no [762:21] errors, [762:22] and they will be released more [762:23] frequently. But once deployed, maybe [762:25] they will be performing, maybe they will [762:27] not be performing as expected. So, who [762:29] looks after that? Not DevOps. [762:31] DevOps does not define a role that [762:33] focuses on the overall reliability of [762:35] the deployed systems or applications. [762:39] SRE will fill this gap. So, SRE will [762:43] mainly look at the reliability and the [762:46] performance and the uptime of releases [762:49] and applications after DevOps. [762:54] So, what would a site reliability [762:56] engineer [762:58] focus on? [762:59] Incident response [763:01] and reliability metrics, uh so they will [763:04] have a lot of tools, logging tools, [763:06] monitoring tools that will look at [763:08] service level indicators, SLIs, service [763:11] level objective as well, as error [763:15] budgets. [763:16] So, that's their focus. [763:18] Root cause analysis, when a problem [763:20] happens, finding out what happened and [763:23] why it happened is also what the SRE [763:26] should do. [763:28] So, this is the one that will be [763:29] notified at 3:00 in the morning to wake [763:31] up and see what the problem is and fix [763:33] problems and all that. [763:35] And this is usually a team, not an [763:37] individual. [763:40] If we contrast DevOps and SRE, [763:44] the focus of SRE is reliability and [763:46] uptime and performance. [763:48] Whereas [763:49] the DevOps is the faster delivery of [763:51] software and the frequent release. [763:55] SRE will be more into the operation [763:57] side, incident response, monitoring and [764:00] alerting and capacity planning for the [764:02] infrastructure. [764:03] Whereas DevOps will focus on CI/CD, [764:06] release automation, automating the [764:08] process, environment builds to deploy [764:11] the software on, and code configuration [764:13] management as well as infrastructure as [764:15] code. [764:16] So, SRE and DevOps are different. Skills [764:20] are different. However, the core skills [764:21] are the same. [764:23] You can't expect the SRE to go ahead and [764:25] fix a problem in a Kubernetes cluster [764:27] that is faulty without knowing [764:29] Kubernetes. [764:31] And you don't expect them as well that [764:33] they are going to work or troubleshoot [764:34] something in the cloud if they don't [764:36] know the cloud. [764:37] They would go into systems and find out [764:39] why it happened and look at logs. So, [764:41] they have to know about logging [764:43] solutions. They have to know about [764:44] Linux. They have to know about Bash. [764:47] So, they have to know about a lot of [764:48] things or the common skills are the [764:50] same. However, when it comes to [764:51] monitoring, uptime, capacity planning, [764:53] and so on, these are specialized tools [764:56] that are used by SREs more than DevOps. [765:00] DevOps is going to focus on tooling or [765:02] tools and pipelines that help developers [765:06] in the software development life cycle [765:08] to build, test, and deploy code quickly [765:10] and automatically with less errors and [765:12] high quality. [765:13] Whereas [765:14] SREs will focus on keeping the systems [765:17] reliable, the applications deployed, the [765:19] software deployed, [765:20] and make sure that it is scalable and [765:22] available in terms of uptime. [765:24] So, they are going to use software [765:26] engineering and tools in order to [765:28] monitor these criteria or metrics and [765:30] make sure they are up to expectations. [765:35] DevOps will include CI/CD, [765:36] infrastructure as code, configuration [765:38] management, automated testing, and [765:39] monitoring [765:41] to an extent, not the full-fledged [765:43] monitoring like SRE. [765:45] Whereas SRE will include things like the [765:47] error budgets, service level indicators, [765:50] service level objectives that will be [765:52] the focus of SREs. [765:55] So, SRE is a way to implement DevOps, [765:57] especially in large-scale complex [765:59] systems. So, can there be a DevOps team [766:02] and an SRE team? Absolutely. They can [766:05] coexist because the focus is different. [766:08] DevOps is going to take care of [766:09] everything until deployment. SRE is [766:12] going to take over from that point and [766:13] make sure that it is reliable and up and [766:17] running without any issues and up to the [766:19] performance expectations. [766:23] Here is a real-world example that shows [766:25] how can DevOps and SRE work together. [766:29] So, if we have a company like Google or [766:30] Netflix, for example, the DevOps [766:32] platform team or the DevOps team is [766:34] going to maintain Kubernetes clusters, [766:36] build CI/CD workflows, support thousands [766:39] of the developers with the right tools [766:41] to automate the process. [766:44] The SRE team for a specific service or [766:46] the entire infrastructure, the [766:48] applications will ensure that the uptime [766:51] meets the expected percentage, 99.99, [766:54] for example. [766:56] It will handle global traffic. If there [766:58] is any issues or bottlenecks, they will [767:01] figure it out and fix it. And it will [767:03] make sure that they also deployed [767:05] infrastructure or applications, they [767:06] will scale on demand. And even if there [767:10] is high traffic, it will still keep the [767:12] performance expectations. [767:15] So, this is DevOps and SRE. So, they are [767:17] complementary and they are not mutually [767:18] exclusive. It's not that you have SRE, [767:21] so you don't need DevOps, or you have [767:22] DevOps, so you don't need SRE. You need [767:23] both. Or [767:25] in some companies, smaller companies [767:26] specifically, the DevOps person or the [767:29] DevOps engineer is now requested to also [767:31] deal with the uptime and the logging and [767:34] the monitoring and all that as an [767:36] SRE/DevOps. [767:39] This is all good, but as we scale, we [767:41] have problems. So, that's caused the [767:43] emergence of what we call platform [767:45] engineering that we are going to [767:47] introduce next. [767:50] A new concept that is evolving and being [767:54] adopted right now is platform [767:55] engineering. For the past couple of [767:57] years, it has been a hot topic. And the [768:00] reason why it evolved is because we have [768:03] faced issues scaling DevOps. [768:06] And also ensuring governance and [768:08] standard standardization as we scale [768:10] DevOps was an issue as well. [768:12] So, let's understand the issue. I know [768:14] maybe this will sound or will feel like [768:16] above your head at this stage at the [768:19] fundamentals, but you can always come [768:21] back and reference this lecture when you [768:23] hear the term platform engineer to [768:25] understand what it is. [768:26] It's It might not be relevant right now. [768:28] Maybe it's 6 months, 9 months down the [768:31] road in your career, but come back and [768:34] watch the video again if you feel it's [768:37] an overwhelm at the moment. [768:40] So, what are the issues with DevOps? [768:43] Two things. Number one, DevOps teams are [768:46] getting overwhelmed. [768:48] They have so many tasks they have to [768:50] worry about, including building and [768:52] running the infrastructure, [768:54] running Kubernetes clusters, CI/CD [768:56] pipelines, infrastructure as code [768:58] scripts and deployment, security, as [769:01] well as monitoring to an extent. [769:03] And this is not limited to one tool in [769:06] each one of these categories, but it [769:08] could be multiple skills, multiple [769:11] clouds, multiple tools that they need to [769:14] work on based on the requirements from [769:16] the dev team. [769:17] And of course, that is overwhelming. [769:19] That's the the first issue with DevOps. [769:22] Since they are getting overwhelmed, they [769:25] are becoming a bottleneck. So, they are [769:26] slowing down processes. They are slowing [769:29] down development teams because they [769:31] can't cater or scale to the requests and [769:35] requirements and the skills they need to [769:37] learn at the same time. So, now the [769:39] developers or development teams are [769:41] being held back because of DevOps. [769:45] And this is kind of contradict the main [769:48] purpose of DevOps, which was to speed up [769:52] and ensure faster delivery and so on. [769:56] That's issue number one. [769:57] Issue number two is as we scale DevOps, [770:01] one of the solutions would be, since [770:04] DevOps engineers are overwhelmed, let's [770:06] not centralize that in one team. Let's [770:08] have DevOps engineers in different [770:10] projects with the different development [770:12] teams. So, have application one, for [770:14] example, has a group of developers, and [770:17] let's say they need to use a set of [770:19] tools, then let's get a DevOps engineer [770:21] or two that they work work with them and [770:23] they are proficient in these tools. [770:26] App two, another tech stack, [770:28] let's get them [770:31] one or two DevOps engineers that can [770:33] cater to these skills. [770:34] App three team, also get them one or two [770:37] DevOps engineers for their tech stack. [770:39] But this be this becomes [770:41] an issue because [770:43] there is no consistency in the [770:45] technology and tools used across the [770:48] different teams. [770:50] And there is no standardization in terms [770:52] of security or even governance. We [770:54] cannot have a policy that will be across [770:56] because we have different teams working [770:58] with different tools with different [770:59] requirements. [771:00] And we can't keep up on how the DevOps [771:03] engineers are setting these tools. They [771:05] could be secure, they could be not [771:07] secure, they could be following best [771:08] practices and maybe not. [771:11] Of course, this will be an extra cost to [771:13] the to the organization. [771:15] The scripts and the stuff they would be [771:17] using, since they use different tech [771:18] stacks, the reuse is going to be [771:20] minimal. [771:22] And it will be harder to troubleshoot. I [771:24] cannot even move DevOps engineers now [771:26] between the different projects because [771:28] they are proficient in what they do, but [771:31] they don't know what's happening across [771:32] in the in the other team or in the third [771:34] team. [771:35] So, because of these two issues in [771:38] scaling DevOps, [771:40] platform engineering emerged as a [771:42] solution to this. [771:43] And basically, what platform engineering [771:46] is all about is why do we have to have [771:49] developers wait for DevOps engineers to [771:52] do stuff for them. [771:54] Why don't we build [771:56] the platform that can do all the [771:59] automation they need? They can build [772:00] repositories in GitHub. It can build [772:02] pipelines. It can do uh infrastructure [772:05] in the cloud. It will have all [772:08] everything they need, and they can do it [772:10] in a self-service fashion. [772:12] So, basically, they log into that [772:14] platform, they click, and then a repo is [772:16] created. They click again, and then a [772:18] Kubernetes cluster is deployed. They [772:20] click third time, and there is a CI/CD [772:22] pipeline. [772:24] So, platform engineering is a discipline [772:26] of designing and building tool chains [772:28] and workflows that enable self-service. [772:30] That is the bottom line. [772:33] So, this is for software engineering [772:35] organizations in the cloud-native era. [772:37] That's what we need. [772:39] So, the whole purpose is to build [772:41] something called the internal [772:42] development platform. [772:45] That internal development platform, it [772:47] will integrate or it will have all the [772:49] tool sets that are required. So, for [772:52] example, Kubernetes, OpenShift, Docker, [772:54] Terraform, Jenkins, GitLab, Pulumi, Git [772:57] and GitHub, GitHub Actions, Python. All [773:00] the tools and the integration with the [773:02] cloud environment is going to be [773:04] ready-made. [773:05] And then there is a portal where the [773:08] users or the developers can log in, and [773:10] then they can select, "Okay, here is [773:12] what I need." They will tick a box for [773:14] CI/CD pipeline. They will tick a box for [773:17] uh AWS Azure Kubernetes cluster. They [773:19] will tick a box for a GitHub repository. [773:22] They will tick a box that I need [773:24] monitoring using this tool. And it will [773:26] be all done in the background for them [773:28] without them having to wait for anyone [773:30] to do it. [773:32] That's what it is about and now the [773:34] development teams, they can self-service [773:36] their requirements and they don't have [773:37] to wait for anyone. That's the core of [773:39] platform platform engineering. [773:42] So the internal developed platform is a [773:44] self-service system that allows [773:45] developers to do the following. [773:47] Deploy code without worrying about [773:49] infrastructure. In the infrastructure [773:51] will be taken care of which used to be [773:53] done by the DevOps engineers. [773:55] Monitor their apps with minimal setup [773:58] and run tests, stage environments or [774:00] rollbacks easily. So they are doing the [774:02] build and tests and stuff like that. [774:04] Launch new services using templates and [774:06] the ones who are going to build this [774:08] platform, the platform engineering team [774:10] is going to be proficient about these [774:13] tools, the security requirements, the [774:14] company policy and all that stuff. So [774:16] they will set this properly such that [774:19] the users of the platform which are the [774:21] development team can work on that. [774:25] So the platform engineer role is to [774:27] build and maintain a reusable IDP [774:30] including tools and system that will [774:33] make it easier for developers and [774:35] operation teams to build, test, deploy [774:37] and run applications efficiently without [774:40] having to wait for a human DevOps [774:42] engineer to build stuff for them which [774:45] might be a bottleneck. [774:47] Platform engineering involves setting up [774:49] cloud infrastructure. So everything that [774:51] used to be done by the DevOps engineer. [774:54] DevOps tools, operating systems, [774:56] database servers, containers, [774:58] Kubernetes orchestration tools according [775:01] to best practices. [775:04] Let's look at a real-world example. How [775:07] the platform engineer play with DevOps [775:11] and SRE. How in a big corporate. Of [775:13] course, when you talk about platform [775:15] engineering, we're talking about big [775:16] corporates. We're not talking about a [775:18] startup that has few people. [775:21] However, in the job market, you might [775:23] find platform engineering required for a [775:26] smaller company. Basically, what they [775:28] expect is they expect everything. [775:31] They would expect it to know the DevOps, [775:33] to know the SRE part and to know also [775:35] the platform engineering part. [775:39] So a company wants to deploy 100 [775:40] microservices in Kubernetes. [775:43] So the platform engineer, what they will [775:44] do is they will build a self-service [775:46] portal where developers click a button [775:48] to get the following. [775:50] A repository, [775:52] a working CI/CD pipeline, a deployment [775:55] target which could be the Kubernetes [775:56] cluster for example. [775:58] With built-in monitoring, logging and [776:00] alerting hooks. [776:02] And this will make the deployment feel [776:05] easy to the developers. [776:07] The DevOps team will set up Argo CD [776:09] which is required for GitOps, Helm [776:11] charts and CI/CD pipelines. [776:14] A common question I get about this one [776:16] is, would platform engineering kill [776:18] DevOps? And the answer is no. They need [776:21] to do work even if they are part of the [776:23] platform engineer. The platform engineer [776:25] needs to know all these services [776:27] including CI/CD and how to set up the [776:29] tools and all that stuff. So the [776:30] platform engineering team will have [776:32] DevOps engineers within because they [776:34] need to be proficient in the different [776:36] DevOps tools. [776:37] So it could be shifting the jobs from a [776:40] DevOps engineer into platform [776:41] engineering team. [776:43] Or it could be that I'm going to have [776:45] DevOps engineers within the platform [776:46] engineering team to set up the DevOps [776:49] tools properly according to best [776:51] practices. [776:52] And maybe the development team are going [776:54] to have a DevOps engineer that will be [776:56] proficient in how to use the IDP, the [776:58] internal development platform and the [777:00] DevOps engineer will be working on that. [777:02] So the short answer is platform engineer [777:05] is not going to kill DevOps. It requires [777:08] the skills of DevOps engineers. [777:12] So this is what the platform engineer [777:14] does and this is what the DevOps [777:15] engineering will do and SRE will be [777:18] handling the monitoring, the uptime, the [777:20] SLIs, the SLOs and being on call and [777:23] handle capacity planning and so on. [777:28] Since you might end up being into [777:30] security and we discussed DevOps, then [777:34] it makes a lot of sense to look at how [777:36] we can secure your pipelines. How we can [777:39] secure it from the inception of the code [777:42] by the developers [777:43] all the way until it is deployed and [777:45] ensuring who has the access and [777:48] authorization to deal with these [777:50] applications. [777:52] DevSecOps is what looks after all of [777:54] this. So let's find out what that is and [777:56] there is a lot of people that are [777:58] interested in building cloud as cloud [778:00] security engineers and part of that is [778:03] going to be DevSecOps. [778:05] So DevSecOps stands for development plus [778:08] security plus operations. So we have Dev [778:10] and Ops and then we have Sec on top of [778:13] that. [778:15] So it means integrating security [778:17] practices and tools into every stage of [778:21] the DevOps pipeline. From planning and [778:23] coding all the way to deployment and [778:25] production monitoring. So in short, [778:28] DevSecOps is security of the DevOps [778:31] pipeline and the automation scripts and [778:33] everything you use in DevOps. [778:36] If you look at the different phases and [778:38] how DevOps is going to act in each one [778:41] of these, when you are doing the [778:42] planning for DevOps, you have to include [778:45] security requirements and threat [778:47] modeling in design discussions. [778:50] When coding, [778:51] we need to use static code analysis [778:53] tools, the SAST to catch vulnerabilities [778:56] very early. [778:58] And when you are building before [779:00] testing, building the application, [779:01] integrating the tool the software [779:03] together, then we need to scan [779:05] dependencies for known common [779:07] vulnerabilities and exploits or [779:09] vulnerabilities using tools like Snake, [779:12] Trivy and Dependabot. [779:15] And for CI/CD, of course, we need to [779:17] automate security tests in pipelines for [779:21] secret scanning, policy checks and so on [779:23] in the code. The short [779:25] or the summary of this is [779:27] you have to think security in every step [779:30] from the planning before the coding, [779:32] through the coding and during building [779:35] and when you are doing CI/CD testing as [779:37] well, that should all include security [779:40] tools [779:41] to scan to ensure that you don't have [779:43] backdoors in your code and you don't [779:45] have any vulnerabilities in your code [779:47] and so on. [779:48] Moreover, [779:49] when you are thinking about containers, [779:52] you have to scan container images for [779:54] vulnerabilities. You need to make sure [779:55] that they are clean as well. [779:57] When you are working on scripts [779:59] infrastructure as code, you can use [780:01] tools like Checkov and Terraform [780:03] Sentinel to ensure secure infrastructure [780:06] definitions and you don't have [780:08] credentials for example in your code. [780:10] For the secrets management, passwords [780:13] and so on, licenses, keys and stuff like [780:16] that, you need to use HashiCorp Vault [780:19] secrets manager in AWS or sealed secrets [780:22] tools where you can store these [780:25] credentials without having to embed them [780:27] in your code. [780:30] And for production monitoring, of [780:31] course, we need to look for security [780:33] events and misconfiguration or drifts [780:36] and there are tools to help you do that [780:38] like Falco, OSSEC and AWS GuardDuty etc. [780:42] So again, the message is think security [780:44] in in every action, in every step, in [780:46] every technology, every code, every [780:48] image you are using in your DevOps. [780:53] Congratulations on finishing up the [780:55] course. Hopefully, it was interesting [780:58] and you have done all that hands-on demo [781:01] labs and all the practice examples and [781:03] all that yourself in order to cement the [781:05] knowledge. [781:06] Again, if you would like to get more [781:08] knowledge and more depth into this [781:10] course, you you want to get more design [781:12] assignments, more practice, more [781:13] hands-on labs and also the IT tools [781:17] track line that will give you a 50,000 [781:19] ft view of what is Linux, what is Git, [781:23] what is GitHub, what's Docker, what's [781:25] Kubernetes, what's Bash scripting and [781:26] Terraform, what's Docker and Kubernetes, [781:29] this is going to be available on our [781:31] website and you will also support us [781:34] in creating more free content like this [781:37] one at this quality for you to enjoy and [781:41] for you to grow as well. This course can [781:44] The supplementary material can be found [781:46] at www.dolphinet.com/courses/ITF-course. [781:55] Thank you very much for watching and [781:57] looking forward to meeting you again in [781:59] future videos.