Let's move into Operating and Maintaining Physical and Logical Cloud
Security in Part 2 ‑ Services. Just as we did with components,
we will enumerate major services that provide for physical and
logical security in the cloud, we're going to review the
configuration options of these systems, and then we'll demonstrate
use cases inside of the AWS Management Console.
The first system that we will discuss is the Virtual Extensible Local Area
Network, not to be confused with the VLAN. First, just as a brief recap, when
we're talking about a virtual local area network,
what we're saying is that we have a port‑by‑port basis of mapping to a MAC
address that can be made to something called a VLAN ID.
This is an assignment that allows the port to join particular Layer 3
subnetworks. In an unconfigured state, the switch reduces Layer 2 broadcasts
and communication collisions, but with a VLAN assignment,
it can also reduce Layer 3 broadcasts and can enhance the
performance, keeping like traffic flows together.
When we are talking about a Virtual Extensible Local Area Network,
there is a major function separation between that and a VLAN. The
first is you can theoretically create as many as 16 million VXLANs in
an administrative domain as opposed to 4096 VLANs. Also, there's
something called a VTEP,
a Virtual Extensible Local Area Network Tunnel End Point, that
allows you to run your virtual domains over a Layer 2 network on top
of Layer 3 with Mac and UDP encapsulation.
This allows for virtual machines to have
communications across local area networks.
In this use case, we have a physical data center that has its own physical
compute clusters that is hosting a hypervisor, and that hypervisor has the
capability of launching various virtual machines.
That data center is demarked by means of some kind of router configuration.
When you have a VXLAN,
you can then create a VXLAN Tunnel End Point, or
VTEP, between these two data centers.
This way, you could allow for something called live migration to
take place across the networks so that you could take a system
coming from Data Center 1 and move it over to Data Center 2 while
it's consuming services.
This capability is a major difference between a
simple VLAN and what the cloud uses, known as a VXLAN.