amazon vpc question

[#1]

1. What happens when we have a hub and spoke connection where multiple vpc’s are aggregated through a parent Amazon account. Does the infoblox proxy know how to call the right sub account?

[#2]

if you're talking about vdiscovery, this works through specific AWS IAM accounts and is rights based. As long as the vdiscovery member can access the service endpoint which is public then no problem. If we're talking about a CPA appliance, API proxied calls are network routed. once the API calls hit the target CPA appliance the grid takes over and is pure networking. The CPA appliance will also queue in the event there is a hicup or lapse in access to the GM.

Does this answer the question?

[#3]

To add to this- if spinning up an instance using API proxy (whether it be through your Grid Master or a CP (Cloud Platform) appliance, you would specify the VPC that the instance should be launched in. For vDiscovery, this is reported on during the vDiscovery process and is learned automatically so nothing is required in order for NIOS to learn this.

Thank you,

Tony Tiscareno

Infoblox

[#4]

I just set up a VPC, and need the VPC to access some internal servers through my Cisco 5510 ASA.

Is it best to use the config that Amazon supplies? Or is there a best practice to do this?

Did some Google searches, but I get a variety of answers.

[#5]

Is there any benefit of placing servers in their own subnets based on purpose? e.g. Web, App and Database servers.

I can't see why I can't just have 1 public subnet and 1 private subnert with all servers being in the private and traffic controlled by security groups. Maybe I'm over thinking when trying to put each server in it's own subnet.

[#6]

I need to know What is the relation between an AWS VPC subnet and a route table?

whether we have to use NAT instance or NAT gateways to instances launched in private subnet to access the internet for software updates.

black friday vpn deals 2020

[#7]

You can overthink it, but there are a few reasons why you will want more than 2. First, you can't span availability zones with a single subnet, so you need a private and a public subnet for each AZ. Second, it helps with isolation, which in turn limits your exposure. Your database servers might need to hear from and respond to application servers, but don't need to talk to the web servers, for example. This limits the blast radius in the event you have a server which is compromised. It can't affect boxes it can't route to.