Cours 13 — Cloud Networking

---

1. AWS VPC

1.1 Composants VPC

Diagramme en cours de génération...

Sous-réseaux :

• Public : Route 0.0.0.0/0 → Internet Gateway
• Private : Route 0.0.0.0/0 → NAT Gateway
• Database : Pas de route Internet, accès via VPC endpoints

1.2 VPC Peering

Diagramme en cours de génération...

1.3 Transit Gateway

Diagramme en cours de génération...

1.4 PrivateLink (VPC Endpoint)

Diagramme en cours de génération...

1.5 NAT Gateway vs NAT Instance

1.6 VPC Flow Logs

aws ec2 create-flow-logs \
    --resource-type VPC \
    --resource-id vpc-12345678 \
    --traffic-type ALL \
    --log-destination-type cloud-watch-logs \
    --log-destination-arn arn:aws:logs:region:account:log-group:vpc-flow-logs

---

2. GCP VPC

2.1 Architecture

Diagramme en cours de génération...

Particularités GCP :

• VPC global (pas limité à une région)
• Subnets régionaux
• Routes implicites (default route, subnet routes)

2.2 Shared VPC

Diagramme en cours de génération...

2.3 Cloud NAT

# Créer un Cloud NAT
gcloud compute routers create nat-router \
    --network default \
    --region us-central1

gcloud compute routers nats create nat-config \
    --router=nat-router \
    --region=us-central1 \
    --nat-all-subnet-ip-ranges \
    --auto-allocate-nat-external-ips

2.4 Private Google Access

Permet aux instances sans IP publique d'accéder aux services Google (BigQuery, Cloud Storage, etc.) via l'adresse IP de découverte (199.192.0.0/16).

---

3. Azure VNet

3.1 Architecture

Diagramme en cours de génération...

3.2 VNet Peering

az network vnet peering create \
    --name vnet-a-to-b \
    --resource-group rg-a \
    --vnet-name vnet-a \
    --remote-vnet /subscriptions/.../vnet-b \
    --allow-vnet-access

az network vnet peering create \
    --name vnet-b-to-a \
    --resource-group rg-b \
    --vnet-name vnet-b \
    --remote-vnet /subscriptions/.../vnet-a \
    --allow-vnet-access

3.3 Azure Firewall

az network firewall create \
    --name azfw01 \
    --resource-group rg-network \
    --location francecentral

az network firewall policy create \
    --name policy01 \
    --resource-group rg-network

az network firewall policy rule-collection-group create \
    --name AppRules \
    --policy-name policy01 \
    --resource-group rg-network \
    --priority 100

3.4 Azure VPN Gateway

---

4. Hybrid Cloud

4.1 Architectures

Diagramme en cours de génération...

4.2 AWS Direct Connect

Diagramme en cours de génération...

4.3 Azure ExpressRoute

# Créer un circuit ExpressRoute
az network express-route create \
    --name er-circuit \
    --resource-group rg-network \
    --bandwidth 1000 Mbps \
    --provider Equinix \
    --peering-location Paris

# Connecter au VNet
az network express-route gateway create \
    --name er-gw \
    --resource-group rg-network \
    --min-val 1

4.4 VPN Site-to-Site

# AWS VPN CloudFormation
VPNConnection:
  Type: AWS::EC2::VPNConnection
  Properties:
    CustomerGatewayId: !Ref CustomerGateway
    TransitGatewayId: !Ref TransitGateway
    Type: ipsec.1
    StaticRoutesOnly: false

---

5. Multi-Cloud Networking

5.1 Stratégies

Diagramme en cours de génération...

Approches :

1. Interconnect cloud-to-cloud (AWS TGW ↔ GCP TGW)
2. VPN over Internet (IPsec entre clouds)
3. Third-party SD-WAN (Aviatrix, Alkira)
4. Service mesh global (Istio multi-cluster)

5.2 Multi-Cloud avec Aviatrix

# Aviatrix Transit Network
aviatrix_transit_gateway:
  cloud_type: 1  # AWS
  gw_name: aws-transit
  vpc_id: vpc-123
  gw_subnet: 10.0.0.0/24
  enable_hybrid_connection: true
  connected_transit: true

---

6. CDN (Content Delivery Network)

6.1 AWS CloudFront

CloudFront:
  Type: AWS::CloudFront::Distribution
  Properties:
    DistributionConfig:
      Enabled: true
      Origins:
        - Id: ALBOrigin
          DomainName: !GetAtt ALB.DNSName
          CustomOriginConfig:
            HTTPPort: 80
            OriginProtocolPolicy: https-only
      DefaultCacheBehavior:
        TargetOriginId: ALBOrigin
        ViewerProtocolPolicy: redirect-to-https
        AllowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
        CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
      PriceClass: PriceClass_All
      WebACLId: !Ref WebACL

6.2 Cloudflare

Diagramme en cours de génération...

6.3 Fastly

# Fastly VCL
sub vcl_recv {
    if (req.url.path ~ "^/api/") {
        set req.backend = F_api_backend;
        return (pass);
    }
    if (req.url.path ~ "^/static/") {
        set req.backend = F_static_backend;
        return (lookup);
    }
}

6.4 Comparatif CDN

---

Résumé

Diagramme en cours de génération...