Networking (VPC, SLB, CEN)
Core concepts
A Virtual Private Cloud (VPC) is an isolated network with a CIDR block you choose. Inside it you define vSwitches (subnets) bound to a single zone each. Instances in different zones need vSwitches in each zone. Route tables direct traffic; the system route table handles local traffic.
Security Groups filter instance traffic (stateful, allow-only). NAT Gateway gives private instances outbound internet without inbound exposure; EIP gives a public IP to a specific resource. Internet Gateway handles public-facing traffic for the VPC.
Server Load Balancer (SLB) distributes traffic across backends. Know the types: CLB (classic, layer 4/7), ALB (application, advanced routing), and NLB (network, ultra-high performance). Health checks remove unhealthy backends.
Cloud Enterprise Network (CEN) connects VPCs and on-premises networks across regions with a hub-and-spoke or mesh topology, replacing full-mesh VPC peering at scale. VPN Gateway and Express Connect handle hybrid connectivity.
Traps
- VPC peering is not transitive; CEN solves multi-VPC connectivity.
- A vSwitch is zone-scoped; you cannot span zones with one vSwitch.
- SLB health checks must target the correct port/protocol or all backends appear unhealthy.
Worked example
Three VPCs in different regions must communicate. Answer: attach all three to a CEN instance with a transit router, rather than chaining VPC peerings (which would not be transitive).