Networking: VPC, SLB, DNS, CDN
Core concepts
A VPC is an isolated virtual network with a CIDR block, subdivided into vSwitches (subnets) bound to a single zone. Route tables direct traffic; NAT Gateway gives private instances outbound internet without inbound exposure; EIP provides a public IP. VPC peering and Cloud Enterprise Network (CEN) connect VPCs; peering is non-transitive, CEN provides transitive routing.
SLB offers Layer 4 (TCP/UDP) and Layer 7 (HTTP/HTTPS) listeners with health checks and backend server groups. Alibaba Cloud DNS resolves public and private names; PrivateZone handles internal resolution. CDN caches static content at edge nodes, reducing origin load and latency.
Traps in questions
- vSwitch is zone-bound: a subnet cannot span zones; multi-zone design needs multiple vSwitches.
- NAT vs. EIP: NAT is for outbound-only access from many instances; EIP is a one-to-one public address.
- Peering is non-transitive: A–B and B–C does not give A–C; use CEN or a transit design.
- SLB health checks: an unhealthy backend is removed from rotation; the SLB itself does not fix the instance.
- CDN cache invalidation: dynamic or user-specific content should bypass caching; TTL and refresh rules control staleness.
Rule of thumb
Private-by-default: put instances in private vSwitches, expose only the SLB, and use NAT Gateway for egress. Add CDN only for cacheable content.
Worked example
Web servers in two zones must serve internet users without public IPs. Place them behind an SLB in public subnets, keep instances in private subnets, and route egress through a NAT Gateway. Directly assigning EIPs to each instance exposes them and increases attack surface.