AWS Direct Connect

{{container layoutStyle="columns"}}(((

In this microlearning, we'll explore how to use AWS Direct Connect to establish a secure and direct connection between your network and your eMagiz environment, bypassing the public internet. AWS Direct Connect provides a reliable way to route traffic through a dedicated connection. This microlearning will guide you through the process of configuring DNS records to ensure that your network traffic flows through this direct connection, enhancing security and performance.

4

5

Should you have any questions, please contact [[academy@emagiz.com>>mailto:academy@emagiz.com]].

6

7

== 1. Prerequisites ==

8

9

* Advanced knowledge of the eMagiz platform

10

* Expert knowledge of AWS Infrastructure

11

12

== 2. Key concepts ==

13

14

This microlearning centers around how you can use AWS Direct Connect to connect to your eMagiz environment.

15

With the AWS Direct Connect, we mean: An option that gives the client the option to directly connect their network to eMagiz without data travelling over the internet

16

17

This microlearning will explain how traffic needs to be routed over the dedicated connection by adding DNS records to the corporate resolving servers.

18

The network architecture Below is a technical representation of the connectivity between the customer network and the AWS deployment of a eMagiz Platform Instance of the customer.

19

20

[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--connectivity-direct-connect-emagiz.png]]

21

22

== 3. AWS Direct Connect ==

23

24

This microlearning will explain how traffic needs to be routed over the dedicated connection by adding DNS records to the corporate resolving servers.

25

The network architecture Below is a technical representation of the connectivity between the customer network and the AWS deployment of a eMagiz Platform Instance of the customer.

26

27

[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--connectivity-direct-connect-emagiz.png]]

28

29

An eMagiz platfom instance is reachable via the internet via DNS records with below format:

30

amqp01.cloud<number>.emagizcloud.com (The primary node)

31

amqp01b1.cloud<number>.emagizcloud.com (The backup node)

32

33

=== 3.1 Force eMagiz traffic over the Direct Connect ===

34

35

To force traffic from the customers network to the bus over a Direct Connect connection a change to the corporate DNS service needs to be done by adding overrides to the bus DNS records.

36

In the infrastructure drawing the Direct Connect VPC is an extension of the customer network. It contains IP numbering matching the customers network IP plan.

37

38

From the received allocation two subnets are configured in separate AWS Availability Zones (datacenters). Within these subnets two endpoints are setup so the bus can be reached via the internal network. These “Service Endpoints” can be resolved via a DNS record with the following format: vpce-<unique_id>.vpce-svc-08a0a27ad9d7b60d8.eu-central-1.vpce.amazonaws.com

39

40

The private addresses which are resolved by above endpoint need to be added to the internal DNS servers as overrides so traffic to the public eMagiz Platform Instance DNS names are resolved to the internal IP addresses.

41

42

* An example of above change implemented in BIND can be followed in below blog posting: {{code}}https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html{{/code}}

43

* Comparable solutions exist for Microsoft DNS servers: {{code}}https://blog.simonw.se/override-a-single-external-hostname-with-internal-dns-entry/{{/code}}

44

45

=== 3.2 Example implementation with BIND ===

46

47

An example customer has cloudslot123 and service endpoint vpce-01234567890123456-io3z36gk allocated to their private endpoint over Direct Connect. A DNS lookup before the change results connecting to the public internet endpoint of the eMagiz Platform Instance:

48

49

[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--dns-public-internet.png]]

50

51

Creating a RPZ zone in the “company.com” dns servers:

52

53

[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--creating-a-rpz-zone.png]]

54

55

After the change a DNS lookup to the bus results in answers over the Direct Connect (172.20.3.20 and 172.20.4.22):

56

57

[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--change-dns-lookup.png]]

58

59

== 4. Key takeaways ==

60

61

* AWS Direct Connect acts as an extension of the customer network

62

* Ensure that the DNS lookup is changed to look for internal IP addresses in stead of public ones.

63

64

== 5. Suggested Additional Readings ==

65

66

If you are interested in this topic and want more information on it please read the following:

67

68

* [[Example Implementation #1 (External)>>https://blog.simonw.se/override-a-single-external-hostname-with-internal-dns-entry/||target="blank"]]

69

* [[Example Implementation #2 (External)>>https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html||target="blank"]]

70

* [[AWS (Search Result)>>url:https://docs.emagiz.com/bin/view/Main/Search?sort=score&sortOrder=desc&highlight=true&facet=true&r=1&f_space_facet=0%2FMain.&f_type=DOCUMENT&f_locale=en&f_locale=&f_locale=en&text=aws||target="blank"]]

71

72

)))((({{toc/}}))){{/container}}

73

Wiki source code of AWS Direct Connect

Navigation

author	version	line-number	content
		1	{{container}}
		2	{{container layoutStyle="columns"}}(((
		3	In this microlearning, we'll explore how to use AWS Direct Connect to establish a secure and direct connection between your network and your eMagiz environment, bypassing the public internet. AWS Direct Connect provides a reliable way to route traffic through a dedicated connection. This microlearning will guide you through the process of configuring DNS records to ensure that your network traffic flows through this direct connection, enhancing security and performance.
		4
		5	Should you have any questions, please contact [[academy@emagiz.com>>mailto:academy@emagiz.com]].
		6
		7	== 1. Prerequisites ==
		8
		9	* Advanced knowledge of the eMagiz platform
		10	* Expert knowledge of AWS Infrastructure
		11
		12	== 2. Key concepts ==
		13
		14	This microlearning centers around how you can use AWS Direct Connect to connect to your eMagiz environment.
		15	With the AWS Direct Connect, we mean: An option that gives the client the option to directly connect their network to eMagiz without data travelling over the internet
		16
		17	This microlearning will explain how traffic needs to be routed over the dedicated connection by adding DNS records to the corporate resolving servers.
		18	The network architecture Below is a technical representation of the connectivity between the customer network and the AWS deployment of a eMagiz Platform Instance of the customer.
		19
		20	[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--connectivity-direct-connect-emagiz.png]]
		21
		22	== 3. AWS Direct Connect ==
		23
		24	This microlearning will explain how traffic needs to be routed over the dedicated connection by adding DNS records to the corporate resolving servers.
		25	The network architecture Below is a technical representation of the connectivity between the customer network and the AWS deployment of a eMagiz Platform Instance of the customer.
		26
		27	[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--connectivity-direct-connect-emagiz.png]]
		28
		29	An eMagiz platfom instance is reachable via the internet via DNS records with below format:
		30	amqp01.cloud<number>.emagizcloud.com (The primary node)
		31	amqp01b1.cloud<number>.emagizcloud.com (The backup node)
		32
		33	=== 3.1 Force eMagiz traffic over the Direct Connect ===
		34
		35	To force traffic from the customers network to the bus over a Direct Connect connection a change to the corporate DNS service needs to be done by adding overrides to the bus DNS records.
		36	In the infrastructure drawing the Direct Connect VPC is an extension of the customer network. It contains IP numbering matching the customers network IP plan.
		37
		38	From the received allocation two subnets are configured in separate AWS Availability Zones (datacenters). Within these subnets two endpoints are setup so the bus can be reached via the internal network. These “Service Endpoints” can be resolved via a DNS record with the following format: vpce-<unique_id>.vpce-svc-08a0a27ad9d7b60d8.eu-central-1.vpce.amazonaws.com
		39
		40	The private addresses which are resolved by above endpoint need to be added to the internal DNS servers as overrides so traffic to the public eMagiz Platform Instance DNS names are resolved to the internal IP addresses.
		41
		42	* An example of above change implemented in BIND can be followed in below blog posting: {{code}}https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html{{/code}}
		43	* Comparable solutions exist for Microsoft DNS servers: {{code}}https://blog.simonw.se/override-a-single-external-hostname-with-internal-dns-entry/{{/code}}
		44
		45	=== 3.2 Example implementation with BIND ===
		46
		47	An example customer has cloudslot123 and service endpoint vpce-01234567890123456-io3z36gk allocated to their private endpoint over Direct Connect. A DNS lookup before the change results connecting to the public internet endpoint of the eMagiz Platform Instance:
		48
		49	[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--dns-public-internet.png]]
		50
		51	Creating a RPZ zone in the “company.com” dns servers:
		52
		53	[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--creating-a-rpz-zone.png]]
		54
		55	After the change a DNS lookup to the bus results in answers over the Direct Connect (172.20.3.20 and 172.20.4.22):
		56
		57	[[image:Main.Images.Microlearning.WebHome@expert-solution-architecture-aws-direct-connect--change-dns-lookup.png]]
		58
		59	== 4. Key takeaways ==
		60
		61	* AWS Direct Connect acts as an extension of the customer network
		62	* Ensure that the DNS lookup is changed to look for internal IP addresses in stead of public ones.
		63
		64	== 5. Suggested Additional Readings ==
		65
		66	If you are interested in this topic and want more information on it please read the following:
		67
		68	* [[Example Implementation #1 (External)>>https://blog.simonw.se/override-a-single-external-hostname-with-internal-dns-entry/\|\|target="blank"]]
		69	* [[Example Implementation #2 (External)>>https://www.redpill-linpro.com/sysadvent/2015/12/08/dns-rpz.html\|\|target="blank"]]
		70	* [[AWS (Search Result)>>url:https://docs.emagiz.com/bin/view/Main/Search?sort=score&sortOrder=desc&highlight=true&facet=true&r=1&f_space_facet=0%2FMain.&f_type=DOCUMENT&f_locale=en&f_locale=&f_locale=en&text=aws\|\|target="blank"]]
		71
		72	)))((({{toc/}}))){{/container}}
		73	{{/container}}