Alone will come back.
So let's cover now the APCP.
Basically the reason being is when you need to connect to the.
Remember we said that the VPC is a virtual data center or a virtual containment of your services servers
and in databases inside us.
What if I have multiple PCs for instance a company could have at this PC development the PC and the
production VBC.
Right.
If there is a file between them that I need to share their files between them that I need to share what
can I do if they are completely separate then it always has a feature called VCP.
Basically you can have one or more subnets from VPC that need to communicate with one or more subnets
in the PC.
So they do peering between the two PCs and that peering.
And then you edit your security groups and security in order to allow these subnets on the on the PC
to talk to the subnets on the CPB.
The question I have is now can we have the PCs from the same account talk to each other.
Yes you can have the PC from account a.
So that's a completely like a separate company for corporate talk to the PC from a different corporate.
Yes.
Are there any conditions going to have the PCs in the same region to appear with each other.
Yes.
Can I have the PCs from different regions paired with each other.
No.
So the VBC pairing can only be done between the PCs in the same region that belong to the same or different
accounts.
And the VPC is a one to one.
The peering is one to one relationship so you cannot have them as you will see later on.
You cannot have VTC peer with another one.
And then the other one peer with the third one and then you assume that the first and third appeared
anywhere anyway.
This is just a quick introduction.
Let's dig into the details.
So here is how it looks like.
So I have here an example a VPC A and B PCB and I want to have this specific instance so it can be as
granular as one instance.
Talk to one instance or instance talk to subnet or Cybernetica subnet or multiple subnets talk to multiple
subnets.
So here I have when you see that there is an IP address and a slash 32 That means its a host address
with a single computer or a single server or a single PC or a single.
In our case is a single instance.
So its like 32 means a single instance to get a single IP address a host IP address.
So this instance would like to talk to this instance and also its a host on the other side.
Host IP address.
OK.
This one is secured on the submit.
This one is secured and the Submit can establish VBC being between VBC a and b to allow them to talk.
Yes there is one condition that has to be satisfied in order for the two to be able to communicate with
each other.
And the main one or the the
and the condition is decide that blocks from the PC and the center blocks from VPC they should not overlap.
So if you're trying to do that if you are even on the console and trying to configure it disappearing
between to the PCs where they have overlapping solder blocks it will not go through to not be accepted
and the connection will not be established.
There is to be another condition that the two PCs must be in a single region in the same region.
But this doesn't exist anymore as of November 2017 when it has allowed entire region.
So you can peer between two PCs one could be in Ohio and that could be and talk to you.
So that is allowed.
And the good news is the traffic in that case crosses the database backbone and doesn't go on the internet
between the BBC's entire region and it is encrypted as well.
So any company that would like to expand or have the PC peering traffic between TV PCs in two different
region is now supported.
Now can I just initiate from VPC a request to appear with the PCB and it so happens no.
The question from the site that someone has to initiate the request so let's say BBCA account owner
were issued the request to appear with the PCB the Ribisi owner will be notified and he has to accept
the request in order for the Pyrenean connection to happen between them.
So we disappearing is appearing connection is a networking connection between two PCs and it can do
for NITV sex on top of it.
Instance in an instance in either VBC can communicate with each other.
So once you allow it by security and you're routing and the disappearing connection is initiated from
one side and accept it from the other side and is up then you can do the communication between the incenses
on both sides.
You can create a VPN connection between your own devices or the in the same account or a PC from your
account with another account could be in the same region.
Or they could be in separate regions within it.
Maybe an example would be faced with a scenario that they will tell you you have it disappearing which
we see in the BCB and you want to make it fault tolerant.
What do you do.
So one of the choices might be do another week disappear.
You can't.
It's not allowed.
And this is as all the other E.W. are services it's a service provided by us.
We don't know the details of which but I assure you that this is faultline highly available and there
is no congestion or bottleneck.
So basically you can push as much traffic as you wish across and it will handle that.
And there is no single point of failure so you don't need to worry about establishing a second one.
This is your job to make sure that there is always a routing path between your two PCs in the same region.
So either use the existing infrastructure of a VPC to create the APCP.
What does it mean.
It means it's not a gateway.
They don't get to it.
They don't add any physical hardware and it's not a VPN connection between the PCs.
So what is it.
It's not your business.
It really takes care of that.
But they assure you that this is not an extra piece of hardware that they are adding or a gateway or
a VPN or anything in order to allow that.
So it uses the existing areas infrastructure.
The second thing is as I just mentioned it's not.
There is no single point of failure in the VPC and it can never be your bottleneck in terms of bandwidth
and performance.
What why would I use it.
For example use cases.
The first one is if you have files that you would like to share between multiple The PCs appear between
the PCs allow the subnets the routing from the side to that side and the other way around open the.
Adjust your security groups for the instances that need to communicate with each other to make sure
that they can communicate with one another and boom their request.
The other side will accept the request.
The BBC period comes up and you are ready to go.
And also you can use it to allow other PCs to access the resources you have in one of your VIPs.
So let's say for instance on E.W. as a company hosts just hypothetically saying that let's say a payment
gateway so basically a gateway that can process online online transactions credit cards or whatever.
And the other Ribisi is they like the service and they would like to put it to subscribe to it.
So they need to peer they payment servers or applications.
That Have there been activities they need to build these with the payment gateway servers that will
process that the transaction and then will send a confirmation back or a decline message.
So the transaction is carried on the site.
So that's one example where you will need to have resources in one we do that the other VCs are interested
in.
And they like to reach out to.
And you mentioned to establish with disappearing.
Then there is a request for the PC or local PC that they will initiate a request to the owner of the
other PC that I would like to appear with.
And we VBC the PC can be owned by you or can be owned by another account.
The very important thing to remember is that blocks the size of blocks cannot overlap and they cannot
be the same between the peering with PCs and the owner of the PC will accept the BBC connection and
activate the peering connection now after the connection is initiated the request is initiated and is
accepted and the connection is up.
You need to do two things you need to update your routing tables in either side on both sides in order
to make sure that BBCA can't access the Submit or the specific IP addresses on the PCB.
So what you need to get to in this case.
Now when we go to our table we right destination and then I have a target that I need to specify right.
So in the internet I used to say AGW and the VPN I use to say VZW.
How about in peering.
You have PC X and then the ID of the peering connection case of the VPC peering is acronym PCI-X and
then the ID of the specific connection.
And of course when you created you will find that new appearing connections under the VPC
method you mentioned them are easy to adjust the security groups in order to allow that.
One important thing you can do here then if you have the PC and the PCB and I have here an instance
with security grew sick b and here with security groups like a for instance or Sigsbee you can once
the peering is up you can hear different rules that the source is Security Group A and then allow all
the protocols you want.
So can a reference in the in-bound rules on the on the side that the source is the security group on
the other side.
Yes you can.
Now for my outbound you can specify the destination in a security group.
Yes you can.
You can now start referencing across the peering connection.
Security Groups as a source of information from either side.
One important thing to note about that.
So now in this case we have a peering a VPC being a connection between the PC and the PCC.
And also I have a different and connection between the PC and the PC game here is the PC ID PCX ID they
are different.
You need to know that the VBC building is a one to one relationship so basically ate with C and the
other one is a with B.
The second one.
And very very important thing to note here is if I have this set up can subnets from VBC communicate
with subnets from within B B given that they are both connected to the PPC and the traffic flow this
way the answer is no.
Why.
Because VBC peering does not allow what we call edge to edge routing.
So basically the PCB and a route exchanged between these two sides what ever I learn at a root from
B.
I will never exchange with C so C will never know that that is connected to B and A knows about B it
will never find out that because the prerequisite for C communicating with B is C has to know Rood's
about B and B has to know Root about C so it will never ever receive or know something about B and share
it with C in terms of routing or subnets or prefixes and vice versa.
The PCA will never share with the pc be what it learns about the PC C K.
So transitive feeling is not there or this is code also edge to edge routing so what I exchanged across
the VPC Pierian connection will never be shared with anyone else.
Even if C B here was paired with VPC the I cannot it cannot communicate with the through B.
So what if i want see and B to share some files directly.
Then you have to create another connection between them direct.
So you have to see them to exchange information.
Then they have to be a Darity that say we have a scenario like this one.
So I have a corporate data center or a headquarter connected to its own VBC VBC in this case.
Connected How to be through a VPN connection could be through a direct connection of two means to connect
from a remote location to repeat to your PC and in the various.
One is the VPN connection.
I'd be sick of connecting over the Internet or over the next and the other one is the high speed low
latency performance that the connection is good.
Now the PC ate my PC has appeared in connection with a different VPC in the same account or in a different
account.
Now I am concerned about that fault tolerant of this connection so I have this connection only and I
want to harden the set of the set up.
What do I do.
So one idea might be why don't you have a direct connection this way and this means if this connection
fails the the dissenter will route to a through B doesn't work.
Not really option why because it's true that the BCB will know root about vitiate but it will never
ever share it with the datacenter or headquarter through the connect or VPN.
It will never hear and this is called that the disappearing does not support edge to edge routing.
So here I have VPC as an edge sharing route with B but this age B will never share it with the third
one or the third Eduljee that isn't
to what I do in this case one might say if you want to harden the set up then you need to have a second
opinion connection here.
Again this is not a sport.
You cannot have two peering connections between the same two pieces at the same time.
And why is that.
Because it has promised that they have the period connection as a redundant faltering highly available
high performance bottleneck.
So what can I do in the set up if I want to harden.
All you need to harden is you need to harden the connection from the data center to VTC.
What if I need to communicate with the B C B then you need to establish that connection with the PCB.
Can I add any condition or at any cost route to a through B.
No.
Can I get it out to be through a.
No.
So all you need to be concerned about is the connection ribbon connection which you can make it's redundant
and that means you have a highly available fault alone.
In this case limitations of disappearing the connection between the PCs that have matching or overlapping
ID before Id resets.
So the Roeske is not supported and this is a simple display period.
Your software or your kernel if your IP is one that 1.1 that one and my IP on the other side is on that
one that one that one if you do a ping S-sh or anything here and your intent is to send it to one of
the two on that one.
What would force the kernel here to send it outside if they can already know that what the grounded
one is myself.
Is this easy to install.
Or is this computer or was the.
OK.
So these are overlapping IPs.
Similarly when you do peering between two PCs What's your intent.
The intent is you would like to have some easy to instances from here to communicate in some instances
from the other side.
If they have the same IP addresses your implied router will never send that outside.
You will always think that belongs to my side or block.
So it has to stay with them so the traffic will never leave they see two instance to the router and
if for any reason it happened then the router will send it back.
It will never send it outside.
Second one is you can have the disappearing between the PCs in different regions.
There is a limit of how many PCs you can have per VPC and the active is 50 and the spending is 25 pending
here means you have requests.
But the other side or the other party did not respond yet.
So you could have up to 50 50 VPC disappearing spare VBC.
And remember that it does not support transitive peering relationships so if you have that shape that
we talked about before in the exam and they tell you that B would like to communicate we'll see them.
Can they do it through Of course not.
They have to appear directly with each other.
And also you cannot have if you have VBC peering between two PCs you cannot have a second one established
between them.
At the same time.
Now what.
Good thing.
And we will talk about placement groups later on when we talk about easy two instances.
But the placement group is basically a cluster of two instances in the vicinity of each other so basically
in that they are in the same availability zone.
And the reason why you have that is you want to do high performance computing and you like to ensure
low latency and high performance as the incenses communicate with one another.
OK.
So here are what we are saying is if you have two PCs peered together you can have a cluster across
them you can have members of the cluster here in the cluster here and you can have all of these in a
placement group
unicast reverse path forwarding in a BBC BNN connection is not supported.
You don't need to worry much about about this one.
Basically this is to ensure in multicast and similar applications that if the traffic comes to me I
want to make sure that the reverse path is the IGP or the routing protocol path or the path back to
the source.
So in the next lecture we're going to cover the virtual private network option in the PC.
And for this one we learned that I can peer two pieces together they can be in the same account or different
between different accounts provided they are in the same region overlapping IPS is not supported transitive
peering is not supported and you need to update your routing on either side on both sides.
And your security groups on both sides in order to be able to peer between them whereas if it is not
supported over if I have a hearing with B and peering with C does not mean B and C can't talk to each
other through a.
So they have to peer with each other if they need to communicate or share files.
So I'll see you in the next lecture and we talk about the VPC virtual private networks.