Skip to content
Ameen Abozaid
Englishالعربية
ARC-013

Networking

  • 8 Lessons
  • 4 h practice (estimate)
Start module
On this page 9 topics

Overview

Topics

  • CIDR
  • routing
  • VPC/VNet
  • subnets
  • NAT
  • VPN
  • private endpoints

Learn first

4 h of practice (estimate)

Learning outcomes

  1. Plan IP address space with CIDR so environments, regions, and on-premises networks don't overlap.
  2. Design VPC/VNet layouts with public and private subnets, routing, and NAT.
  3. Connect cloud to on-premises (site-to-site VPN, dedicated connections) and choose by bandwidth, latency, and resilience.
  4. Expose services privately with private endpoints and keep data paths off the public internet.

Lessons

  1. 01CIDR and address planning
  2. 02VPC/VNet layout and subnets
  3. 03Routing and NAT
  4. 04Hybrid connectivity
  5. 05Private endpoints and private data paths
  6. 06Hub-and-spoke topologies
  7. 07Demo: planning address space for Larkspur, stores, and the data center
  8. 08Demo: connecting the cloud platform to the on-premises ERP

Lab and exercises

Lab

ARC-013-LAB1 · Larkspur network design

Outcomes: 1–4 · Time: ~4 h (one provider; verify service names before recording)

  1. Gather existing ranges: data center, stores, head office.
  2. Produce the address plan for prod, non-prod, hub, and DR, with growth headroom.
  3. Design the VPC/VNet topology: hub-and-spoke, subnets per tier per zone, routing, NAT.
  4. Design hybrid connectivity to the data center hosting the ERP.
  5. Add private endpoints for each data store and document the DNS approach.
  6. Write the connectivity failure modes with detection and behavior.

Acceptance: no overlapping ranges; no data store reachable from the internet; connectivity failure mode documented.

Exercises (case-based; six exercises)

IDOutcomeTask
ARC-013-EX011The data center uses 10.0.0.0/16 and stores use 10.50.x.x/24 each. Allocate prod, non-prod, and hub blocks that avoid overlap and leave growth.
ARC-013-EX021How many addresses does a /24 give and what do you subtract for reservations? Explain why subnet sizing for containers needs care.
ARC-013-EX032Sketch a three-zone VPC layout with public, application, and data subnets and state which route each subnet has.
ARC-013-EX042Cost review: NAT data transfer is high. Name two design changes that reduce it.
ARC-013-EX053Choose between VPN and a dedicated connection for the ERP link and state when you would revisit.
ARC-013-EX064A private endpoint was created but the application still connects over the public address. Diagnose and fix.
Show solutions
  • EX01 Example: prod region 10.100.0.0/16, non-prod 10.101.0.0/16, hub 10.102.0.0/20, DR reserved 10.110.0.0/16; none overlap 10.0.0.0/16 or 10.50.0.0/16. Record in the plan.
  • EX02 256 addresses, minus a few reserved per subnet by the provider (verify before recording). Containers can consume one address per pod/task, so use larger subnets.
  • EX03 Public: route to internet gateway; application: default route to NAT in same zone; data: local only, no default route.
  • EX04 Use private endpoints for storage and other cloud services; cache or pull artifacts internally; reduce chatty outbound calls.
  • EX05 Start with dual VPN (low volume, fast to deliver); revisit when nightly volume, latency need, or availability target exceeds what VPN gives; keep VPN as a backup afterwards.
  • EX06 DNS still resolves the public address; enable private DNS for the endpoint or add a private zone; then disable public access on the service to prove the path.

Workplace evidence: a network design you produced or reviewed for a hybrid environment.

Outcome coverage: all outcomes covered by exercises and the lab.

Quiz

Outcomes: O1 CIDR planning · O2 VPC/VNet layout, routing, NAT · O3 hybrid connectivity · O4 private endpoints.

A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.

  1. 1Which block is larger?O1
  2. 2Overlapping CIDR ranges between cloud and on-premises mainly cause:O1
  3. 3Best practice for address planning is:O1
  4. 4Which belongs in a public subnet?O2
  5. 5Outbound-only internet access from private subnets uses:O2
  6. 6For NAT resilience you should:O2
  7. 7A single VPN tunnel as the only ERP link is a:O3
  8. 8A dedicated connection compared with VPN typically offers:O3
  9. 9A private endpoint should be combined with:O4
  10. 10In hub-and-spoke, spokes connect to:O4

Practical part

Network design review of the ARC-013-LAB1 address plan, topology, hybrid link, and failure-mode notes plus exercises ARC-013-EX01 to EX06. Pass: quiz at least 8/10, at least five of six exercises correct, no overlapping ranges, and no data store reachable from the internet.

Common mistakes

Overlapping CIDRs that block future peering; single VPN tunnel as the only ERP link.

Assessment

Network design review.

Workplace evidence

A network design you produced or reviewed for a hybrid environment.

Career relevance

Network security (ARC-018) and HA/DR (ARC-019).

Type to search levels, phases, modules and lessons.