Learning tracks

Address planning, subnet tiering, route table scoping, and the boundary rules that decide whether a packet ever leaves the VPC.

• Subnet Tiering and Route Table Scoping

  A subnet is not public or private by declaration — it is defined entirely by the route table associated with it. Getting the association model right is what makes every later networking decision possible.

  Associate16 min

• AWS IPAM: What It Enforces, What It Only Reports, and What It Bills

  IPAM allocation rules constrain what IPAM offers you, not what your account can create. Nothing stops a team from typing a CIDR by hand, so the rules you set as guardrails turn out to be a report — and the tier that manages private IPv4 bills you for every active address in every monitored account.

  Professional12 min

What a target actually sees as the source address, how health checks decide which zones receive traffic, and the defaults that silently change both.

• Client IP Preservation: What Your Target Actually Sees as the Source

  Whether a target sees the real client address depends on the target type and the protocol, not on one setting. Getting it wrong produces working traffic with the wrong source IP, which breaks security groups, rate limiting, and audit logs without breaking connectivity.

  Professional9 min

• Target Health and Zonal Distribution: Which Zones Receive Traffic

  A Network Load Balancer publishes one address per Availability Zone and withdraws a zone from DNS when it has no healthy target. Push that to every zone and it fails open, so total failure and total health produce the same DNS answer.

  Professional8 min

• Global Accelerator: Client IP Preservation, and What It Takes Out of the Path

  One option, three different defaults depending on endpoint type, and two that cannot be changed at all. Turning it on also changes which security controls evaluate the traffic — and two pages of the same AWS guide give opposite answers about one of them.

  Professional10 min

NAT Gateway placement, per-AZ data processing charges, gateway versus interface endpoints, and where egress spend actually accrues.

• NAT Gateway Placement, Failure Modes, and What Egress Actually Costs

  Where a NAT Gateway lives determines whether it works at all, how it fails when an AZ degrades, and how much of your data transfer bill is avoidable. All three answers come from the same design decision.

  Associate14 min

Centralized inspection topologies, appliance mode, route table associations, and propagation across attachments.

• Transit Gateway Route Tables: Association, Propagation, and Segmentation

  A Transit Gateway is not a router with one routing table — it is a routing domain per attachment. Understanding which table governs which direction is what separates a working hub-and-spoke design from one that fails asymmetrically.

  Professional10 min

Direct Connect, Site-to-Site VPN, and the BGP attributes that control which path your traffic actually takes on the way back.

• Hybrid Connectivity: VPN, Direct Connect, and the BGP Attributes That Actually Work

  Which AWS-side endpoint you terminate on decides your route quotas, whether you can use ECMP, and how failover behaves. Most hybrid incidents trace back to that one choice, a route ceiling that resets BGP, or a return path nobody drew.

  Professional16 min

• Cloud WAN as a Hybrid Endpoint: A Third Termination Point, and the First Ceiling You Share

  A core network edge terminates VPN and Direct Connect with the same per-attachment quotas as a Transit Gateway, and then three things change underneath you: the route ceiling becomes global across every segment, the Direct Connect association loses its prefix filter entirely, and the ASN rule inverts.

  Specialty12 min