...
| Term | Definition |
|---|---|
| Asymmetric Routing | Condition that presents itself when network traffic between a client and its destinationfollows different paths inbound and outbound. This results in the client sending packets to one IP address but receiving responses from a potentially different IP address, preventing client and server from properly establishing two-way communication. |
| AWS Private Subnet | Subnet in an AWS VPC that has no direct access to the Internet. |
| AWS Public Subnet | Subnet in an AWS VPC that has direct Internet access by way of a configured Internet gateway (IGW). |
Cornell Private Network | Private IPv4 address range 10.0.0.0/8, defined in RFC 1918 for use on private/internal networks. Addresses in this range are not allowed to leave the Cornell network and route directly over the Internet. |
| Cornell Public Network | Cornell's publicly routable IPv4 address ranges. |
| Direct Connect | Dedicated network connection between Cornell and Amazon Web Services via AWS peering partners. Direct Connect should be treated as if it were a campus network, including leveraging transport encryption for sensitive data. See also Cornell AWS Direct Connect. |
| Internet Gateway (IGW) | AWS-managed VPC routing device that provides inbound and outbound access from a subnet to the Internet. Allows use of public IP addresses (Elastic IP) on EC2 Instances. |
| Transit Gateway (TGW) | AWS-managed routing device that can cross-connect VPCs and Direct Connect resources. Transit Gateways are an integral component in the Cornell AWS Direct Connect Architecture. |
| Direct Connect Gateway (DCGW) | AWS-managed routing device that can connect VPCs and Transit Gateways in multple regions to Direct Connect connections. Direct Connect Gateways are an integral component in the Cornell AWS Direct Connect Architecture. |
| TCGW-DCGW infrastructure | The infrastructure components in the Cornell AWS Direct Connect Architecture that lie between the campus network and an AWS VPC using Direct Connect. |
| Secondary CIDR (in VPCs) | The secondary CIDR block is an extra, small CIDR block added to VPCs for use by the TGW-DCGW infrastructure. This CIDR block should not be used for any purpose other than for utility subnets. |
| Utility Subnets | Utility subnets are small ( |
Exclusions
The discussion and examples below focus on traffic between private and public network segments in AWS, and private and public network segments on campus. Although the Cornell AWS Direct Connect Architecture also links AWS VPCs to Cornell's private network segments in Azure, traffic between AWS and Azure is not included in this article.
...