# What the Cloud Virtualises — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-cloud-model

> Describe which networking layers a cloud provider manages for you and which decisions remain yours.

## Software-defined networking in one paragraph

In a data centre you would buy switches, routers and firewalls and cable them together. In a public cloud, the provider runs a huge shared physical network and gives each customer a **software-defined** slice of it. You never see the cables. Instead you declare *intent* through an API: an address range, how it is split into subnets, which routes exist, and which traffic is allowed. The provider's hypervisors enforce those rules on every packet leaving or entering a virtual machine. This means some classic problems disappear (no spanning tree, no physical port failures for you to fix) while others remain fully yours: choosing non-overlapping address ranges, deciding what is reachable from the internet, writing firewall rules, and connecting networks together. Most of this course is about those remaining decisions. The concepts are shared across AWS, Google Cloud and Azure; names differ, so we mostly use AWS terms and point out the equivalents.

## From address to reachable workload

The first sections build up four ideas in order: an IP address, the CIDR block it belongs to, the subnet that block is carved into, and the route that decides where the packet goes next.

![Four connected stages from left to right: IP address, CIDR block, subnet, route.](assets/figures/cloud-networking/section-1-map.svg) — Figure 1.1: IP address -> CIDR block -> subnet -> route

## Name translation table

AWS VPC = Google Cloud VPC network = Azure Virtual Network (VNet). AWS security group is closest to an Azure network security group (NSG) or a Google Cloud firewall rule. Learn the idea once and map the names.

**Quiz:** Which of these is still the customer's responsibility in a cloud VPC?

- [ ] Replacing failed physical switches
- [ ] Running spanning tree on the provider's network
- [ ] Cabling hypervisor hosts together
- [x] Choosing address ranges and firewall rules

*Answer:* Choosing address ranges and firewall rules. The provider owns the physical network. You still decide address space, routing, reachability and firewall policy.