Cloud Networking 101: From Beginner to Expert
Cloud networking is the system of roads, addresses, gates, traffic rules and delivery services that lets users, applications and data reach one another safely. The sentence is simple; the implementation is not, and in the cloud a mistake can be created in minutes and copied into every project. This twelve-part series builds the foundation one idea at a time, so that AWS, Azure, Google Cloud and Huawei Cloud product names become translation rather than mystery. Parts 1 to 4 cover packets, CIDR, DNS, routing and virtual networks. Parts 5 to 8 move into firewalls, NAT, private endpoints, load balancing and hybrid connectivity. Parts 9 to 12 cover landing zones, zero trust, resilience, observability and network cost, and finish with four architecture patterns, a decision method and a capstone design. One fictional South African freight company carries the worked examples, and every part ends with an exercise and questions to test your understanding. Educational material: adapt every range, port and pattern to your own workload and current provider documentation.
12 articles
- Part 1How network communication works: packets, addresses, ports and protocolsCloud networking is roads, addresses, gates and traffic rules, most of them now written in software. Part 1 builds the mental model everything else in the series rests on: packets, addresses, ports, protocols, and the five questions behind almost every network fault.11 min read
- Part 2IP addresses, CIDR and an address plan you will not regretAddress planning looks like admin until two networks with the same range need to talk. Part 2 explains how to read a CIDR block, what private and public addresses really mean, and how to build an address plan that survives growth, acquisitions and hybrid connectivity.10 min read
- Part 3DNS, routes and gateways: how a name becomes a reachable destinationDNS turns a name into an address, routing decides the path, and gateways join one routing domain to the next. Part 3 traces how all three combine, why the most specific route wins, and why private endpoints so often fail on DNS rather than on the network.9 min read
- Part 4VPCs, VNets and subnets: drawing useful boundaries in a cloud networkA VPC or VNet is a fenced piece of a provider's network, not a security guarantee. Part 4 explains what virtual networks and subnets actually do, translates the terms across AWS, Azure, Google Cloud and Huawei Cloud, and shows how to decide when a workload deserves a network of its own.9 min read
- Part 5Firewalls, security groups and network policy: deciding which flows exist"Only allow authorised traffic" is not a rule anyone can implement. Part 5 turns network security into a flow matrix: every permitted conversation has a source, destination, port, owner and reason, and everything else is denied.11 min read
- Part 6Internet access, NAT and private endpoints: four questions, not one"The workload needs internet" can mean four different things, and each has its own narrow answer. Part 6 separates inbound publication, outbound NAT, private access to cloud services and administrator access, then walks into the DNS trap that catches most private endpoint projects.10 min read
- Part 7Load balancing, TLS and application deliveryA load balancer only improves availability when the backends, health checks and failure domains behind it are designed properly. Part 7 covers Layer 4 versus Layer 7, where TLS should terminate, global delivery, and the health probe that decides who gets traffic.9 min read
- Part 8Connecting offices, data centres and cloud networksVPNs, private circuits, peering and transit hubs each solve a different connection problem. Part 8 compares them, explains BGP in plain language, shows why a full mesh stops scaling, and follows one South African company's sites into the cloud, including the backup path that was not really a backup.12 min read
- Part 9Enterprise landing-zone networking: shared foundations with clear ownershipA landing zone makes the safe path the easy path before the workloads arrive. The network part of it is less about hub-and-spoke versus mesh and more about which capabilities are shared, which controls are central, and who operates each piece.11 min read
- Part 10Zero trust, segmentation and service networkingBeing inside the network used to mean being trusted. Cloud, remote work, partners and stolen credentials ended that. This part explains segmentation, microsegmentation, service identity, Kubernetes networking and DNS at enterprise scale, and where each control belongs.10 min read
- Part 11Network resilience, observability and cost: designing for the bad dayA service can run across three availability zones and still fail because of one DNS resolver, one certificate or one circuit. This part covers designing the whole path for failure, the evidence you need to diagnose it, and why one gigabyte can be billed four times.10 min read
- Part 12Expert cloud network architecture: four patterns and a decision methodExpert networking is not the number of products on a diagram. It is turning business, security and recovery requirements into a small number of controlled traffic paths, then proving they behave. The final part brings together four patterns, a seven-step method, fifteen review questions and a capstone design.14 min read
Working through any of this in your own organisation?
These articles come out of delivery work rather than theory. If the problems in this series look familiar, a short scoping conversation is usually the quickest way to work out what is worth doing first.
Talk to CloudNala