Thursday, April 23, 2026

Cohort 3 | Project CloudIgnite Topics: IP Addressing & CIDR Blocks, Elastic IP, VPC Fundamentals Duration: ~3 hours

CLF-C02 Relevance: Sections marked with 🎯 are directly relevant to the AWS Certified Cloud Practitioner exam.

Key Takeaways

• Private IP ranges (RFC 1918): 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 — use only these in VPC
• Elastic IP: static public IP that persists across stop/start; charged when allocated but not associated
• CIDR formula: total addresses = 2^(32 - mask_bit); AWS reserves 5 per subnet
• VPC components: CIDR block, subnet, route table, Internet Gateway, Security Group, NACL
• Security Group vs NACL: instance-level/stateful vs subnet-level/stateless
• Lab 261: Troubleshoot missing public IP; Lab 262: Elastic IP demonstration

Table of Contents

1. IP Addressing & CIDR Blocks
2. Lab 261 — Public vs. Private IP Addresses (Troubleshooting)
3. Lab 262 — Elastic IP Address
4. VPC (Virtual Private Cloud) Fundamentals
5. CIDR Block Calculation Practice
6. Key Takeaways & Exam Tips

1. IP Addressing & CIDR Blocks

🎯 Private IP Ranges (RFC 1918)

These are the only valid IP ranges for use inside a VPC:

Other Reserved IP Ranges (Do NOT use in VPC)

Rule: Everything outside the private/reserved ranges is publicly routable — already assigned to organizations. Using public IP ranges inside a VPC causes conflicting routing (traffic may be misdirected to the real public owner of that IP).

What is a CIDR Block?

• An IP address combined with a mask bit (e.g., 10.0.0.0/16)
• The mask bit (slash number) defines how many bits are fixed (network portion)
• The remaining bits are flexible (host portion — used for your devices)
• Formula: Available addresses = 2^(32 - mask_bit)
• AWS allows VPC CIDR mask bits from /16 (largest) to /28 (smallest)

2. Lab 261 — Public vs. Private IP Addresses (Troubleshooting)

Scenario

A customer has two EC2 instances (Instance A & Instance B) in the same VPC and same public subnet, same configuration. Instance B can reach the internet; Instance A cannot.

Troubleshooting Methodology (OSI-based)

Work top-down or bottom-up through the network layers:

Key diagnostic logic:

• If the problem were at Layer 1–3 (region, subnet, route table, IGW), both instances would fail — not just one.
• Since only Instance A fails, the issue is at the instance level → Security Group or IP configuration.

Root Cause Found

Instance A has no Public IP address assigned. Without a public IP, it cannot be reached from the internet.

• Private IP → accessible only within the VPC
• Public IP → required for internet access (inbound/outbound)
• Attempting to SSH/connect using a private IP from outside the VPC will time out

Customer Query: Using 12.0.0.0/16 for a VPC

Answer: Do NOT use this range.

• 12.x.x.x is a publicly routable IP range — not in the private ranges list.
• Using it causes conflicting routing: requests may be directed to the real public owner of that IP instead of your EC2 instance.
• Always use 10.x, 172.16–31.x, or 192.168.x.x for VPC CIDR blocks.

3. Lab 262 — Elastic IP Address

Scenario

A customer's EC2 instance has a public IP that changes every time the instance is stopped and restarted, breaking their application (e.g., DNS no longer resolves correctly).

Why Does the Public IP Change?

• By default, AWS assigns a dynamic public IP (similar to DHCP on a home network).
• When an instance is stopped, its public IP is released.
• When restarted, a new, different public IP is assigned.
• The private IP is retained across stop/start cycles.

Solution: Elastic IP Address 🎯

An Elastic IP (EIP) is a static, persistent public IPv4 address that you own until you release it.

How to Create & Associate an Elastic IP

1. In the AWS Console, go to EC2 → Network & Security → Elastic IPs
2. Click Allocate Elastic IP address → choose Amazon's IPv4 pool → Allocate
3. Select the new EIP → Actions → Associate Elastic IP address
4. Choose your instance and its private IP → Associate

Cost tip: You are charged for an EIP only when it is allocated but NOT associated with a running instance. If associated, there is no charge for the EIP itself (you still pay for the instance).

Lab Steps Summary

1. Launch a new EC2 instance (Amazon Linux, t3.micro, Lab VPC, public subnet, auto-assign public IP enabled, Linux SG security group, existing key pair).
2. Note the current public IP.
3. Stop the instance → observe that the public IP disappears.
4. Start the instance → observe a new (different) public IP is assigned.
5. Create and associate an Elastic IP.
6. Stop and start the instance again → confirm the IP does not change.

4. VPC (Virtual Private Cloud) Fundamentals

🎯 Traditional Network → AWS Equivalents

🎯 What is a VPC?

• A logically isolated (not physically isolated) virtual network within AWS.
• Multiple VPCs may share the same underlying physical hardware, but their data is virtually separated.
• Think of it like a LAN in the cloud — your private space to launch resources.

Key VPC Characteristics

• Regional service — a VPC cannot span multiple AWS regions.
• A VPC can span multiple Availability Zones (AZs) within a region.
• Subnets are AZ-specific — each subnet lives in exactly one AZ.
• When you create an AWS account, a default VPC is created automatically.

🎯 Core VPC Components

Important: Even if a subnet is "public," EC2 instances in it cannot reach the internet unless an Internet Gateway is attached to the VPC and the route table has a route pointing to it.

VPC Benefits

• Cost-effective — no need to buy physical routers, switches, or cables.
• Secure — logically isolated; you control inbound/outbound rules.
• Scalable — add more CIDR blocks, subnets, or AZs as needed.

5. CIDR Block Calculation Practice

The Formula

Total addresses  = 2^(32 - mask_bit)
Usable addresses = Total - 5  (5 IPs reserved per subnet by AWS)

Reserved IPs in Every AWS Subnet (5 total)

Worked Examples

Example: 10.0.0.0/26

• Fixed bits: 26 → Free bits: 6
• Total: 2⁶ = 64 addresses
• Range: 10.0.0.0 → 10.0.0.63
• Usable: 64 − 5 = 59 instances

Tip: Use a CIDR Calculator

Search "CIDR calculator" on Google to quickly find:

• Network address, subnet mask
• First & last usable IP
• Total hosts

6. Key Takeaways & Exam Tips

🎯 CLF-C02 Relevant Topics Covered

Quick-Reference: Security Group vs. NACL

Common Exam Gotchas

• A stopped EC2 instance loses its public IP — use Elastic IP for persistence.
• Private IPs are retained when an instance is stopped.
• VPCs must use private IP ranges; public ranges cause routing conflicts.
• An Internet Gateway is required even for public subnets to access the internet.
• Security Groups act at the instance level; NACLs act at the subnet level.
• A VPC spans one region but can span multiple AZs.
• Subnets are AZ-specific (one subnet = one AZ).

Notes compiled from April 23, 2026 lecture — AWS/RE:START Cohort 3: Project CloudIgnite. Next session: VPC & Subnet creation lab using CIDR blocks.