At AppNexus every customer has a private VLAN, or Virtual Local Area Network, in each datacenter where they reserve servers. Your VLAN is a list sequential of IP addresses to be assigned to the instances you launch in the AppNexus environment. Your VLAN can consist of 8, 24, 56, and so on IP addresses; eight addresses in each range are reserved for networking equipment so it can behave as though it was part of your indiviudal VLAN.
VLANs provide security by segregating each customer's traffic from AppNexus and other customers' traffic and also by regulating traffic from the Internet according to a customer-controlled Access Control List (ACL).
- By default all inbound traffic from the Internet to your IP block is denied except for ping (ICMP Echo---used to verify that the host is up). With your ACL, you can explicitly permit TCP, UDP, or ANY traffic for particular source and destination IPs and ports.
- You'll set your inital ACL via the customer questionnaire, and you can change it at any time. At the moment, ACL changes must go through Support. Please see How to Request Firewall Changes for more information. Soon there will be an API for ACLs and you will also be able to use the customer portal.
- All traffic within a VLAN is allowed so all instances can freely communicate with each other.
- By default, all ports/traffic between same-customer VLANs in different datacenters is open. (Note that traffic between LAX1 and NYM1 travels over the Internet and is not encrypted.)
- All outgoing traffic from your VLAN is allowed.
If you run out of IP addresses in your VLAN
If you outgrow a VLAN, AppNexus will assign you a larger one. This can take up to one workday as support staff configures the ACL for the new VLAN. You will then need to migrate instances from the old VLAN to the new one. This can be done without downtime; you will assign each item in your VLAN a second IP address for the duration of the migration. Detailed instructions on VLAN migration will be provided when you make your request to Support.
Note: We assume that customer IP requests are for useable IP addresses; the eight addresses used for network gear have already been accounted for when an IP range is allocated.
Assigning specific IP addresses from your VLAN
You can assign specific IP addresses to your equipment by using the optional "--ip" parameter for the
manage-instance launch command. For more information, see manage-instance.