Lecture 20: NAT Gateway High Availability
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：02:19
- 来源：Udemy Lecture 24112508
- Slide 数量：1
- 画面构建：约 00:35、00:42、00:55、01:14、01:51
扫描说明
按页面英文 transcript 的 48 个时间点逐一定位并检查视频画面。整讲使用同一张高可用架构幻灯片，图中的可用区、NAT 网关、路由表、流量路径和结论项目逐步出现，因此作为一个小节处理，并截取动画构建完成后的完整画面。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Highly Available NAT Gateway Architecture
时间范围：00:00–02:19
总结 / Summary
中文
NAT 网关（NAT Gateway）是可用区级资源（Availability Zone-scoped Resource），单个 NAT 网关只能保证所在可用区（Availability Zone, AZ）内的弹性。如果多个可用区的私有子网都把默认路由指向同一个 NAT 网关，那么该 NAT 所在 AZ 故障时，其他 AZ 中仍在运行的实例也会失去互联网出口。高可用设计应在每个 AZ 的公有子网分别部署 NAT 网关，并让各 AZ 的私有路由表（Private Route Table）优先使用同 AZ 的 NAT。一个 AZ 故障时，其他 AZ 的实例和 NAT 路径仍可继续工作，而且正常设计不需要跨 AZ 故障转移（Cross-AZ Failover）。
English
A NAT Gateway is scoped to an Availability Zone (AZ) and is resilient only within that AZ. If private subnets in multiple AZs all use a single NAT Gateway, an outage in the gateway's AZ can remove Internet access even from instances that remain healthy elsewhere. A highly available design deploys a NAT Gateway in the public subnet of each AZ and points each private route table to the NAT in the same AZ. When one AZ fails, the instances and NAT path in the other AZ continue operating, with no cross-AZ failover required in the normal design.
Transcript
00:00 Hello and welcome to this lecture.
00:01 So in earlier lecture,
00:02 we saw how to set up NAT gateway.
00:04 In this lecture, we are going to see
00:06 how to have the highly available NAT gateways.
00:10 So as you know, NAT gateway scope is AZ level
00:13 because we are going to create that in a given subnet.
00:16 That means if one AZ goes down,
00:18 probably your NAT gateway will also go down
00:21 and you might lose outbound internet connectivity
00:25 for all your instances across multiple availability zones.
00:29 So, NAT gateways are resilient within a single AZ
00:34 and if you want high availability for NAT gateways,
00:38 you should create those in multiple AZs.
00:41 So the architecture will look something like this.
00:44 This is a VPC and then you have a multiple AZs.
00:48 In these AZs you have multiple subnets.
00:50 So NAT gateway resides inside public subnets.
00:55 So that means you can route traffic
00:56 for all EC2 instances in this subnet,
01:00 private subnet through NAT gateway in the same AZ,
01:04 and if there is other set of EC2 instances in another AZ,
01:09 you can route traffic to another NAT in that AZ.
01:13 So, as I said earlier,
01:14 very well, these EC2 instances can be routed.
01:17 There can route a traffic for internet
01:21 through this NAT gateway as well.
01:23 And this is a legitimate architecture.
01:27 There is no problem with that,
01:29 but in case if this AZ goes down,
01:31 that means these instances,
01:33 even if they are running,
01:35 they can't access the internet.
01:37 So in exam it may be asked that how to have
01:40 the high availability for the NAT gateways across AZ.
01:44 The answer would be to have
01:44 the individual NAT gateways in each AZ.
01:48 So even if AZ goes down,
01:51 the whole system will go down,
01:52 and other set of instances and NAT gateway
01:55 will run into another AZ.
01:58 That means your system is still reliable.
02:01 So, that is one thing you need to understand
02:05 about the NAT gateway high availability for your exam.
02:10 Later, in the next lecture,
02:12 we will see how to set up a NAT gateway
02:14 on your EC2 instances.
02:17 Thank you.
整讲总结 / Overall Summary
中文
NAT 网关高可用（NAT Gateway High Availability）的考试要点是“每个可用区一个 NAT”。虽然技术上可以让跨 AZ 的实例共享单个 NAT 网关，但这会引入可用性风险和跨区依赖。将 NAT 网关与私有工作负载按 AZ 对齐，可以隔离故障并让其他 AZ 保持出站互联网访问。
English
The key exam principle for NAT Gateway high availability is “one NAT per Availability Zone.” Cross-AZ sharing is technically possible, but it introduces an availability risk and a dependency on another AZ. Aligning each NAT Gateway with the private workloads in its AZ isolates failures and preserves outbound Internet access in the remaining AZs.
返回顶部 ↑