Lecture 42: Bandwidth Limits inside and outside of VPC
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：12:37
- 来源：Udemy Lecture 26073172
- Slide 数量：6
- 画面切换：00:40、02:19、03:11、06:40、08:57
扫描说明
按 Udemy Transcript 的 283 个时间点逐一定位并比较视频画面，确认标题、讨论范围、VPC 限制、EC2 路径限制、EC2 最大带宽以及 VPN/DX 带宽共 6 个 Slide。同页流量箭头和组件逐步出现视为动画构建，截图保留最终稳定状态。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Network Bandwidth Limits
时间范围：00:00–00:40
总结 / Summary
中文
本讲不只讨论 EC2 本身，还比较流量经过 Internet Gateway、NAT Gateway、VPC 对等连接（VPC Peering）、VPN、Direct Connect（DX）和 Transit Gateway 时的带宽限制。端到端性能取决于路径上每个组件，而不是单一实例规格。
English
This lecture compares bandwidth not only at EC2 but also across Internet Gateways, NAT Gateways, VPC peering, VPN, Direct Connect, and Transit Gateway paths. End-to-end performance depends on every component along the path rather than a single instance specification.
Transcript
00:00 Hello, and welcome to this lecture,
00:01 network bandwidth limits.
00:03 Now that you understood how enhanced networking works,
00:06 let's try to understand what bandwidth you can get
00:09 while the traffic is sent
00:10 from one networking component to other.
00:13 Now, I don't want to restrict this discussion
00:15 just to the EC2 instance,
00:16 but typically if the communication happened
00:19 between EC2 and, say, a VPN or DX
00:23 or internet gateway, NAT gateways,
00:26 or over the VPC peering connection,
00:28 all these are different scenarios.
00:29 So we must consider everything when it comes to deciding
00:33 what kind of bandwidth you can get, right?
00:36 So let's get started with this lecture.
00:39 So in this lecture,
2. Scope and the Network Flow Model
时间范围：00:40–02:19
总结 / Summary
中文
讨论范围涵盖 VPC 组件、EC2、VPN/DX/Transit Gateway。带宽通常按网络流（Network Flow）限制；一个流由源 IP、源端口、目的 IP、目的端口和协议这五元组（Five-Tuple）定义。单流达到上限后，要提高聚合带宽（Aggregate Bandwidth）需使用多个并行流。
English
The scope covers VPC components, EC2, VPN, Direct Connect, and Transit Gateway. Bandwidth limits are often expressed per network flow, defined by the five-tuple of source IP, source port, destination IP, destination port, and protocol. Once one flow reaches its cap, multiple parallel flows are needed to increase aggregate bandwidth.
Transcript
00:40 we are going to discuss VPC bandwidth limits.
00:43 And the bandwidth limit may apply to the internet gateway,
00:47 NAT gateways, VPC peering connection.
00:50 EC2 itself has a bandwidth limit.
00:52 Now you understand that EC2 comes in different flavors,
00:55 different instance families, generations, sizes,
00:59 and everything affects the network bandwidth.
01:01 So in this lecture,
01:02 we'll also see what kind of instance families can give you
01:05 the maximum bandwidth.
01:07 Then comes the bandwidth over VPN connection
01:10 or Direct Connect or Transit Gateways.
01:12 So we'll also touch upon those concepts.
01:15 Now, whenever we'll talk about the bandwidth
01:17 and essentially maximizing the bandwidth,
01:20 we will typically use a term
01:22 called network flow throughout this lecture, right?
01:25 And here, I want to mention the network flow.
01:28 So what is network flow?
01:29 It is basically a five-tuple point-to-point connection.
01:32 So which means if two EC2 machines
01:34 are communicating with each other
01:37 and there is some process which is transferring data,
01:39 it's one network flow, right?
01:41 So it has a five-tuple, source IP, source port,
01:44 destination IP, destination port, and the protocol.
01:47 Now typically bandwidth has a limit per flow.
01:52 That means if you want to maximize the bandwidth
01:54 between two instances, for example,
01:57 then you should look at having multiple flows.
02:00 And then we'll talk about that again later.
02:02 But understand that when we talk about the bandwidth,
02:05 it typically applies to a single flow.
02:07 And then you can maximize it by using multiple flows.
02:10 So for example, these are two EC2 instances,
02:13 and there is one flow between them.
02:15 And now if you want to maximize the bandwidth,
02:17 you will have multiple flows.
3. VPC Component Bandwidth Limits
时间范围：02:19–03:11
总结 / Summary
中文
VPC 本身、互联网网关（Internet Gateway）和 VPC 对等连接（VPC Peering）不设置课程所述的固定带宽上限。单个 NAT 网关（NAT Gateway）可扩展到约 45 Gbps；更高需求可在各可用区部署多个 NAT Gateway，但要让实例使用同 AZ 的网关，避免跨 AZ 数据传输费用。
English
The VPC itself, Internet Gateways, and VPC peering do not impose the fixed bandwidth caps discussed here. A single NAT Gateway scales to about 45 Gbps. Higher demand can use multiple NAT Gateways across Availability Zones, but instances should use the gateway in their own AZ to avoid cross-AZ data-transfer charges.
Transcript
02:19 Okay, so with respect to the VPC,
02:21 there are no specific limit that has been enforced
02:25 by the VPC for the bandwidth.
02:27 Whether it's an internet gateway or VPC peering connection,
02:30 it doesn't impose any bandwidth traffic limits, right?
02:35 But when it comes to the NAT gateway, as of now,
02:38 NAT gateway can provide up to 45 Gbps of bandwidth.
02:42 And that is about the single NAT gateway.
02:44 Now, sometimes if you need more bandwidth than 45 Gbps,
02:47 then you can obviously have multiple NAT gateways.
02:51 But in that case,
02:52 make sure that the traffic from instances does not flow
02:56 across the availability zone.
02:57 Otherwise you would have to pay
02:59 additional data transfer charges across AZs.
03:02 But then you can use multiple NAT gateways
03:04 to scale beyond 45 Gbps.
03:07 Now that's what the VPC bandwidth limits are.
4. EC2 Bandwidth by Destination
时间范围：03:11–06:40
总结 / Summary
中文
EC2 带宽取决于实例家族、vCPU 数量、Nitro 代际和流量目的地。目的地位于同一 AWS 区域（Same Region）时，可使用实例标称的完整网络带宽，但通常需要多流；去往互联网或 Direct Connect 等区域外路径时，至少 32 vCPU 的实例通常可用标称带宽的最多 50%。较小或非当前代实例在这些外部路径上通常受每实例 5 Gbps 限制。实际数字仍需查对应实例类型。
English
EC2 bandwidth depends on the instance family, vCPU count, Nitro generation, and traffic destination. For destinations in the same AWS Region, an instance can use its full advertised network bandwidth, generally through multiple flows. For Internet or Direct Connect paths outside the Region, instances with at least 32 vCPUs can typically use up to 50% of advertised bandwidth, while smaller or non-current-generation instances are commonly capped at 5 Gbps per instance. Check the exact instance specification.
Transcript
03:11 But now essentially,
03:12 if you talk about EC2 bandwidth limit,
03:14 now there could be multiple scenarios.
03:16 As I said, the EC2 machines could be in the same VPC
03:20 and in the same placement group.
03:22 That means they are very close to each other.
03:25 Or these EC2s could be across VPCs
03:28 and these VPCs could be in the same region
03:31 or another region.
03:33 Or you can talk to internet,
03:34 or you can have a traffic between EC2 and S3.
03:38 Now, again, this S3 bucket could be in the same region
03:41 or a different region.
03:42 Now, depending on the scenario,
03:45 the bandwidth limit would change, right?
03:48 So first of all,
03:49 the bandwidth of EC2 instance itself
03:51 will depend on a lot of factors.
03:53 Which instance family it is,
03:55 how many vCPUs instance has,
03:57 and what's the traffic destination is.
04:00 Now you know that there are network optimized EC2 instances.
04:03 And if you look at the AWS current generation instances
04:06 which are based on the Nitro systems,
04:08 then they provide much more networking bandwidth
04:11 than the older generation instances.
04:13 So always make sure that you choose
04:15 the latest generation instances
04:16 to get the maximum performance from the EC2 instances.
04:21 Now, if the traffic destination is within the region
04:24 then typically you can leverage the maximum bandwidth
04:27 that EC2 has.
04:28 Now, if you go to the AWS EC2 instance page
04:31 and look at its configuration,
04:33 it provides you the networking bandwidth as well.
04:36 And that typically says up to five Gbps or up to 10 Gbps
04:40 or up to 100 Gbps, right?
04:42 So if the traffic destination is in the same region
04:46 as EC2 machine, then you can leverage whole bandwidth
04:49 of that EC2 machine.
04:51 Now, again, we are not talking about a single flow here.
04:53 You have to use multiple flows to, you know,
04:57 consume whole bandwidth.
04:59 But now if the traffic is outside of AWS region,
05:03 in that case,
05:05 it depends where the destination is again, right?
05:08 If it is going over the internet or Direct Connect,
05:12 then you can only utilize up to 50% of the network bandwidth
05:15 that EC2 provides, right?
05:17 And this is only applicable for the instances
05:20 which have minimum of at least 32 vCPUs.
05:24 So if the instance is smaller in size than 32 vCPUs,
05:29 it is still limited to five Gbps per instance,
05:33 if the traffic is going to the internet
05:35 or to the Direct Connect,
05:37 then that would be the maximum bandwidth that you can get.
05:40 If instance size is less than 32 vCPUs
05:43 and instance is not the current generation instances.
05:46 Now what are current generation instances?
05:48 You can just Google on AWS page and you will find typically
05:53 all the Nitro based systems
05:54 are the current generation instances as of now.
05:57 So understand that if the traffic destination
06:00 is within the region, you can get the full EC2 bandwidth.
06:04 But if it is outside of region
06:06 then it would depend again,
06:08 on whether the instance is small size
06:10 and it's a current generation or not.
06:13 Otherwise five Gbps is the bandwidth limit.
06:16 So you can see it could be either 50% or five Gbps
06:21 if the traffic is going through the internet gateway
06:24 or to the S3 or to the other region EC2 machine.
06:28 Okay, I hope that is clear.
06:30 Now here, I'm not talking about specific bandwidth numbers,
06:33 because as I said,
06:34 it would depend on the underlying EC2 instance type
06:37 and its networking capabilities.
5. Maximum EC2 Bandwidth with Enhanced Networking
时间范围：06:40–08:57
总结 / Summary
中文
使用 Intel 82599 VF 时，课程给出的聚合带宽为 10 Gbps、单流约 5 Gbps。使用 ENA 时聚合带宽可达 100 Gbps，但单流在集群置放群组（Cluster Placement Group）外约 5 Gbps、组内约 10 Gbps，因此需要多流才能利用总带宽。访问 S3 时优先使用 VPC 端点（VPC Endpoint），避免 Internet Gateway 的外部流量折扣。课程还以 P4d UltraClusters 的 400 Gbps 作为专用超算实例上限示例；普通选型仍应按实例规格确认。
English
With Intel 82599 VF, the lecture cites 10 Gbps aggregate bandwidth and about 5 Gbps per flow. With ENA, aggregate bandwidth can reach 100 Gbps, but a single flow is about 5 Gbps outside a cluster placement group and about 10 Gbps inside one, so multiple flows are required. For S3, use a VPC endpoint to avoid the external-path reduction through an Internet Gateway. The lecture also cites 400 Gbps on P4d UltraClusters as a specialized supercomputing example; ordinary designs must still follow the instance specification.
Transcript
06:40 So what is the maximum bandwidth
06:42 that you can get from the EC2 machines
06:44 when the traffic goes to these destinations?
06:46 So that, again now,
06:48 depending on whether you have the enhanced networking
06:50 enabled or not.
06:51 As we learned in the last lecture,
06:53 if you are using Intel Virtual Function
06:56 then you can get 10 Gbps of aggregate bandwidth
06:59 and then per-flow bandwidth is five Gbps.
07:02 So that is when your instance supports
07:04 the Intel Virtual Function as an enhanced networking.
07:08 But if the instance is current generation
07:10 and it supports the ENA, that is elastic network adapter,
07:14 then you can get up to 100 Gbps of the bandwidth
07:18 with the ENA.
07:19 Now again, 100 Gbps is an aggregate bandwidth.
07:22 That means per flow bandwidth you can get five Gbps
07:25 if it is outside of placement group
07:28 and 10 Gbps if it is inside placement group,
07:31 but ultimately the aggregate bandwidth
07:34 is 100 Gbps while using the ENA.
07:36 And the same rule applies to even the traffic
07:38 to the S3 as well.
07:40 Again here, you have to use multiple flows.
07:44 And for highest bandwidth,
07:46 you should leverage VPC endpoint in that case.
07:48 Because if the traffic goes over to the internet,
07:51 you know that bandwidth will be 50% maximum, right?
07:54 So you can't leverage this 100 Gbps bandwidth there.
07:58 So these are few things that you need to consider
08:00 while thinking about the bandwidth,
08:02 but ultimately there are other factors as well,
08:05 like EC2 instance sizes, EC2 instance type,
08:08 everything, right?
08:10 That you need to go to AWS EC2 page
08:13 and see if it supports the ENA
08:14 and what's the maximum bandwidth it supports, right?
08:18 Now, while we are talking about the ENA and EC2,
08:21 we said that it's 100 Gbps typically.
08:23 But lately AWS also launched an instance,
08:26 which is special instance P4d
08:28 which runs on a supercomputer called UltraClusters,
08:31 which provides 400 Gbps of the networking.
08:34 And that's the first time in cloud that happened.
08:37 And this is not typically the normal instance
08:40 that anybody can use,
08:42 but this is where the bandwidth limits
08:44 have been reached, right?
08:46 But in general, if it's about ENA,
08:48 you can consider it as 100 Gbps
08:51 is the standard limit as of now.
08:53 So I hope that is clear.
08:54 And now let's go to the other bandwidth,
6. VPN, Direct Connect, and Transit Gateway Bandwidth
时间范围：08:57–12:37
总结 / Summary
中文
虚拟私有网关（Virtual Private Gateway, VGW）上的站点到站点 VPN（Site-to-Site VPN）总聚合带宽为 1.25 Gbps；每连接有两个隧道，但 VGW 不支持 ECMP，因此通常只有一条隧道主动承载流量。Transit Gateway 支持等价多路径（Equal-Cost Multi-Path, ECMP），可聚合多个 1.25 Gbps VPN 连接，课程给出的 TGW 聚合上限为 50 Gbps。Direct Connect 带宽由端口速率决定；私有 VIF 经 VGW 时仍按 DX 物理端口能力，而非 VPN 的 1.25 Gbps 上限。具体数字会更新，考试更重要的是识别限制点和能否聚合。
English
A Site-to-Site VPN terminating on a Virtual Private Gateway has 1.25 Gbps aggregate bandwidth. Each connection has two tunnels, but the VGW does not support ECMP, so normally only one tunnel actively carries traffic. Transit Gateway supports ECMP and can aggregate multiple 1.25 Gbps VPN connections; the lecture cites a 50 Gbps TGW aggregate limit. Direct Connect bandwidth follows the port speed, and a Private VIF through a VGW remains bounded by the DX physical port rather than the VPN's 1.25 Gbps limit. Exact numbers change, so the exam emphasis is identifying the bottleneck and whether aggregation is available.
Transcript
08:57 that is VPN, DX, or Transit Gateway.
09:00 So when it comes to the VPN,
09:02 you know that in VPC you have to attach
09:05 the virtual private gateway.
09:07 And virtual private gateway is limited
09:09 by 1.25 Gbps of aggregate bandwidth.
09:12 Now, what is this aggregate bandwidth?
09:14 On virtual private gateway,
09:16 you can have multiple VPN connection
09:17 to multiple branch offices, right?
09:20 But then, irrespective of how many VPN connection terminates
09:23 on this private gateway,
09:25 total aggregate bandwidth from AWS
09:28 to your on-premise network would be limited to 1.25 Gbps.
09:34 Now every VPN connection comes with two tunnels.
09:36 And 1.25 Gbps is also per-tunnel in bandwidth.
09:41 But you know that you can't use ECMP with VPG
09:45 at the VPC level.
09:46 That means only one tunnel is active at a time.
09:49 However if it's a Transit Gateway it's a different story.
09:51 You can have ECMP enabled
09:53 and you can double the bandwidth in that case, right?
09:56 And we'll talk more about that
09:58 during the Transit Gateway session.
10:00 But understand that for virtual private gateway,
10:03 the aggregate bandwidth limit from AWS
10:06 to on-premise network traffic at 1.25 Gbps.
10:10 And which also means from on-premise to AWS,
10:12 it will be limited by how much traffic
10:14 the on-premise is sending to your VPC.
10:17 Now, as I said, multiple VPN connection,
10:20 the overall bandwidth will be limited by 1.25 Gbps only.
10:25 And AWS Direct Connect bandwidth
10:27 is defined by the port speed.
10:29 Now we haven't talked about Direct Connect yet,
10:31 but Direct Connect provides you option
10:34 with different port speed
10:36 like one Gbps, 10 Gbps, or 100 Gbps,
10:40 as well as sub one Gbps like 50 Mbps, 100, 500, like that.
10:46 So in case of Direct Connect,
10:47 it will be limited by the port speed that you define, right?
10:51 And if Direct Connect is terminating
10:54 over Virtual Private Gateway,
10:56 now, when we talk about Direct Connect,
10:59 we'll talk about these factors.
11:00 But in order for you to send traffic
11:04 from your VPC private instances over the Direct Connect,
11:07 you have to create a private BIF
11:10 which has to be attached
11:11 to the Virtual Private Gateway again.
11:13 Now in that case, the private gateway throughput
11:17 will be bound by the Direct Connect physical port itself,
11:20 right?
11:20 So if port is one Gbps then you will get one Gbps bandwidth.
11:24 If it is more than that, then you will get that bandwidth.
11:28 So 1.25, what we talked about
11:30 is all about the VPN connection which terminates on the VPC.
11:35 But for Direct Connect,
11:36 it will be as per your Direct Connect port.
11:40 So I hope that it's clear.
11:41 Now with respect to the Transit Gateway especially,
11:45 Transit Gateway has a limit of 50 Gbps aggregate bandwidth.
11:50 That means you could have multiple VPN connection
11:53 which can terminate onto the Transit Gateway.
11:56 And then each VPN connection can have 1.25 Gbps bandwidth.
12:01 And then you can aggregate multiple such VPN connection
12:04 to get aggregate bandwidth of 50 Gbps.
12:08 I hope that it's clear.
12:09 Now with respect to the exam I don't think
12:11 you need to remember all these numbers
12:13 because these numbers are going to change
12:15 and you will see higher bandwidth being supported by EC2
12:19 and different networking components in AWS.
12:22 But in general, I hope you know that,
12:24 which all the bandwidth you have to consider
12:26 when the traffic flows through
12:28 different networking components in AWS.
12:31 So with that, we'll stop here for this lecture.
12:34 And thanks for watching.
整讲总结 / Overall Summary
中文
带宽设计必须把实例、流和路径组件一起看：VPC/IGW/Peering 通常不是固定瓶颈，NAT Gateway 单个约 45 Gbps；EC2 同区域可使用完整标称能力，外部路径常受 50% 或 5 Gbps 限制；ENA 的 100 Gbps 是多流聚合。混合网络中，VGW VPN 为 1.25 Gbps 且无 ECMP，TGW 可用 ECMP 聚合，Direct Connect 则由端口速率决定。
English
Bandwidth design must consider the instance, individual flows, and every path component together. VPC, IGW, and peering are generally not fixed bottlenecks, while one NAT Gateway provides about 45 Gbps. EC2 can use full advertised bandwidth within the Region but external paths often face a 50% or 5 Gbps constraint; ENA's 100 Gbps is a multi-flow aggregate. In hybrid networking, VGW VPN is 1.25 Gbps without ECMP, TGW can aggregate through ECMP, and Direct Connect follows its port speed.
返回顶部 ↑