网络课程笔记

00:00 Hi, and welcome to this lecture.

00:01 VPC Traffic Mirroring.

00:03 So in the last lecture we saw,

00:05 monitoring your VPC traffic, right?

00:07 Where traffic can be captured in a CloudWatch or S3,

00:10 and then you can analyze this traffic

00:11 for maybe any anomalies,

00:15 or you want to see a certain pattern of the traffic, right?

00:19 But that happens typically in,

00:21 I would say offline mode,

00:23 or maybe you first capture the logs

00:24 and then you do analysis.

00:27 But in certain cases you want to do,

00:29 you know, real-time monitoring of your traffic.

00:32 And now, one way could be

00:34 to have the IPS and IDS system in place

00:38 and all the traffic should be going through

00:40 that IDS-IPS system.

00:42 And from there,

00:42 it is routed to your destination application host, right?

00:47 But again, it adds additional hops to your traffic, right?

00:50 And it may degrade your latency

00:53 or performance of overall network, right?

00:57 There is a better way to do this,

00:58 which called VPC Traffic Mirroring.

01:01 As the word suggests, the mirroring.

01:03 That means whatever traffic flows

01:05 in and out of your network, or particularly through ENI,

01:10 the same traffic in real time can be mirrored

01:14 to another target.

01:15 And then you can run your network monitoring system

01:18 on that target to see any malicious behavior

01:23 into your traffic.

01:24 So that's the use case for this VPC Traffic Mirroring.

01:28 So let's talk shortly about this.

01:32 This I haven't seen much coming into the exam,

01:35 but as we are talking about monitoring the traffic,

01:38 it is good to know about this traffic mirroring.

01:42 So what it means is it copies your network traffic from ENI,

01:47 of EC2 instances, of course.

01:50 And then it sends that traffic to

01:53 another monitoring appliances,

01:55 or content inspection or threat monitoring system,

01:59 or maybe for troubleshooting, right?

02:01 So this is a relatively new feature.

02:02 And in the VPC console,

02:04 you can see these options where you can

02:08 define the Mirror Targets,

02:10 Mirror Filters, and the Mirror Sessions.

02:12 And once these sessions are started, all the traffic,

02:17 which hits the ENI is mirrored to another target,

02:21 where you can monitor that.

02:23 So the steps to configure the traffic mirroring

02:26 is you create a mirror target first.

02:29 Now target could be another EC2 instance.

02:33 Ultimately an ENI.

02:35 Or you can also send all the traffic to

02:38 Network Load Balancer.

02:40 Now those could be your target.

02:42 Then you can define the filter.

02:44 Now, what does filter means?

02:46 You can actually filter

02:47 which traffic you want to mirror, right?

02:50 Maybe from particular source IP

02:52 or for particular destination IP,

02:55 or from,

02:57 for a particular source port or destination port.

02:59 All these kind of filters you can apply

03:02 so that you know,

03:03 you don't inspect all the traffic all the time.

03:06 Only interested traffic or interested packets,

03:10 you can mirror and then inspect, right?

03:13 And finally you create a mirror session

03:15 once you have the mirror target and define the filter.

03:19 So if you look at this diagram.

03:22 in the first subnet,

03:24 I have a traffic source, which is EC2 instance.

03:27 And as you know, EC2 has ENI.

03:30 And now I can define the traffic mirroring

03:33 for that ENI as a source.

03:35 And the destination is another ENI,

03:38 and which is attached to

03:39 another traffic analyzer application.

03:42 And I can now define the session

03:46 where it captures all the traffic

03:47 from this ENI to this ENI, right?

03:51 Now here, ENI is a target.

03:53 As I said, the target could also be NLB,

03:56 Network Load Balancer.

03:57 So source remains the same,

03:59 but in target system now I have a NLB

04:02 and then you have the traffic analyzer applications

04:05 running on maybe a single or multiple instances.

04:08 And this is how you can,

04:10 you can capture the traffic through NLB as well.

04:13 So either of the configuration is okay,

04:15 depending on how much traffic you capture

04:19 and how many applications you are running.

04:21 You can have NLB or a single ENI.

04:25 Now you can also define filters, as I said.

04:28 So, this is say a source EC2 instance.

04:32 Which is say, instance A

04:34 traffic goes in and out of this instance,

04:36 and while the traffic flows in and out,

04:38 you can define the filter which captures this

04:42 and then mirrors to ENI or NLB.

04:45 So, the center block here

04:48 represents the mirror target basically.

04:50 And then these filters,

04:51 you can apply to multiple instances in your VPC.

04:55 And according to the filter,

04:57 all the traffic from all those sources

04:59 will be going to your target,

05:03 ENI or NLB.

05:04 So, traffic filter parameters are like inbound or outbound.

05:09 You can decide which traffic to capture

05:11 or which traffic to mirror,

05:13 whether inbound or outbound.

05:15 Whether accepted or rejected traffic has to be mirrored.

05:19 Which protocol?

05:20 So it supports L4, layer 4 protocol only.

05:23 Then a source port and destination port range

05:25 that you want to capture.

05:27 And then, source CIDR block and destination CIDR block.

05:30 So you can very well define the filter

05:32 using all these parameters

05:34 and only interesting traffic you can mirror, right?

05:38 To the target, okay?

05:41 So with that, let's recap what we just learned,

05:43 and this is important for your exam to remember.

05:45 So VPC Traffic Mirroring basically

05:49 captures the traffic which flows in and out of your VPC,

05:52 and then you can mirror that and send it to a

05:55 potential network and security anomalies tool.

05:58 That's the purpose of VPC Traffic Mirroring.

06:01 The source of the traffic is always ENI,

06:04 Elastic Network Interface,

06:05 which is attached to your EC2 instance.

06:08 Now mirror target could be either another ENI,

06:11 which is attached to EC2 instance,

06:13 or it could be Network Load Balancer.

06:15 Now remember that in case of Network Load Balancer,

06:18 the UDP port is 4789.

06:22 So on the Network Load Balancer site,

06:24 this port should be open.

06:26 And also remember that on your port site,

06:30 the target port should also be open.

06:33 Typically in security group,

06:35 all the outbound traffic is open, but if it's not,

06:37 you have to make sure that it can go

06:39 to the UDP-4789 of your Network Load Balancer.

06:44 Now, when the mirror traffic happens,

06:47 you can also do the filtering.

06:49 And why we need filtering?

06:50 As I said,

06:51 because you want to only capture

06:53 certain type of the traffic.

06:55 Now that could be based on the source CIDR

06:57 or destination CIDR.

06:59 It could be based on the protocols.

07:00 It could be based on the ports as well.

07:03 And you can define multiple rules

07:05 for your traffic mirroring,

07:06 and these rules are numbered.

07:08 And of course you would have multiple rules because

07:11 maybe for UDP traffic

07:13 you want to send those packets to a different destination

07:17 where you can analyze that.

07:18 For UDP traffic

07:19 you want to send it to a different destination

07:21 for mirroring the traffic.

07:23 Or in some cases,

07:24 if the traffic is coming from particular source IP address,

07:27 you want to again send it to a different target mirror,

07:31 mirror target basically.

07:33 That all you can define in the rules

07:35 and whatever rules matches, according to the number,

07:38 it would send the traffic to a respective target.

07:42 Now, when you set up this traffic mirroring,

07:45 you know that that there is a source ENI,

07:47 there is a target ENI or Network Load Balancer.

07:50 Now these two things could be either in the same VPC

07:54 or they could also be in different VPCs.

07:57 But again,

07:58 the limitation is this VPC should be in the same region.

08:01 But then you can connect these VPCs

08:03 using intra-Region VPC peering

08:05 or intra-Region transit gateway.

08:08 So if your target VPCs in different regions,

08:11 that wouldn't be possible as of now,

08:14 but otherwise there is no restriction

08:16 that the traffic source

08:17 and the mirror target should be in the same VPC.

08:19 They can very well be across the VPCs.

08:23 Further, the Source and Destination ENIs,

08:27 or you can say mirror source and mirror target

08:29 could be in different AWS accounts as well.

08:33 Now, this is interesting because many a times maybe

08:36 you are hosting your network packet analysis tool

08:40 into your VPC

08:41 and you want to give that as a service to your customers.

08:44 Now, in that case your customers would have their VPC

08:46 in their own AWS account,

08:48 and then you can set up a VPC peering

08:50 between these two VPCs.

08:52 Though these VPCs are owned by different entities,

08:54 you can still monitor the traffic from your customers VPC.

08:58 So that is kind of a use case

08:59 you can also implement using the VPC Traffic Mirroring.

09:04 So I think that's it,

09:05 what you need to know about VPC Traffic Mirroring.

09:08 And I haven't seen that, this coming much into the exam,

09:13 but as we are learning everything about networking,

09:15 it's good to know.

09:17 So that's it about this lecture.

09:18 See you in the next lecture.

09:20 Thank you.