网络课程笔记

00:00 Hi. So in this lecture, let's understand VPC reachability analyzer.

00:04 So as I said in the previous lecture,

00:06 it is used to analyze whether you can reach from source to the destination.

00:11 And if given this kind of architecture

00:14 where you have VPC, internet Gateway, couple of public subnets, private subnets.

00:19 And of course, in the VPC,

00:20 you have additional components like

00:22 security groups and then Network-Access-Control-List

00:26 and these components are also analyzed for

00:28 testing the reachability to the destination.

00:31 So if source is internet Gateway and the destination

00:34 is one of the instance in a public Subnet,

00:37 maybe your web server tier, then you can configure that instance as a destination

00:42 and then you can run this analysis.

00:44 And in the analysis result, it will show you whether from the source,

00:48 you can reach to the destination.

00:51 And also if required, you want to track the reverse path. Right

00:55 now,

00:55 In here, the source is internet Gateway and the destination is EC2 instance.

01:00 But the source can be anything right? It could be your EC2 instance in one of the

01:06 Subnet and the destination could be again

01:08 internet Gateway or another EC2 instance

01:10 in the same VPC or this instance can also be in a different VPC.

01:16 And sometimes this traffic can go through the NAT gateways to the internet Gateway.

01:21 So VPC reachability analyzer will tell you hop by hop

01:25 how the traffic is flowing from source to the destination.

01:30 So it produces hop by hop details of the virtual network path.

01:34 Also it will tell you that what is blocking that traffic.

01:38 For example, if you have security group,

01:40 which doesn't have the allow rules for the source IP address,

01:44 then it will tell you that this security group is not allowing that traffic.

01:49 Or if you have Network-Access-Control-List, which is blocking that traffic,

01:53 then it will also flag that as a blocking component

01:57 and we will see that shortly during the exercise.

02:00 But the point here is that the VPC reachability analyzer will exactly

02:04 tell you where is the problem and then you can go and fix that

02:08 and just one more thing while doing this analysis,

02:11 it doesn't actually send any traffic.

02:14 So it all works based on your network configuration in your

02:19 AWS account.

02:19 So it just analyzes all the networking components and their configurations

02:24 and then give you the result without actually sending any traffic.

02:29 So what are the use cases?

02:31 Of course, the first use case is to troubleshoot the network connectivity issues.

02:36 And more than that, I think

02:38 one another important use case is to automate the testing of your network.

02:43 For example, if you are using infrastructure as a code for deploying your networks.

02:48 And whenever you make any changes to your network configuration,

02:52 you want to make sure that everything is working as expected.

02:55 That means your web server tier is accessible over

02:58 the internet or your database tier is accessible from your

03:02 web tier.

03:03 All that can be done in an automated manner.

03:06 If you have corresponding VPC reachability analyzer

03:09 test included in your CI/CD pipeline.

03:12 And if any of the test fails, then you can stop your CI/CD pipeline

03:17 and raise that as an issue.

03:19 So that's another good example of use case

03:22 where you can use VPC reachability analyzer

03:26 right

03:27 now, what are the sources and the destination of the traffic that it supports?

03:31 So there are a bunch of components here and you can see that on this slide, right?

03:37 And few limitations that you need to know at this moment.

03:41 And of course,

03:42 AWS will probably launch more features to address these limitations.

03:46 But as of now, the source and the destination of the traffic must be in the same

03:51 AWS Region,

03:52 which means source and destination can be in the

03:55 same VPC or they could be in different VPCs

03:58 in the same

03:59 AWS Region.

04:01 And then the connectivity between these two VPCs could

04:03 be over Transit Gateway or the VPC peering connection.

04:07 And the good thing is that it can work across

04:10 AWS account in a given

04:12 AWS organization.

04:14 So this is useful where you have multi account setup,

04:16 where you have a separate account for network and

04:19 rest of the accounts for say application deployment.

04:21 Then also you can use VPC reachability analyzer.

04:25 So I hope that is clear.

04:27 And just last thing that it currently supports only IPv4 traffic,

04:31 which means it doesn't support IPv6 traffic,

04:34 but in the future,

04:36 AWS may support that. So just look at the

04:39 AWS announcements for that.

04:41 Okay. Now with that, let's quickly see how the

04:44 successful connection looks like and unsuccessful connection look like.

04:48 So on the left side,

04:49 you can see the destination is reachable and it

04:52 will trace down all the components in that path.

04:55 So in this example,

04:56 we are using source as internet Gateway and destination as our EC2 machine.

05:01 And it shows that the traffic is coming from internet Gateway

05:05 and then it is hitting the Network-ACL for the

05:08 Subnet in which you have launched your EC2 instance

05:11 and then it hits the security group

05:13 and finally it hits the

05:15 ENI

05:15 which is attached to this instance.

05:20 And on the right side, it

05:21 is the same case, but we have the security group which doesn't have the allow rule.

05:27 And that's where it is flagged as you know,

05:30 not allowing that traffic to flow in.

05:32 So if you get this kind of map, then you can very well see where is the problem

05:37 and then you can go and fix that problem.

05:40 So that's essentially is VPC reachability analyzer.

05:44 And if you're interested to further see this in action,

05:47 then we are going to do a quick exercise in the next lecture.

05:50 Thank you.