Lecture 51: Walkthrough: VPC Reachability Analyzer
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:07
- 来源：Udemy Lecture 41570984
- Slide 数量：10
- 画面切换：01:10、02:23、03:39、04:12、04:34、05:26、05:54、06:43、07:38
扫描说明
逐条检查了 Udemy 页面中的 178 条 Transcript cue，并对全长 09:07 的视频画面进行扫描。按照每次控制台操作的独立目标与分析结果，将演示划分为 10 个实操阶段。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 实验设计：逐层制造 SSH 可达性问题
时间范围：00:00–01:10
总结 / Summary
中文
实验在一个 VPC 的子网（Subnet）中启动 EC2，并尝试从工作站通过 SSH 访问。讲师依次模拟私有子网（private subnet）缺少互联网路由、NACL 入站阻断和安全组（Security Group）入站阻断，再用 VPC 可达性分析器（VPC Reachability Analyzer）定位每个问题；同时提醒每次路径分析都会计费。
English
The lab launches an EC2 instance in a VPC subnet and attempts SSH access from a workstation. It deliberately introduces a private-subnet routing problem, an inbound NACL block, and an inbound Security Group block, then uses VPC Reachability Analyzer to locate each issue. Each path analysis incurs a charge.
Transcript
00:00 Okay. This is a quick exercise for VPC reachability analyzer.
00:04 The setup is pretty simple where we have
00:06 VPC and a Subnet
00:07 in which we have EC2 instance.
00:09 And then we want to access this instance over
00:12 SSH from our workstation.
00:14 So the connectivity will look something like this.
00:17 Now here we'll try a few scenarios.
00:20 So very first thing that we will do is purposefully
00:22 we will launch this instance in a private Subnet
00:25 and then see what the network reachability analyzer tells us, right?
00:30 Then we'll modify the
00:32 Subnet and make it public
00:33 and then further, we'll modify the Network-ACL rule
00:37 not to allow the traffic.
00:39 And then finally, we will update the security group
00:41 and test the connectivity through the reachability analyzer.
00:46 Now, for you, a word of caution,
00:48 there is a charge for, you know, every analysis that you perform.
00:52 And in my opinion, this charge is little higher than I would have expected.
00:57 So for this lab,
00:58 you might get four times this cost because we
01:01 are going to run this analysis four times,
01:04 right? So bear that in mind.
01:06 So let's go to
01:07 AWS console and set this up
2. 创建 VPC、IGW、私有子网与路由表
时间范围：01:10–02:23
总结 / Summary
中文
在 Mumbai 区域创建演示 VPC、互联网网关（Internet Gateway, IGW）、子网和关联路由表（Route Table）。IGW 已附加到 VPC，但路由表故意不添加默认互联网路由，因此该子网仍然是私有子网（private subnet）。
English
In the Mumbai Region, the instructor creates a demo VPC, Internet Gateway, subnet, and associated route table. The IGW is attached to the VPC, but the route table intentionally omits a default internet route, so the subnet remains private.
Transcript
01:10 Okay. So I am in Mumbai Region and I'm in my VPC console.
01:14 First thing I'm just going to do is to create my VPC
01:18 with the name
01:19 demo
01:19 and some CIDR
01:22 and just create the VPC. And again, I want to create internet Gateway
01:28 so that I can later connect over the internet.
01:32 And I also want to attach this to my VPC,
01:38 right?
01:39 And now I want to create a Subnet and this time,
01:41 I'm not going to create the public Subnet
01:44 and that's purposefully because we want to see the connectivity.
01:48 So let's call it a demo Subnet
01:51 and
01:52 in one of the availability zone
01:54 and let's give it some CIDR
01:56 range,
01:58 that's it.
01:59 And we also want to create corresponding route table.
02:03 So let's call it demo
02:05 root table in this
02:06 VPC.
02:07 And I'm not going to create a public route here,
02:11 but just one thing, make sure that you associate this route table with our Subnet.
02:17 Okay. Everything is done.
02:19 Now, let's go to the EC2 instance and launch one of the instance.
3. 启动带公网 IP 的 EC2 并允许 SSH
时间范围：02:23–03:39
总结 / Summary
中文
EC2 实例被放入演示子网并分配公网 IP，同时创建允许来自任意地址的 SSH 入站规则。即使实例有公网 IP、安全组（Security Group）也允许 TCP/22，只要子网路由表没有指向 IGW 的默认路由，实例仍无法从互联网访问。
English
The EC2 instance is placed in the demo subnet, assigned a public IP, and given an inbound rule allowing SSH. Even with a public IP and a Security Group that permits TCP port 22, the instance remains unreachable from the internet because the subnet route table lacks a default route to the IGW.
Transcript
02:23 Let's call it demo again.
02:26 And here
02:28 make sure that you use your key pair and edit this network to select your VPC
02:33 and then your Subnet.
02:35 Now, here we want to assign the public IP to the instance because ultimately,
02:39 we want to connect over the public IP.
02:42 And this is how typically, you know, when you start with
02:45 AWS, your setup will look like, right?
02:47 And most of the time some students make mistakes
02:50 where they accidentally launch the instance in a private Subnet
02:53 and then they are not able to connect.
02:55 So I would say this is one of the, you know, very basic problem that most of, you know,
02:59 newcomers in AWS face.
03:01 And in that case VPC reachability analyzer can help you to detect such problems.
03:06 Ok. Moving on.
03:07 So we are assigning the public IP and we are going to create our own security group
03:13 and in the security group, we are going to open
03:16 SSH from anywhere. That's it we want,
03:18 and that's it. Let's launch the instance.
03:23 Now at this moment, if you see the instance, it has a public IP
03:27 and once it is in a running state, we will try to connect it over
03:32 SSH.
03:33 So let me pause this video for maybe 30
03:35 seconds till the time instance comes in running state.
4. 验证 SSH 连接失败
时间范围：03:39–04:12
总结 / Summary
中文
讲师使用实例公网 IP 和私钥（private key）发起 SSH 连接，连接按预期超时。这个步骤先用真实连接确认症状，再交给配置分析工具解释故障点。
English
The instructor attempts SSH with the instance's public IP and private key, and the connection times out as expected. This first confirms the symptom with a real connection before using configuration analysis to explain the failure.
Transcript
03:39 Okay? So instance is in running state. I'm just grabbing its public IP.
03:44 OK? So let me put the public IP and then load my SSH key
03:50 which will be of course your private key. So I'm loading my PPK
03:53 file and opening this connection
03:56 and as expected, it won't work
03:58 because we launched this instance in a private Subnet.
04:02 Okay. So you may get
04:04 something like this which is expected.
04:07 Now let's go to the VPC
04:09 reachability analyzer and also check from there.
5. 在 Network Manager 中打开 Reachability Analyzer
时间范围：04:12–04:34
总结 / Summary
中文
VPC 可达性分析器（VPC Reachability Analyzer）已逐步迁移到 AWS Network Manager 的 Monitoring and troubleshooting 区域。执行分析前必须确认当前 AWS 区域（Region）与实验资源所在区域一致。
English
VPC Reachability Analyzer is being surfaced under the Monitoring and troubleshooting area of AWS Network Manager. Before creating an analysis, the selected AWS Region must match the Region containing the lab resources.
Transcript
04:12 Now earlier this reachability analyzer was part of the VPC console.
04:17 But now AWS
04:18 started moving this kind of, you know, tools into a Network Manager.
04:22 So in your case, it could be under the Network Manager.
04:26 So open the Network Manager
04:28 and if you go on the left side, you will see this reachability,
04:31 analyzer under monitoring and troubleshooting.
6. 创建 Internet Gateway 到 EC2 的 TCP 路径
时间范围：04:34–05:26
总结 / Summary
中文
创建路径时把互联网网关（Internet Gateway）设为源、EC2 实例设为目的地，并选择 TCP 协议以模拟 SSH 流量。提交后 Reachability Analyzer 会基于当前配置分析路径，而不是发送真实 TCP 数据包。
English
The path is created with the Internet Gateway as the source, the EC2 instance as the destination, and TCP selected to represent SSH traffic. Reachability Analyzer evaluates the current configuration rather than sending real TCP packets.
Transcript
04:34 Now here make sure that you are in the Mumbai Region.
04:38 And
04:38 what we want to do is to create and analyze the path. So let's give it a name, demo,
04:43 EC2
04:44 EC2
04:45 path
04:47 and then source type is internet Gateway
04:50 and let's select demo, internet Gateway
04:53 and destination is EC2 instance which is here.
04:57 And that's our
04:58 demo
04:59 instance.
05:00 Now protocol, it supports
05:02 TCP and UDP. So SSH works on the
05:05 TCP. So let's select that
05:07 and now let's create and analyze the path.
05:10 So it generally takes like 10-15 seconds for this path to be tested.
05:14 So let's wait for a couple of seconds.
05:17 You can just refresh this.
05:21 So if you want, you can just wait and refresh this.
05:25 OK? So
7. 不可达结果：路由表缺少 Internet Gateway 路由
时间范围：05:26–05:54
总结 / Summary
中文
第一次分析返回 Not reachable，并明确指出演示路由表没有通往互联网网关（Internet Gateway）的路由。反向查看路径也会显示同一配置缺口，说明工具能够把抽象的 SSH 超时定位到具体路由表。
English
The first analysis returns Not reachable and identifies that the demo route table has no route to the Internet Gateway. Reversing the path exposes the same configuration gap, showing how the tool maps an abstract SSH timeout to a specific route table.
Transcript
05:26 it has analyzed the path and it says it's not reachable
05:31 and this was expected, right?
05:32 And if you just go down and see the reason,
05:34 it tells that the route table does not have the route to the internet Gateway.
05:39 And that's exactly what's the problem.
05:41 And if you just do something like reverse the path,
05:45 it will tell you that this route table which is demo RT
05:48 doesn't have route to the destination.
05:51 And this is how you exactly know where the problem is.
8. 添加默认路由并重新分析为 Reachable
时间范围：05:54–06:43
总结 / Summary
中文
在路由表中添加指向 IGW 的互联网路由后，重新运行已有路径分析，状态变为 Reachable，并列出流量经过的资源。复用同一路径可快速验证配置修改是否解决问题。
English
After an internet route to the IGW is added to the route table, rerunning the existing path changes the status to Reachable and lists the traversed resources. Reusing the same path provides a quick verification that the configuration change fixed the issue.
Transcript
05:54 Now, of course, what you can do is you can just go to your route table
05:58 and now modify this route table and say if the traffic is going to the internet
06:04 or coming from the internet, then it has to
06:07 go through the internet Gateway.
06:09 Now, once you do that, you can just come here again
06:12 and you already have this path. So you can just analyze the path again.
06:17 So just say confirm
06:19 and then it will again, start analyzing the path.
06:23 So let's wait for again a couple of seconds.
06:26 Okay.
06:27 Now this time,
06:27 it says the reachability status is reachable and it
06:31 will exactly show you how the path is getting traversed.
06:35 OK. So this was expected. Now let's modify the Network-Access-Control-List
06:40 and then see how it affects the traffic.
9. 移除 NACL 入站允许规则并定位阻断
时间范围：06:43–07:38
总结 / Summary
中文
删除子网关联 NACL 的入站允许规则后再次分析，路径失败。结果将网络访问控制列表（Network Access Control List, NACL）标为红色阻断点，并说明它不允许相应入站流量。
English
After the inbound allow rule is removed from the subnet's NACL, the path analysis fails. The result highlights the Network Access Control List as the blocking component and explains that the required inbound traffic is not permitted.
Transcript
06:43 So let's go here and let's go to the
06:45 subnets.
06:46 So we have this demo
06:47 Subnet and there is a Network-Access-Control-List.
06:50 So you can just go down here and click the Network-Access-Control-List.
06:54 So it will take you here then look at the inbound rules.
06:58 So this is inbound rule which allows all the traffic.
07:01 So let's go and remove this rule and save the changes.
07:07 Now again, let's go here and analyze the path and confirm,
07:15 okay, it failed as expected.
07:17 And if you just go down,
07:19 it tells you that Network-ACL does not allow the inbound traffic from this Subnet
07:24 to the VPC,
07:25 right? And it is exactly the reason also shown or marked as in the red.
07:31 So
07:32 you know that what's the problem?
07:33 Now, let's try the last scenario which is blocking at the security group level.
10. 恢复 NACL、删除 Security Group 规则并定位不匹配
时间范围：07:38–09:07
总结 / Summary
中文
恢复 NACL 规则后，讲师删除安全组（Security Group）的 SSH 入站规则并重新分析。结果再次为 Not reachable，并给出 Security Group rule mismatch，准确指出没有允许该入站流量的规则；实验结束后应终止 EC2 并清理资源以避免费用。
English
After restoring the NACL rule, the instructor deletes the Security Group's inbound SSH rule and reruns the analysis. The path is again Not reachable, with a Security Group rule mismatch explaining that no rule permits the traffic. The EC2 instance and other lab resources should be cleaned up afterward to avoid charges.
Transcript
07:38 So let's go back to the Network-ACL, let's go back to the inbound rule
07:43 and make sure that we add our inbound rule back with all the traffic from everywhere.
07:51 And now instead let's go to the
07:54 security groups here
07:56 and we had this demo security group
08:01 and in the inbound rules, we had this rule.
08:04 So let's now delete this rule and save the changes.
08:08 Okay, let's go back here and analyze the path again.
08:14 So it will start the test again
08:17 and now
08:18 let's wait again for a couple of seconds.
08:21 Okay. So as expected, the result is not reachable. And here it exactly tells you that
08:28 SG rule mismatch, that means there is no rule which allows the inbound traffic
08:33 and that's what we were expecting.
08:36 So that essentially is the network reachability analyzer.
08:41 And it is very helpful when you want to troubleshoot any
08:43 kind of networking issues between any source and the destination.
08:48 Finally, if you have done this exercise,
08:50 just go and terminate your machines because you may be otherwise paying for those.
08:56 So that's it for this lecture.
08:57 And next, we will see network access analyzer which is quite similar,
09:02 but the purpose is different.
09:04 So see you in the next lecture
整讲总结 / Overall Summary
中文
本演示用同一条 Internet Gateway 到 EC2 的 TCP 路径逐层验证了三类典型错误：缺少 IGW 路由、NACL 入站阻断和安全组（Security Group）规则不匹配。VPC 可达性分析器（VPC Reachability Analyzer）的价值在于把“SSH 超时”转化为可读的逐跳路径和明确阻断组件，并可在每次配置修正后复用路径做验证。
English
Using the same TCP path from an Internet Gateway to EC2, this walkthrough validates three common errors: a missing IGW route, an inbound NACL block, and a Security Group rule mismatch. VPC Reachability Analyzer turns an SSH timeout into a readable hop-by-hop path and a precise blocking component, and the path can be rerun after each configuration change for verification.
返回顶部 ↑