Lecture 56: VPC Peering invalid scenarios
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:01
- 来源：Udemy Lecture 26073748
- Slide 数量：4
- 画面切换：00:17、01:56、02:57
扫描说明
逐条检查了 Udemy 页面中的 102 条 Transcript cue，并对全长 05:01 的视频画面进行扫描。画面依次介绍 Peering 基础限制、VPN/Direct Connect 非法中转，以及 IGW、NAT Gateway 与 VPC Endpoint 非法共享场景，共识别出 4 张不同的 Slide。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Peering 限制导论
时间范围：00:00–00:17
总结 / Summary
中文
本讲集中说明 VPC 对等连接（VPC Peering）的地址、拓扑和资源共享限制，尤其是考试中容易误判为可行的传递式路由场景。
English
This lecture focuses on address, topology, and resource-sharing limitations of VPC Peering, especially transitive-routing scenarios that are easy to mistake for valid designs.
Transcript
00:00 Hello, and welcome to this lecture.
00:01 Now let's look at some of the limitations with VPC peering,
00:05 and then some certain cases in which VPC peering connection
00:09 won't work.
00:11 And let's understand that.
00:13 So VPC peering should not have the overlapping CIDR
2. 重叠 CIDR、非传递性与连接配额
时间范围：00:17–01:56
总结 / Summary
中文
两个对等 VPC 的 CIDR 不能相同或部分重叠。Peering 是非传递的（non-transitive）：即使 A↔B、B↔C，A 也不能经 B 到达 C，必须单独建立 A↔C 连接。任意两个 VPC 之间只能有一个 Peering Connection，不需要用多个连接增加带宽或高可用性。视频还给出每个 VPC 最多 125 个 Peering 连接的考试数字；实际部署应核对当前 Service Quotas。
English
Peer VPC CIDRs cannot be identical or partially overlapping. Peering is non-transitive: A-to-B and B-to-C connections do not let A reach C through B, so A-to-C needs its own peering connection. Only one peering connection can exist between a given VPC pair; multiple connections are neither required nor allowed for bandwidth or high availability. The video cites 125 peering connections per VPC as an exam figure; current Service Quotas should be checked for real deployments.
Transcript
00:17 between two VPCs. That's what we also saw.
00:20 So if two VPCs have the same CIDR as shown here,
00:23 it won't work. In fact,
00:24 if another VPC has a subset of this CIDR,
00:28 then also, it won't work because ultimately they are
00:30 overlapping CIDR.
00:31 So even if the prefix here would have been 24,
00:35 it wouldn't have worked. So this does not work.
00:38 Second, the VPC peering connection is non transitive.
00:42 What that means?
00:43 If you have a peer in connection
00:45 from VPC A to B and from B to C,
00:49 that does not make the traffic flowing through A to C,
00:53 it cannot go like this and here, right?
00:56 So VPC A and VPC C still cannot communicate.
01:00 It's non transitive peering connection.
01:04 Third, you cannot,
01:07 you can set up only one VPC peering connection between
01:10 any two VPCs. So between this A and B,
01:14 there is only one peering connection.
01:16 You might think, maybe for high availability
01:19 or for more bandwidth,
01:21 you have to set up multiple peering connection,
01:23 but it is not required and you cannot even do that.
01:27 So this is not possible.
01:30 For the maximum connection that you can have per VPC
01:33 is 125.
01:35 So if more than 125 VPCs you want to connect to the,
01:39 any of the VPCs, you cannot.
01:42 So you need to remember this so that in the exam,
01:45 you can select the right answer based on that.
01:47 Now let's look at some of the invalid scenarios when you use
01:51 a VPC peering connection.
01:52 And let me explain what I mean by that.
3. 无效场景：经 Peered VPC 使用 VPN 或 Direct Connect
时间范围：01:56–02:57
总结 / Summary
中文
若 VPC-B 通过站点到站点 VPN（Site-to-Site VPN）或 AWS Direct Connect 连接本地数据中心，Peered VPC-A 不能把 B 当作中转来访问本地网络。原因仍是 Peering 不支持传递式路由；流量应终止在对等 VPC 的资源，而不能继续穿越其混合网络连接。
English
If VPC-B connects to an on-premises data center through Site-to-Site VPN or AWS Direct Connect, peered VPC-A cannot use B as a transit network to reach on premises. Peering does not support transitive routing, so traffic cannot continue through the peer's hybrid connection.
Transcript
01:56 So VPC peering, invalid scenarios like VPN or DX.
02:01 What it means is, suppose you have VPC A and VPC B
02:04 and connected through a VPC peering connection.
02:07 And suppose we VPC is now connected to on-premise network
02:11 over a VPN or a direct connect. Now, in this case,
02:15 what you would expect probably from VPC A,
02:18 I can reach to the machine in this corporate data center
02:21 or the other way around, but it does not work.
02:25 That means the traffic cannot go from VPC A
02:28 to the corporate data center.
02:30 That's for the same reason that VPC peering connections
02:34 are non transitive.
02:36 That means the traffic should end into the VPC B
02:39 EC2 instance over network interface, only.
02:42 It cannot go beyond that.
02:45 There are certain workarounds to do that,
02:47 like using proxy and all,
02:48 but with a simple setup like this, it won't work.
02:53 Second, VPC peering connection cannot also
4. 无效场景：共享 IGW、NAT Gateway 或 VPC Endpoint
时间范围：02:57–05:01
总结 / Summary
中文
VPC-A 不能经 Peering 使用 VPC-B 的互联网网关（Internet Gateway）或 NAT 网关（NAT Gateway）上网，也不能通过 B 的网关 VPC 端点（Gateway VPC Endpoint）访问 S3 或 DynamoDB。Peering 只提供两个 VPC 资源之间的直接私有可达性，不会把一方的边缘网关或服务端点传递给另一方。
English
VPC-A cannot use VPC-B's Internet Gateway or NAT Gateway for internet access through peering, nor can it use B's gateway VPC Endpoint to reach S3 or DynamoDB. Peering provides direct private reachability between resources in the two VPCs; it does not transitively share a peer's edge gateways or service endpoints.
Transcript
02:57 get you to the internet gateway from another VPC.
03:01 Now, what do I mean? Again, VPC A is connected to VPC B
03:05 through peering connection,
03:06 and suppose VPC B has an internet gateway.
03:10 Then one would think that this VPC
03:13 does not have internet gateway
03:14 then can I use the internet gateway of VPC B.
03:17 Because I'm already connected to the VPC B, but again,
03:21 this is not a valid scenario.
03:23 You can't have this connectivity.
03:25 And same goes for even the NAT gateway.
03:28 In VPC B If you have the NAT gateway,
03:31 then also from VPC A through peering connection,
03:34 you cannot reach to the internet via that NAT gateway.
03:37 So understand that because then in the exam, you will know,
03:41 given this situation,
03:42 you cannot use VPC peering as an option here.
03:46 Okay, one more thing to remember
03:48 if the VCB B has a VPC endpoint,
03:52 and we will learn shortly in the next lecture,
03:54 what does endpoint mean.
03:56 But essentially, endpoints are having
03:59 the private connectivity between your VPC and AWS services
04:03 like S3 and DynamoDb that I've shown you.
04:06 So without having the internet,
04:07 you can reach to this service in the same AWS region.
04:11 So if you have VPC endpoint point created in VPC B,
04:15 you can still reach to those end points and you can't access
04:18 S3 or DynamoDb from VPC A
04:21 through the VPC peering connection.
04:23 So even this connection is not possible.
04:26 So just to summarize,
04:27 a VPC peering connection cannot be established
04:30 If there are overlapping CIDR connection between VPCs,
04:34 then VPC peering connections are non transitive.
04:37 That means VPC connection from A to B and B to C
04:40 does not mean you can go from A to C
04:42 and then these are a few invalid scenarios
04:45 where you can't reach to internet gateway
04:48 or NAT gateway or VPC endpoint in the peered VPC from your
04:53 original VPC.
04:55 And these are important to understand for your exam.
04:58 So that's it for this lecture. Thank you.
整讲总结 / Overall Summary
中文
VPC 对等连接（VPC Peering）的关键限制可以概括为：CIDR 不得重叠、路由不具传递性、任意 VPC 对只有一个连接，并且不能借用对端的 VPN、Direct Connect、IGW、NAT Gateway 或 VPC Endpoint。凡是需要中心化中转或共享出口的架构，都应考虑其他服务而不是把 Peering 当作路由器。
English
The key VPC Peering limitations are non-overlapping CIDRs, non-transitive routing, one connection per VPC pair, and no use of a peer's VPN, Direct Connect, IGW, NAT Gateway, or VPC Endpoint. Architectures that require centralized transit or shared egress need a different service rather than treating peering as a router.
返回顶部 ↑