Lecture 76: Transit Gateway VPC attachments and Routing
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:28
- 来源：Udemy Lecture 28586283
- Slide 数量：4
- 画面切换：00:39、01:36、03:41
扫描说明
逐条检查了 Udemy 页面中的 150 条 Transcript cue，并对全长约 06:28 的视频画面进行扫描。依据标题、VPC Attachments、Transit Gateway Route Table 与 VPC Route Table 的画面切换，共划分出 4 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Transit Gateway VPC Attachments 导论
时间范围：00:00–00:39
总结 / Summary
中文
本讲聚焦如何使用 VPC 附件（VPC Attachment）把多个 VPC 连接到中转网关（Transit Gateway, TGW），并解释 TGW Route Table 与 VPC Route Table 如何协同完成双向路由。
English
This lecture focuses on connecting multiple VPCs to a Transit Gateway (TGW) with VPC Attachments and explains how TGW and VPC route tables cooperate to provide bidirectional routing.
Transcript
00:00 Hello, and welcome to this lecture.
00:01 Now that we have seen that transit gateway
00:03 can be used to connect VPCs, VPN connection,
00:08 direct connect gateway,
00:09 as well as you can have the third party softwares,
00:12 and transit gateways can be peered
00:14 across the regions as well.
00:15 Now, in this lecture,
00:16 let's look at how to connect VPCs to transit gateway
00:20 with VPC attachments.
00:22 Now, having said that the connection with the VPN,
00:26 as well as direct connect,
00:27 we will cover that in the respective section
00:29 when we talk about the VPN as well as direct connect.
00:33 So now let's look at how VPCs connect
00:35 to the transit gateway.
00:37 Now the architecture looks very simple.
2. 创建 VPC Attachments 与 CIDR 约束
时间范围：00:39–01:36
总结 / Summary
中文
每个 VPC 通过独立 Attachment 连接到 TGW；创建 Attachment 时选择类型和对应 VPC。所有连接到同一 TGW 的 VPC 必须使用不重叠 CIDR（non-overlapping CIDRs）。连接后 TGW 可提供类似 Full Mesh 的 VPC 间可达性。
English
Each VPC connects to the TGW through its own attachment, whose type and target VPC are selected at creation. VPCs attached to the same TGW must use non-overlapping CIDRs. Once connected, the TGW can provide full-mesh-like reachability among them.
Transcript
00:39 That should be multiple VPCs
00:41 and then there is transit gateway.
00:44 And what you do is create an attachment
00:46 with the transit gateway.
00:48 While you create that attachment,
00:50 you decide this attachment is for the VPCs or a VPN
00:54 and then if it is a VPC attachment,
00:57 of course you would have to select the corresponding VPCs
00:59 as well.
01:00 Now, in this architecture I'm showing you three attachments
01:04 and there is a centralized transit gateway.
01:06 Now there are certain restrictions
01:08 when you connect VPCs to the transit gateway
01:11 and the obvious one is that VPC CIDR
01:14 should not be overlapping.
01:16 So you can't connect the VPCs
01:18 which have the overlapping CIDRs.
01:21 Now with that,
01:22 let's understand now how the routing happens
01:24 when you connect multiple VPCs.
01:26 Now, as I said, with transit gateway,
01:29 you get full mesh kind of connectivity, right?
01:31 That means any VPC can talk to any other VPC.
01:35 So how does it really happens?
3. Transit Gateway Route Table 与 Route Propagation
时间范围：01:36–03:41
总结 / Summary
中文
TGW 默认路由表（default TGW route table）决定流量应转发到哪个 Attachment。VPC Attachment 创建后，各 VPC CIDR Route 会自动传播（route propagation）到 TGW Route Table，并以对应 Attachment 为 Target；因此抵达 TGW 的数据包可根据目的 CIDR 转发到 VPC B 或 VPC C。可通过自定义 Association 与 Propagation 控制路由隔离。
English
The default TGW route table determines which attachment receives traffic. After VPC attachments are created, their VPC CIDR routes automatically propagate into the TGW route table with the corresponding attachment as the target. Packets reaching the TGW can therefore be forwarded to VPC B or VPC C by destination CIDR. Custom associations and propagation can later control isolation.
Transcript
01:36 Now let's take an example there is VPC A, B, and C
01:41 with non-overlapping CIDRs as shown here,
01:44 and then you create centralized transit gateway,
01:48 and then you create three attachment,
01:49 attachment A, attachment B, and attachment C.
01:52 Now when you create a transit gateway,
01:54 there will be a default route table of that transit gateway.
01:58 Now this route table governs how the traffic should flow
02:02 across the attached networks.
02:05 Now in this case the attached networks are VPCs.
02:08 Now as soon as you attach your transit gateway to the VPCs,
02:12 the VPC CIDR route get propagated
02:15 to this transit gateway route tables.
02:18 So all the routes that means 10.0.0.0/16,
02:23 and 10.1.0.0/16 and 10.2.0.0/16
02:27 will automatically get propagated
02:29 to the transit gateway route table,
02:31 something like this.
02:33 Now, as it happens,
02:35 now if the traffic from VPC A
02:37 reaches to the transit gateway,
02:39 it will look at the default route table
02:42 and it will see how to reach to the other VPCs,
02:45 right?
02:46 And in that case,
02:47 it can route traffic from any VPC to any other VPC.
02:52 So that's what transit gateway default route table does.
02:55 Now at the same time,
02:56 you also need to make sure your VPCs and the subnet
03:00 also have corresponding route tables
03:02 and those route tables have a route
03:05 to reach to the transit gateway.
03:08 Now what do I mean by that?
03:10 In this case the VPC CIDRs' routes
03:14 are automatically propagated to the transit gateway,
03:17 but then how does VPC know that the traffic
03:20 which should go to say 10.1.0.0/16
03:24 should go through this VPC attachment,
03:26 right?
03:27 It doesn't know that.
03:28 Now we have seen this all the time
03:30 whenever you have to connect multiple networks,
03:33 you also need to manage responding route.
03:36 So the route has to be managed at both end,
03:38 the transit gateway side as well as the VPC side.
4. VPC/Subnet Route Tables 的静态 TGW 路由
时间范围：03:41–06:28
总结 / Summary
中文
TGW Route Propagation 不会把路由自动写入 VPC Route Table。每个 VPC 的 Main Route Table 或相关 Subnet Route Table 都必须手动添加指向 TGW 的静态路由（static route），例如把 10.0.0.0/8 的 Target 设置为 Transit Gateway。端到端路径先在 Source Subnet Route Table 选择 TGW，再由 TGW Route Table 选择 Destination Attachment；返回方向也必须具备对应路由。
English
TGW route propagation does not automatically write routes into VPC route tables. Every VPC main route table or relevant subnet route table must manually add a static route whose target is the TGW—for example, 10.0.0.0/8 to Transit Gateway. The end-to-end path first selects the TGW in the source subnet route table and then selects the destination attachment in the TGW route table; the return direction also needs corresponding routes.
Transcript
03:41 So VPC should also have the route tables
03:44 and those route table could be the VPCs default route table,
03:47 that is the main route table,
03:48 or you can have a subnet
03:50 and the route table could be of that subnet.
03:53 Now, if you see there is a route 10.0.0/8,
03:57 and we are saying that the traffic should go
03:59 through the transit gateway.
04:01 Now this is an entry which we have to make manually.
04:04 It's a static route.
04:05 It doesn't automatically understand
04:07 that the transit gateway supports the routing
04:10 to all these CIDRs,
04:11 and that will be propagated to this VPC route table,
04:15 it doesn't happen like that.
04:16 Now if you remember,
04:17 if you're doing a VPN connection or a BGP,
04:20 in that case you can propagate the routes
04:22 from the VPN to your VPC route table,
04:25 but in this case you have to manually add these entries.
04:28 So if all these VPCs needs to communicate with each other,
04:32 then of course you need to add this entry
04:35 into every VPCs' route table or say a subnet's route table.
04:39 Now once you do that,
04:41 now you can see if VPC A wants to communicate with VPC B,
04:46 then it will send a packet for example,
04:48 there is say C to machine,
04:51 and then it will send the packet like this.
04:53 Now when the traffic goes out,
04:55 it will check the corresponding route table
04:57 for say IP address 10.1.0/15 for example,
05:02 right?
05:03 then it will first check its own route table.
05:05 It says the traffic is part of 10.0.0/8
05:09 so it will take the transit gateway route.
05:11 As soon as it reaches the transit gateway,
05:13 it will follow the transit gateway route table,
05:16 and it will check is there a route to reach to 10.1.0/15?
05:21 And then this address will be matched with the middle route,
05:26 which says the traffic has to go through the attachment B
05:29 and then it reaches to the EC2 instance in VPC B.
05:32 Similarly, if it has to reach to VPC C,
05:35 then it will take the route via this attachment C.
05:38 Now this is how the routing happens
05:41 when you use transit gateway.
05:43 Now, thing to remember
05:44 is that transit gateway has a default route table.
05:47 And in this route table,
05:49 the routes from the VPCs are propagated automatically.
05:52 Now you can control basically
05:53 how this route propagation happens,
05:55 but as of now that is what is important to understand.
05:58 And also remember that every VPC
06:01 and the subnet route table also should have the entry
06:04 and this entry has to be static.
06:06 It doesn't come automatically.
06:07 So you have to make sure that you add corresponding entries
06:11 like here in your subnet route tables
06:14 or a VPC main route table.
06:17 So that's it for this lecture,
06:18 to just show you how the routing happens.
06:21 And now next we will actually do the lab
06:24 where we'll set up this kind of connectivity.
06:26 So stay tuned and thanks for watching.
整讲总结 / Overall Summary
中文
TGW 路由依赖两层 Route Table：VPC CIDR 会自动 Propagate 到 TGW Route Table，形成“目的 CIDR → Attachment”的路由；但 VPC/Subnet Route Table 仍需手工添加“远端 CIDR → TGW”的静态路由。Attached VPC CIDR 不能重叠，正向与返回路径都必须完整配置。
English
TGW routing depends on two route-table layers. VPC CIDRs automatically propagate into the TGW route table as destination-CIDR-to-attachment routes, but VPC and subnet route tables still require manually configured static routes that send remote CIDRs to the TGW. Attached VPC CIDRs cannot overlap, and both forward and return paths must be complete.
返回顶部 ↑