Lecture 79: Transit Gateway VPC Network Patterns
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:10
- 来源：Udemy Lecture 33514718
- Slide 数量：3
- 画面切换：00:50、02:47
扫描说明
逐条检查了 Udemy 页面中的 141 条 Transcript cue，并对全长约 6:10 的视频画面逐段扫描。视频由标题、Flat network 架构图和 Segmented Network 架构图三张独立 Slide 构成，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Transit Gateway Routing Domains 与网络模式
时间范围：00:00–00:50
总结 / Summary
中文
中转网关（Transit Gateway, TGW）既可让所有附件（attachments）使用默认路由表（default route table），也可为不同附件配置专属路由表（attachment-specific route tables）。这些独立的转发视图称为路由域（routing domains），可用于设计虚拟私有云之间（VPC-to-VPC）的东西向流量（east-west traffic），以及 VPC 到本地网络（on-premises network）的混合连接模式。
English
A Transit Gateway can place all attachments in its default route table or use attachment-specific route tables. These separate forwarding views are routing domains, and they enable reusable patterns for east-west VPC traffic as well as VPC-to-on-premises connectivity.
Transcript
00:00 Now that you understand
00:01 how the routing works for transit gateways.
00:03 As you know, there is a default route table
00:05 so all the attachments that you have for the transit gateway
00:09 will follow the default route table
00:11 if you haven't customized it.
00:13 Or you could also have the attachment specific route table
00:17 so that you get more control over where the traffic can flow
00:20 and where the traffic cannot flow, right.
00:22 So all these route tables are called
00:24 typically routing domains.
00:27 That means you control how the routing should happen
00:30 within the transit gateway.
00:31 Now this allows us to
00:33 come up with interesting network patterns,
00:36 and right now we just see couple of patterns
00:39 around how you can organize your VPCs and this route table
00:42 to have the east west traffic
00:44 or say VPC to on premises traffic.
00:47 So let's understand this, right.
2. Flat Network：单一路由域全互通
时间范围：00:50–02:47
总结 / Summary
中文
扁平网络（flat network）把所有 VPC 附件（VPC attachments）关联到同一张默认 TGW 路由表（default TGW route table），并启用路由传播（route propagation），使每个 VPC 前缀自动成为传播路由（propagated route）。各 VPC 子网路由表（subnet route tables）仍需手工添加静态路由（static route）；可使用 10.0.0.0/8 等汇总无类域间路由（aggregated Classless Inter-Domain Routing, CIDR）把所有跨 VPC 流量指向 TGW。最终所有 VPC 形成全互通（full connectivity），整个 TGW 只有一个路由域。
English
A flat network associates every VPC attachment with one default TGW route table and enables propagation so each VPC prefix appears as a propagated route. The VPC subnet route tables still need manual static routes, which can use an aggregate such as 10.0.0.0/8 to send all inter-VPC traffic to the TGW. The result is full connectivity through a single routing domain.
Transcript
00:50 So here, for example, it's a flat network we want to have.
00:53 Flat network means all the VPCs
00:55 connected to the transit gateway should be able to,
00:58 you know, communicate with each other.
01:00 Now, in that case, obviously you don't need to do much
01:03 but just connect all those VPCs to the transit gateway
01:07 and then have the default transit gateway route table.
01:10 Now what will happen in this case is that
01:13 every VPC that you attached to the transit gateway
01:15 will have a common route table
01:18 and this route table would have the destination
01:21 as the VPC address range,
01:24 and the destination will be through the VPC attachment,
01:28 and the route propagations will be turned on
01:31 so that any VPC can now communicate with any other VPC.
01:37 So in this case, VPC will also have its own route table
01:40 as you know, right,
01:42 and this entry has to be made statically.
01:44 You can't have the propagated routes here.
01:47 So every VPC would have the local route
01:50 for its own destination.
01:51 And then for sending traffic to other VPCs,
01:55 you will add this entry.
01:57 Now you could always add individual entry
02:00 for other VPC's address range like 10.2.0.0/16,
02:05 10.3.0.0/16 likewise,
02:08 but we have aggregated all these routes into one CIDR
02:13 that is 10.0.0.0/8,
02:15 and then traffic should go through
02:16 the transit gateway attachment.
02:18 Now, similarly, there will be route tables
02:20 for other VPCs as well.
02:22 Now that's it.
02:23 If you have this kind of configuration,
02:26 then you get full connectivity between all these VPCs,
02:30 and this gives us one flat network among those VPCs.
02:34 Okay, in this case,
02:35 you know, these are static route entries,
02:37 these are propagated routes,
02:39 and this is called routing domain for the transit gateway.
02:43 So there is just one routing domain as of now.
3. Segmented Network：连接本地但隔离东西向流量
时间范围：02:47–06:10
总结 / Summary
中文
分段网络（segmented network）适合软件即服务（Software as a Service, SaaS）等多租户场景：每个客户 VPC 可以访问共享本地网络（on-premises network），但不同 VPC 之间没有东西向连接（east-west connectivity）。设计使用两个路由域（routing domains）：VPC 路由域只包含指向虚拟专用网络附件（Virtual Private Network attachment, VPN attachment）的本地网段路由；VPN 路由域则接收所有 VPC 附件传播的路由。这样 VPC 与本地网络可双向通信，而 VPC 路由表中缺少其他 VPC 前缀，实例间流量会在来源侧直接丢弃。VPN 也可替换为 Direct Connect（DX）等混合连接。
English
A segmented network suits multi-tenant SaaS designs in which every customer VPC may reach shared on-premises workloads but cannot communicate east-west with other VPCs. Two routing domains implement the policy: the VPC domain contains only the on-premises prefix through the VPN attachment, while the VPN domain learns every VPC route. This preserves bidirectional VPC-to-on-premises connectivity, but an inter-VPC packet is dropped because its source VPC route table has no route for the peer VPC. The hybrid attachment could also be Direct Connect.
Transcript
02:47 Now sometimes we need segmented network,
02:49 which means we want our VPCs to be communicating
02:53 with maybe your on premise network,
02:55 but we don't want VPCs
02:58 to communicate with each other, right?
03:00 Maybe you are having some kind of SaaS application
03:03 where every VPC represents
03:06 one different customer network, right,
03:08 so you don't want these networks
03:09 to communicate with each other.
03:10 But if there is some on premise workloads running
03:14 and all these customer needs to access that,
03:16 then of course you need VPC to on premise connectivity,
03:19 but not among the VPC themselves, right.
03:23 Now obviously in this case
03:25 you will need two routing domains.
03:27 One routing domains which allows this VPCs
03:30 to communicate with this VPN,
03:33 and another one which allows this VPN
03:35 to communicate with your VPCs, right.
03:38 So let's look at that.
03:39 So with respect to the VPC route tables,
03:43 you would have local routes
03:44 and then in every VPC route table,
03:46 you will have the entry for on premise networks CIDR,
03:51 again, this is a static entry
03:53 and the traffic will go through
03:54 the transit gateway attachment of the VPC.
03:57 So like this.
03:58 And the routine domain for VPCs will just allow connectivity
04:03 from these VPCs to the on premise network.
04:06 So only thing that it needs to have
04:09 is a route for the on premise network
04:12 with the attachment of the VPN
04:15 which is connected to this transit gateway, right,
04:18 and the out protonation is turned on.
04:20 So this is one routing domain
04:22 and the other routing domain
04:23 in which VPN has to send traffic to the on premise network,
04:27 it would have the propagated routes
04:31 from all the VPC attachments.
04:33 So here we are saying,
04:34 if the traffic has to go from VPN to on premises,
04:38 for VPC1 it will use VPC attachment one.
04:42 Similarly, for other VPC
04:43 it will use corresponding VPC attachment.
04:47 Now, if you have this kind of transit gateway
04:49 routing domains configured,
04:52 what it allows us is full connectivity
04:55 between VPCs and on-premise network or a VPN,
04:59 or it could be a DX later on.
05:00 And at the same time you have no east west connectivity
05:04 between the VPCs.
05:05 Now you can verify this, right.
05:07 For example, instance in VPC1
05:09 wants to talk to instance in VPC2 two, right?
05:12 So the traffic will be initiated.
05:13 It will look at the route here,
05:16 there is no route to go to the 10.2, right?
05:18 That means traffic will be dropped right there,
05:21 it can't go further.
05:22 Now, even if you have a route which says 0.0.0.0,
05:26 take it through the transit gateway.
05:27 Then of course traffic will come here.
05:30 Now at this moment,
05:31 only the traffic which is allowed
05:33 from this transit gateway attachment
05:35 is to 192.168. IP address.
05:38 So the IP address for this VPC target,
05:42 that is 10.2.something will be dropped at this point
05:45 even if you had static entry for,
05:48 you know, internet traffic.
05:49 So ultimately this allows you
05:52 to have this kind of segmented network.
05:54 And there will be more architectures that we will explore
05:57 as we learn more components
05:59 and how transit gateway can connect to
06:01 Direct Connect, third party appliances,
06:05 and further networking components.
06:08 So stay tuned, thank you.
整讲总结 / Overall Summary
中文
本讲比较了两种中转网关（Transit Gateway, TGW）VPC 网络模式。扁平网络（flat network）让所有附件共享默认 TGW 路由表并传播全部 VPC 路由，再由各 VPC 子网路由表中的静态路由（static routes）把流量送入 TGW，从而形成单一路由域（routing domain）和全互通（full connectivity）。分段网络（segmented network）则把 VPC 入口与虚拟专用网络（Virtual Private Network, VPN）入口放入不同路由域：VPC 只能找到本地网络前缀，VPN 一侧可以找到所有 VPC 前缀，因此保留南北向混合连接并阻断 VPC 间东西向流量（east-west traffic）。关键原则是入口附件关联的路由表决定该来源能看到哪些目标。
English
This lecture compares two Transit Gateway VPC network patterns. A flat network gives all attachments one default TGW route table, propagates every VPC prefix, and uses static VPC subnet routes to send traffic into the TGW, producing one routing domain with full connectivity. A segmented network places VPC ingress and VPN ingress in separate routing domains: the VPC side can see only the on-premises prefix, while the VPN side can see all VPC prefixes. This preserves hybrid north-south connectivity while preventing east-west VPC communication. The central rule is that the route table associated with the ingress attachment determines which destinations that source can reach.
返回顶部 ↑