Lecture 81: Transit Gateway AZ affinity & Appliance mode
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：10:58
- 来源：Udemy Lecture 33514788
- Slide 数量：5
- 画面切换：00:56、04:36、07:06、08:16
扫描说明
逐条检查了 Udemy 页面中的 244 条 Transcript cue，并对全长约 10:58 的视频画面逐段扫描。依据标题、同 AZ 路径、跨 AZ 非对称路径、Appliance Mode Disabled 和 Appliance Mode Enabled 五个完整场景，共划分出 5 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. AZ Affinity 与 Appliance Mode 概览
时间范围：00:00–00:56
总结 / Summary
中文
中转网关（Transit Gateway, TGW）会在 VPC 附件（VPC attachment）所选子网中创建与可用区（Availability Zone, AZ）关联的弹性网络接口（Elastic Network Interface, ENI）。本讲进一步解释 TGW 的 AZ 亲和性（AZ affinity），以及经过有状态网络设备（stateful network appliance）时为何需要设备模式（appliance mode）；这是考试中常见的路径分析主题。
English
A Transit Gateway creates AZ-specific ENIs in the subnets selected by a VPC attachment. This lecture explains TGW Availability Zone affinity and why appliance mode is required when traffic traverses stateful network appliances, an important path-analysis topic for the exam.
Transcript
00:00 Hello, and welcome to this lecture,
00:01 Transit Gateway AZ affinity and appliance mode.
00:04 Now, this is a small lecture,
00:07 but this is an important topic,
00:08 because we have seen this coming into the new exam.
00:12 And this is really important to understand
00:14 how transit gateway behaves with respect to the network
00:19 flowing into the availability zones, right?
00:22 So in the earlier lecture,
00:23 we already understood that transit gateway creates ENIs
00:27 into the subnets, in which you create
00:30 a transit gateway attachment,
00:32 and those are linked to the availability zones, right?
00:35 That means you can't send traffic from the subnet
00:37 into the other availability zone
00:40 if there is no ENI in that availability zone, right?
00:43 So that's about, you know,
00:44 how transit gateway behaves in general.
00:46 But let's talk about AZ affinity,
00:49 and then what is appliance mode
00:50 with respect to the transit gateway.
00:52 Now, for this, we have taken a simple example
2. Source 与 Destination 在同一 AZ
时间范围：00:56–04:36
总结 / Summary
中文
两个业务 VPC 通过共享服务 VPC（shared services VPC）中的防火墙或网络设备检查东西向流量（east-west traffic），且三个 VPC 都在每个 AZ 建有 TGW ENI。当来源 A 与目标 B 位于同一 AZ 时，TGW 尽量选择来源 AZ 内的附件 ENI，使去程与回程都停留在同一 AZ。这样可以减少跨 AZ 数据传输费用（cross-AZ data transfer charges），缩小故障域，并保持路径对称。
English
Two workload VPCs send east-west traffic through a firewall or network appliance in a shared-services VPC, with TGW ENIs present in every AZ. When source A and destination B are in the same AZ, the TGW prefers attachment ENIs in that originating AZ for both directions. The flow stays in one AZ, avoiding cross-AZ data-transfer charges, limiting the failure domain, and preserving a symmetric path.
Transcript
00:56 where there are three VPCs.
00:58 And you can see that on the left side, we have two VPCs,
01:01 which are kind of VPCs
01:03 which needs to communicate with each other.
01:05 That means applications running in that VPC
01:08 needs to communicate with each other.
01:09 And on the right side, you have shared services VPC,
01:12 in which you can deploy network appliances or firewalls
01:15 so that you can monitor, maybe, east-west traffic
01:18 which is flowing between these two VPCs on the left side.
01:22 Now, we will connect all these VPCs
01:24 with transit gateway VPC attachment.
01:27 And then, as you can see,
01:29 I have transit gateway attachments created in every AZ
01:34 in all these three VPCs.
01:36 So, ultimately, it creates TGW ENIs
01:40 into, you know, every availability zone there.
01:43 So let's take an example.
01:45 What if instance A wants to send traffic to instance B
01:48 and both these instances are in the same AZ?
01:51 Now, you know that transit gateway are regional routers,
01:54 so this will be in the same AWS region.
01:57 And as of now, we are talking about just one AWS account.
02:00 So AZ1 here means the AZ1 here as well,
02:03 and same as here as well.
02:05 So what if source and destinations are in the same AZ,
02:09 as you can see in VPC 1 and VPC 2?
02:11 Then the traffic will first go to transit gateway ENI.
02:15 From there, with the route tables, of course,
02:18 it will go to the shared services VPC ENI.
02:21 Now, I'm not showing the route tables here,
02:23 but you can understand how that route will be.
02:25 But that's not important here.
02:27 Now, from this transit gateway,
02:29 ENI traffic will go to the appliance.
02:31 Now, appliance knows that traffic has to go through,
02:34 really, AZ2 instance B in VPC 2.
02:37 So it will send traffic back to the ENI.
02:39 So it will monitor the traffic, basically,
02:41 and send the response from there to this ENI.
02:44 From there, based on the route tables, again,
02:46 it will go to the transit gateway ENI 1
02:49 and then to the instance B.
02:52 Now, if you see this flow,
02:54 everything is happening in the same AZ right?
02:57 We are still in the AZ1 throughout this flow.
03:00 Similarly, traffic comes back from instance B,
03:03 now, this is a written traffic,
03:05 again, it will go to the ENI
03:06 from where the traffic had come, and from there,
03:09 it will go to the transit gateway.
03:11 Now it's up to the transit gateway
03:13 which ENI it wants to select, right?
03:15 Whether it selects ENI 2 or ENI 1 here on the right VPC.
03:19 But transit gateway has that AZ affinity things.
03:23 It tries to keep the traffic in the same AZ
03:26 as much as possible, right?
03:27 So it will send it to the same ENI in AZ1,
03:30 because traffic has originated in AZ1 here, right?
03:34 Instance B is in AZ1.
03:37 That's where it send that traffic,
03:39 to the transit gateway ENI in the same AZ.
03:43 And from there, it, again, goes to the appliance,
03:45 it goes back to the ENI,
03:46 it goes back to the transit gateway,
03:49 back to the requester ENI,
03:51 and from there, to the instance A.
03:54 Now, that's an entire flow which stays within the same AZ.
03:58 Now, the benefit of this is that, of course,
04:01 you don't get, first of all, cross-AZ data transfer charges,
04:05 and then all the traffic remains in the same AZ.
04:09 Now, in case, if something fails,
04:11 only one AZ is affected, right?
04:13 If resources are across AZ, those are not affected.
04:17 So transit gateway attempts to keep the traffic
04:20 in the same originating availability zone
04:22 until it reaches its destination.
04:24 So that's the bottom line,
04:25 and that means transit gateway has AZ affinity.
04:30 Now, that also creates some problem.
04:31 Now, let's understand what happens
04:33 if the target is in the different AZ.
3. Source 与 Destination 跨 AZ：Asymmetric Routing
时间范围：04:36–07:06
总结 / Summary
中文
当来源 A 位于 AZ1、目标 B 位于 AZ2 时，TGW 的 AZ 亲和性（AZ affinity）会让去程在共享服务 VPC 中经过 AZ1 的设备，而从 B 发起的回程则根据其来源 AZ2 进入 AZ2 的设备。网络层仍可能把响应送回 A，但去程与回程经过不同 TGW ENI 和不同设备实例，形成非对称路由（asymmetric routing）。无状态设备（stateless appliance）可能允许该路径，有状态设备则通常不能。
English
When source A is in AZ1 and destination B is in AZ2, TGW AZ affinity sends the forward flow through the AZ1 appliance in the shared-services VPC, while B's return flow originates in AZ2 and is sent through the AZ2 appliance. Basic routing can still deliver the response to A, but the two directions traverse different TGW ENIs and appliance instances, creating asymmetric routing. A stateless appliance may tolerate this path, whereas a stateful appliance usually cannot.
Transcript
04:36 Now, let's move this instance B to AZ2 instead of AZ1.
04:41 Now, the flow will, again, start with instance A,
04:44 sending traffic to transit gateway ENI in the same AZ.
04:47 From there, it will go to transit gateway.
04:50 Now transit gateway sees that the originating traffic
04:52 is coming from AZ1.
04:54 It will, again, send it to the same ENI.
04:56 From there to the appliance, from there back to the ENI,
05:00 to the transit gateway.
05:02 Okay, now is the interesting thing.
05:04 Now, transit gateway issues receives traffic from AZ1.
05:06 So it will send the traffic to the same ENI in the AZ1,
05:11 as long as the health is good of that ENI.
05:14 So it will send traffic from here to the TGW ENI in AZ1,
05:18 and this ENI can further send the traffic
05:20 to instance B in AZ2, because there is no instance in AZ1.
05:25 And this will happen. So far, so good.
05:28 Now, what happens to the written traffic, right?
05:30 So instance B will now send the traffic
05:32 to the ENI of itself, right?
05:34 Because it's a written traffic,
05:36 it, again, starts with instance B.
05:39 The traffic will go to the TGW ENI in AZ2
05:43 and this will now send traffic to the transit gateway.
05:46 Now, at this moment, transit gateway has to make a decision
05:49 to which ENI in this shared services VPC
05:52 it should send traffic.
05:53 Now, if you look at the logic,
05:55 the traffic is originated in AZ2 now.
05:59 So it will send traffic to TGW ENI here, right, in AZ2.
06:03 And the route table of this subnet,
06:06 in which this ENI is there,
06:08 it will tell that traffic it should go to the appliance 2,
06:11 which is here.
06:12 It will come back here, here, from here,
06:15 it will go to, now, transit gateway ENI in VPC1 into AZ2,
06:19 and from there, it will go to the instance A.
06:23 Now, this still works,
06:24 that means instance A will receive the traffic.
06:27 But this is called asymmetric routing,
06:30 because traffic went through a different path,
06:32 or different ENI, and came back via a different ENI.
06:35 So if there is no restriction at application level
06:39 to track the state of the packet,
06:42 or statefulness of the flow, then this works, right?
06:46 But in real world, that's not the case really, right?
06:48 Lot of applications and network appliances are stateful.
06:52 That means it tracks both the incoming and outgoing traffic,
06:56 and they make sure that the traffic matches.
06:59 It's the same flow, basically.
07:01 And in that case, this scenario will not work.
07:04 So let's see how that works, right?
4. Appliance Mode Disabled：状态检查导致丢包
时间范围：07:06–08:16
总结 / Summary
中文
有状态设备（stateful appliance）会同时记录连接的入站和出站流量。设备模式关闭（Appliance Mode Disabled）时，去程由 AZ1 的设备 A 检查，回程却因 TGW 的 AZ 亲和性进入 AZ2 的设备 B；设备 B 从未见过原始连接状态，因此会把响应视为无效并丢弃。默认 TGW 行为由此破坏依赖状态跟踪的防火墙或入侵防御设备。
English
A stateful appliance tracks both directions of a connection. With appliance mode disabled, the forward flow is inspected by appliance A in AZ1, but TGW AZ affinity sends the return flow to appliance B in AZ2. Appliance B has never seen the original connection state, so it treats the response as invalid and drops it. Default TGW behavior therefore breaks firewalls and other inspection devices that depend on state tracking.
Transcript
07:06 So in this case, again, same scenario,
07:08 but now we have stateful appliances.
07:11 That means it is monitoring for the incoming traffic
07:14 and it will only allow the corresponding traffic
07:17 to go back from the appliance
07:19 if it matches the incoming traffic, right?
07:21 So in that case, again, traffic will start from A,
07:25 to the ENI, to the transit gateway, to the appliance in AZ1.
07:29 Then it will go to the ENI, to the instance B in AZ2.
07:34 Again, B will send traffic to the ENI in the same AZ
07:37 to the transit gateway,
07:38 to the transit gateway ENI in AZ2, now,
07:42 in the appliance VPC, or a shared services VPC,
07:44 and it will go to the appliance B.
07:47 Now, if you see for this appliance B, which is stateful,
07:50 this traffic is unseen, right?
07:53 It never saw this traffic coming earlier.
07:55 But then the traffic says that it's a written traffic,
07:58 but there is no originating traffic
08:00 that is known to the instance B.
08:01 It is known to instance A, appliance A, but not to the B.
08:05 So what it will do?
08:06 It will simply drop this traffic
08:07 because it's a stateful appliance.
08:09 And that's really the problem,
08:11 is if you go with default settings
08:14 of the transit gateway, right?
08:16 So what you need to do here is enable the appliance mode.
5. Appliance Mode Enabled：使用 Five-tuple 固定流路径
时间范围：08:16–10:58
总结 / Summary
中文
在共享服务 VPC 附件上启用设备模式（appliance mode）后，TGW 使用五元组（five-tuple）流哈希算法（flow hash algorithm）——来源 IP、来源端口、目标 IP、目标端口和协议——为连接选择一个固定附件 ENI。此后无论回程从哪个 AZ 发起，同一流在生命周期内都会回到原设备实例，从而恢复对称检查。该选项可在创建 VPC 附件时设置，也可通过 AWS CLI 或软件开发工具包（Software Development Kit, SDK）把 ApplianceModeSupport 设为 enable；默认值为关闭。
English
When appliance mode is enabled on the shared-services VPC attachment, the TGW uses a five-tuple flow-hash algorithm—source IP, source port, destination IP, destination port, and protocol—to select one attachment ENI for the connection. Every packet in that flow, regardless of its originating AZ, is then pinned to the same appliance instance for symmetric stateful inspection. The option can be set when the VPC attachment is created or enabled later through the AWS CLI or SDK by setting ApplianceModeSupport to enable; it is disabled by default.
Transcript
08:21 What you can do when you attach this VPC
08:22 to the transit gateway
08:24 on the shared services VPC attachment,
08:26 you can enable the appliance mode.
08:29 Now, what it makes transit gateway to do
08:31 is to fix only one ENI for the flow,
08:35 rather than looking at which AZ it is coming from.
08:38 So if transit gateway knows that the traffic is coming
08:41 from a particular IP address and particular port,
08:44 and going to a particular IP address and a port,
08:48 and with some protocol that's called flow hash algorithm,
08:51 it will always, for the life of that flow,
08:53 will send traffic to only that particular ENI,
08:56 irrespective of which AZ the traffic has originated in.
08:59 So again, if we enable this appliance mode here
09:03 on this attachment,
09:04 then the flow will look something like this.
09:08 Up to B. We caught it.
09:09 Now, from B, it will, again,
09:11 go to the transit gateway ENI in AZ2.
09:13 From there, to the transit gateway.
09:14 But at this moment,
09:15 transit gateway looks at the transit gateway,
09:18 applies the flow hash algorithm,
09:20 and it knows that the originating traffic
09:22 had gone to this ENI in AZ1, it will send to the same AZ.
09:27 And now appliance A has no problem looking at the traffic
09:32 and then getting the response back.
09:35 And then the traffic will flow back to the instance A.
09:39 Now, that's what happens when you enable the appliance mode.
09:42 And you know that without appliance mode,
09:44 this traffic will be dropped
09:46 if your appliance is a stateful appliance.
09:49 So this could be appliance or a firewall,
09:51 it doesn't really matter.
09:52 But that's an essential thing that you need to know
09:54 for transit gateway AZ affinity
09:58 and how does this appliance mode work, right?
10:02 Flow hash algorithm, I had mentioned here.
10:03 Flow hash algorithm is nothing, but it looks at 5-tuples,
10:07 which are like source port, source IP address,
10:09 destination IP address, destination port,
10:11 and the protocol on which the two systems
10:14 are communicating with the network.
10:16 Finally, you can enable this appliance mode
10:19 while you create the transit gateway VPC attachment,
10:22 or, if there is already a transit gateway VPC attachment,
10:26 you can enable this appliance mode.
10:29 So, by default, it is disabled.
10:31 And through AWS CLI and SDK,
10:33 you can basically do --option ApplianceModeSupport=enable
10:39 and then it will be automatically enabled.
10:41 So that's about the transit gateway
10:43 AZ affinity and appliance mode.
10:45 This is important for the exam,
10:46 because we have seen this kind of scenarios presented
10:50 and you should know that appliance mode
10:51 can solve this problem.
10:53 So that's it about this lecture.
10:55 And see you in the next lecture. Thank you.
整讲总结 / Overall Summary
中文
本讲解释了中转网关（Transit Gateway, TGW）的可用区亲和性（Availability Zone affinity）和设备模式（appliance mode）。TGW 默认尽量把流量保留在来源 AZ：来源与目标同 AZ 时，这可避免跨 AZ 费用并维持对称路径；来源与目标跨 AZ 时，去程与回程可能被送到共享服务 VPC 中不同的网络设备，产生非对称路由（asymmetric routing）。无状态设备可能仍能转发，但有状态防火墙会因回程缺少连接状态而丢包。对共享服务 VPC 附件启用 appliance mode 后，TGW 依据五元组（five-tuple）流哈希把整个流固定到同一附件 ENI 和设备实例，从而保证状态检查所需的对称性。
English
This lecture explains Transit Gateway Availability Zone affinity and appliance mode. By default, a TGW attempts to keep traffic in the originating AZ. That behavior avoids cross-AZ charges and preserves symmetry when source and destination share an AZ, but it can send forward and return traffic through different appliances when the endpoints are in different AZs. Stateless devices may still forward the traffic, while a stateful firewall drops the return packets because it lacks the connection state. Enabling appliance mode on the shared-services VPC attachment pins the entire five-tuple flow to one attachment ENI and one appliance instance, restoring the symmetry required for stateful inspection.
返回顶部 ↑