Lecture 83: Transit Gateway Connect Attachment
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:26
- 来源：Udemy Lecture 33514828
- Slide 数量：5
- 画面切换：00:49、04:24、05:17、06:12
扫描说明
逐条检查了 Udemy 页面中的 173 条 Transcript cue，并对全长约 7:26 的视频画面逐段扫描。依据标题、Connect attachment 机制、VPC transport 架构、DX transport 架构和容量/路由限制五张独立 Slide，共划分出 5 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Transit Gateway Connect Attachment 的用途
时间范围：00:00–00:49
总结 / Summary
中文
中转网关（Transit Gateway, TGW）除虚拟私有云附件（VPC attachment）、Direct Connect 附件（Direct Connect attachment）和虚拟专用网络附件（Virtual Private Network attachment, VPN attachment）外，还支持 Connect 附件（Connect attachment）。它用于把第三方虚拟网络设备（third-party virtual appliance），尤其是软件定义广域网路由器（Software-Defined Wide Area Network router, SD-WAN router），连接到 TGW，以便把现有 SD-WAN 网络扩展到 AWS。
English
In addition to VPC, Direct Connect, and VPN attachments, a Transit Gateway supports Connect attachments. A Connect attachment links third-party virtual network appliances—especially SD-WAN routers—to the TGW so an existing software-defined WAN can extend into AWS.
Transcript
00:00 Hello, and welcome to this lecture,
00:02 Transit Gateway Connect Attachment.
00:03 So you already know that Transit Gateway
00:05 supports different type of attachments.
00:07 The very first stage VPC attachment,
00:09 then you could also have Direct Connect attachment,
00:12 where you connect Direct Connect to Transit Gateway
00:14 using Direct Connect Gateway.
00:17 Then you could also have the VPN attachment
00:19 where you can terminate your IPsec VPN tunnels
00:22 onto the Transit Gateway.
00:23 And then there is one more attachment type
00:26 which is Transit Gateway Connect.
00:28 Now this attachment is used for connecting Transit Gateway
00:32 to the virtual appliances, such that your SD-WAN routers.
00:37 And this is essential whenever you want to extend
00:40 your existing SD-WAN network to AWS
00:44 using the Transit Gateway.
00:45 And that's where it becomes important attachment
00:48 to learn about.
2. GRE Tunnel、BGP Session 与 Transport Attachment
时间范围：00:49–04:24
总结 / Summary
中文
Connect 附件并不是独立的底层链路，而是建立在现有 VPC 附件或 AWS Direct Connect 附件之上的覆盖连接；底层附件称为传输附件（transport attachment）。TGW 与设备之间使用通用路由封装隧道（Generic Routing Encapsulation tunnel, GRE tunnel）承载高性能数据流，并通过边界网关协议会话（Border Gateway Protocol session, BGP session）动态交换路由。每个 Connect 对等体（Connect peer）定义设备端 IP、TGW 端 IP 和 BGP 对等地址，从而把设备学习到的分支前缀发布给 TGW。
English
A Connect attachment is an overlay rather than an independent underlay. It runs over an existing VPC or AWS Direct Connect attachment, called the transport attachment. The TGW and appliance use a GRE tunnel for high-performance data transport and a BGP session for dynamic route exchange. Each Connect peer defines the appliance IP, TGW IP, and BGP peer addresses so branch prefixes learned by the appliance can be advertised to the TGW.
Transcript
00:49 So at high level, you can see here,
00:51 there is a Transit Gateway
00:53 and then you could have your virtual appliances
00:55 running inside a VPC.
00:57 And now this virtual appliances can be connected
00:59 to the Transit Gateway using this connect attachment.
01:02 And for establishing this connect attachment,
01:05 you need to create a GRE tunnel
01:07 between Transit Gateway and this virtual appliance here.
01:11 So again, you can create Transit Gateway Connect attachment
01:15 to establish a connection between Transit Gateway
01:17 and third-party virtual appliances,
01:19 which are running in a VPC,
01:21 or it can also run in on-premise network.
01:24 And we'll talk about that architecture as well.
01:27 Now for connecting this Transit Gateway Connect attachment,
01:32 you need a transport attachment first.
01:34 Now, what is transport attachment?
01:35 In order to connect this appliances
01:37 to the Transit Gateway before creating this GRE tunnel,
01:40 there should be a transport mechanism.
01:42 So there are essentially two mechanisms
01:45 by which you can connect these appliances
01:46 to the Transit Gateway.
01:48 One is a VPC attachment.
01:49 That means the VPC in which this appliances are running
01:52 can be connected to the Transit Gateway
01:54 with normal VPC attachment.
01:56 And this is a case when your appliances running
01:58 inside a VPC, but if your appliances are running
02:02 on-premises, then you can use Direct Connect
02:05 as your transport attachment.
02:07 And then it supports
02:08 Generic Routing Encapsulation tunnel protocol,
02:10 and it provides you higher performance.
02:12 And it also supports BGP.
02:14 In fact, for connect attachment,
02:16 it is must to have the BGP peering.
02:19 Now, if you look at this architecture here.
02:21 On the left side, you have VPCs,
02:23 which are connected to the Transit Gateway
02:25 with regular VPC attachment.
02:28 And our appliance is running inside a VPC.
02:31 And this VPC is also connected to the Transit Gateway
02:33 with regular VPC attachment.
02:36 And that's the transport layer as of now.
02:39 Now once you have these attachments created
02:42 for Connect attachment, you can create on top
02:45 of this transport mechanism.
02:48 So one end is Transit Gateway
02:50 and other end is this virtual appliance inside of VPC.
02:53 And you can create now the Connect attachment.
02:56 And as you create a Connect attachment,
02:59 then GRE tunnel gets established and you need
03:03 to also have the BGP peering
03:05 between these two end points here.
03:07 So ultimately, there will be a BGP session configured
03:10 between the Transit Gateway
03:11 and the network appliance running there.
03:13 And there will be BGP configurations
03:16 like inside IP addresses as well as external IP addresses.
03:20 So Transit Gateway will have a unique IP address
03:23 which you can assign to the Transit Gateway
03:25 while you create it
03:25 or you can modify that address later as well.
03:28 And appliance would have its own IP address
03:31 which is called peer IP address here.
03:34 Now you know that BGP also need inside IP addresses.
03:37 So you can allocate an IP address range
03:39 from 169.254.0.0/16 range.
03:43 And out of this 169.254.0.2.5 are reserved.
03:48 So you can use any further IP addresses
03:51 like 169.254.6.0 onwards for BGP peering station.
03:58 And this is what is shown in this architecture.
04:00 Now let's understand how you can use VPC attachment
04:04 as the transport mechanism.
04:06 And how can you use Direct Connect attachment
04:09 as your transport mechanism.
04:11 Now, in the first case, your appliance
04:14 is running inside a VPC.
04:15 So architecture will be something similar
04:16 to what you see here, but in case of Direct Connect,
04:19 your appliances are running in on-premises network.
04:22 So let's look at the first case
04:24 when the VPC transport attachment is used.
3. VPC Transport Attachment 架构
时间范围：04:24–05:17
总结 / Summary
中文
当虚拟网络设备（virtual network appliance）部署在 AWS VPC 内时，先把设备所在的传输 VPC（transport VPC）通过普通 VPC 附件连接到 TGW，再在该附件之上创建 Connect 附件、GRE 隧道和 BGP 会话。企业分支或公司 SD-WAN 可通过 Direct Connect 或互联网先到达传输 VPC，然后由设备把分支路由动态发布给 TGW；其他业务 VPC 通过 TGW 路由表访问这些分支。
English
When the virtual network appliance runs inside AWS, its transport VPC first attaches to the TGW through a normal VPC attachment. The Connect attachment, GRE tunnel, and BGP session are then created over that attachment. Corporate SD-WAN sites or branches reach the transport VPC through Direct Connect or internet connectivity, and the appliance dynamically advertises their routes to the TGW for use by the workload VPCs.
Transcript
04:27 So you can see on the left side,
04:29 we have VPCs connected to the Transit Gateway.
04:32 And then we have virtual appliances running inside a VPC.
04:35 And this VPC is connected
04:36 to the Transit Gateway or the VPC attachment.
04:39 And on top of it, we create the connect attachment.
04:42 We form the GRE tunnel and there is a BGP session
04:45 going in between.
04:46 Now in order for your on-premise network
04:49 to connect to this VPC, you can use different mechanisms.
04:53 So one mechanism is you can use either a Direct Connect
04:56 or you can have internet-based connectivity
05:00 but ultimately, you are extending
05:02 your on-premise network to the VPC.
05:05 And then from there,
05:06 you are creating this Connect attachment
05:08 to the Transit Gateway.
05:10 Now, this architecture makes sense when you have to run
05:13 this virtual appliances inside AWS.
4. Direct Connect Transport Attachment 架构
时间范围：05:17–06:12
总结 / Summary
中文
当 SD-WAN 或客户网关设备（customer gateway appliance）运行在本地数据中心（on-premises data center）时，可使用 AWS Direct Connect 作为传输机制。Direct Connect 经 Direct Connect 网关（Direct Connect gateway）与 TGW 建立底层附件，然后在其上叠加 Connect 附件、GRE 隧道和 BGP 会话。这样设备无需部署到 VPC 中，也可把第三方分支网络动态接入 TGW。
English
When the SD-WAN or customer-gateway appliance runs in an on-premises data center, AWS Direct Connect can provide the transport. Direct Connect reaches the TGW through a Direct Connect gateway and underlying attachment, with the Connect attachment, GRE tunnel, and BGP session layered on top. The third-party branch network can therefore join the TGW dynamically without deploying the appliance inside a VPC.
Transcript
05:17 Similarly, if you have your virtual appliances
05:18 running on-premises network, then in that case,
05:21 you can connect your on-premise data center
05:24 to Transit Gateway.
05:26 Now, you know that in order to connect Direct Connect
05:28 to the Transit Gateway, you need data connect gateway
05:31 with the transit weave.
05:32 And once that connection is established,
05:34 that is used as your transport mechanism.
05:37 And then you can do the same thing again.
05:39 Once that connectivity is established
05:41 you can create then GRE return on top of it.
05:43 And then you can set up a BGP peering session.
05:46 So ultimately, your Transit Gateway connect
05:49 can be used as a third-party branch
05:51 or a customer gateway appliance
05:53 turning in an on-premise network
05:55 that uses AWS Direct Connect as a transport.
05:58 So these are two different architectures
06:01 for connect attachment.
06:02 And remember that whenever it talks
06:05 about connecting Transit Gateway to the virtual appliances,
06:08 then probably will go with one of these architectures.
06:11 Now, a few things to remember
5. Connect Attachment 的路由与带宽限制
时间范围：06:12–07:26
总结 / Summary
中文
Connect 附件不支持静态路由（static routes），边界网关协议（Border Gateway Protocol, BGP）是最低要求。每条 GRE 隧道（GRE tunnel）的最大带宽为 5 Gbps；若需更高吞吐量，可在同一 Connect 附件上创建多个 Connect 对等体并发布相同前缀，以形成等成本多路径（Equal-Cost Multi-Path, ECMP）。每个 Connect 附件最多支持四个 Connect 对等体，因此单连接总带宽最高为 20 Gbps。
English
Connect attachments do not support static routes; BGP is mandatory. Each GRE tunnel supports up to 5 Gbps. Higher throughput is achieved by creating multiple Connect peers on the same attachment and advertising the same prefixes to form equal-cost multipath. A Connect attachment supports up to four Connect peers, providing up to 20 Gbps of aggregate bandwidth per connection.
Transcript
06:12 about Transit Gateway Connect attachment.
06:14 It does not support static routes.
06:17 Only BGP support it for the Connect attachment.
06:20 And then if you talk about the bandwidth,
06:22 every GRE tunnel supports up to five Gbps of the bandwidth.
06:27 And likewise, you could have four connect peers
06:30 established on the same connection.
06:33 Ultimately, it provides you
06:34 up to 20 Gbps bandwidth per connection.
06:37 Now, if you compare this with the IPsec VPN,
06:41 then IPsec VPN only provides 1.25 Gbps per connection.
06:45 But then you would've to have many more VPN connection
06:48 in parallel to really get 20 Gbps bandwidth.
06:53 And you would've to also do EC MPN
06:55 all those configurations.
06:56 Now here as well, if there are multiple GRE tunnels,
06:58 you would have to configure the equal cost multipath.
07:02 But then you just need four such tenants in this case.
07:06 And that's it about Transit Gateway Connect attachment.
07:11 Again, you could find some of the scenarios
07:14 which talks about connecting Transit Gateway
07:16 to the virtual appliances.
07:18 And in that case, you should know
07:19 that you can use Transit Gateway Connect attachment.
07:23 So thanks watching.
整讲总结 / Overall Summary
中文
本讲介绍中转网关 Connect 附件（Transit Gateway Connect attachment），用于把软件定义广域网设备（Software-Defined Wide Area Network appliance, SD-WAN appliance）等第三方虚拟设备接入中转网关（Transit Gateway, TGW）。Connect 是运行在 VPC 或 Direct Connect 传输附件（transport attachment）之上的覆盖层：使用通用路由封装（Generic Routing Encapsulation, GRE）传输数据，并强制使用边界网关协议（Border Gateway Protocol, BGP）动态交换路由。设备部署在 AWS 时采用 VPC transport；设备位于本地时可采用 Direct Connect transport。每条 GRE 隧道最高 5 Gbps，每个 Connect 附件最多四个对等体，可通过等成本多路径（Equal-Cost Multi-Path, ECMP）聚合到 20 Gbps。
English
Transit Gateway Connect attaches third-party virtual appliances such as SD-WAN routers to a TGW. It is an overlay on a VPC or Direct Connect transport attachment, using GRE for data transport and mandatory BGP for dynamic routing. Appliances deployed in AWS use the VPC-transport pattern, while on-premises appliances can use a Direct Connect transport. Each GRE tunnel supports up to 5 Gbps, and up to four Connect peers per attachment can use ECMP for 20 Gbps of aggregate bandwidth.
返回顶部 ↑