Lecture 84: Transit Gateway VPN Attachment
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：10:27
- 来源：Udemy Lecture 42272276
- Slide 数量：9
- 画面切换：00:13、01:08、01:33、01:37、02:40、04:37、06:12、08:39
扫描说明
逐条检查了 Udemy 页面中的 231 条 Transcript cue，并对全长约 10:27 的视频画面逐段扫描。依据标题页、VGW 单连接、多个分支、多个 VPC、TGW 简化架构、加速 VPN、VGW 吞吐量限制、TGW ECMP 聚合带宽和双 VPN 路由九个独立 Slide/画面阶段，共划分出 9 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Transit Gateway 的 VPN Attachment 概览
时间范围：00:00–00:13
总结 / Summary
中文
中转网关虚拟专用网络附件（Transit Gateway VPN attachment）允许本地网络通过 AWS 托管的站点到站点虚拟专用网络（AWS managed Site-to-Site VPN）连接到中转网关（Transit Gateway, TGW）。本讲聚焦它相对于虚拟私有网关（Virtual Private Gateway, VGW）的扩展性、加速路径和聚合带宽能力。
English
A Transit Gateway VPN attachment connects an on-premises network to a Transit Gateway through AWS managed Site-to-Site VPN. This lecture focuses on how it improves scalability, path optimization, and aggregate bandwidth compared with a Virtual Private Gateway.
Transcript
00:00 Hi, so we have already seen
00:02 different types of the attachments
00:03 that transit gateway support,
00:05 so we talked about the VPC attachment,
00:07 and we talked about the transit gateway peering.
00:10 Now let's try to understand the VPN attachment,
2. 通过 VGW 建立单个 Site-to-Site VPN
时间范围：00:13–01:08
总结 / Summary
中文
传统架构把虚拟私有网关（Virtual Private Gateway, VGW）附加到虚拟私有云（Virtual Private Cloud, VPC），再与本地客户网关（Customer Gateway, CGW）建立互联网协议安全虚拟专用网络（Internet Protocol Security Virtual Private Network, IPsec VPN）。这种连接适合少量 VPC 和分支，但每个 VPC 与每个客户网关之间都需要独立的站点到站点虚拟专用网络连接（Site-to-Site VPN connection），本质上是一对一拓扑。
English
In the traditional design, a Virtual Private Gateway is attached to a VPC and forms an IPsec Site-to-Site VPN with an on-premises Customer Gateway. This works for a small number of VPCs and branches, but every VPC-to-customer-gateway relationship requires its own VPN connection, creating a one-to-one topology.
Transcript
00:13 so, as you might have guessed,
00:15 you can attach transit gateway to the on-premises network
00:19 using AWS manage site-to-site VPN.
00:23 Now, we are going to cover everything about site-to-site VPN
00:26 in a different section,
00:28 but if you're not aware of that,
00:29 then let me quickly tell you that AWS
00:33 provides the manage site-to-site IPsec VPN,
00:36 and for that, you have to have your VPC,
00:39 and you attach the virtual private gateway to that VPC,
00:42 and on the customer side, you have customer router,
00:45 and then you set up this site-to-site VPN,
00:48 so this works well as long as you have just one or two VPCs,
00:52 and on the right side,
00:53 you have maybe one or couple of branch offices,
00:57 but then, again, this connectivity's one-to-one.
01:00 That means as many VPCs
01:01 and as many customer gateways you have,
01:04 you will have those many site-to-site VPN connection,
3. 多个 Branch Office 带来的 VPN 连接扩张
时间范围：01:08–01:33
总结 / Summary
中文
当多个分支机构（branch office）连接同一个 VPC 时，每个分支都要在客户网关（Customer Gateway, CGW）与虚拟私有网关（Virtual Private Gateway, VGW）之间维护单独的站点到站点虚拟专用网络连接（Site-to-Site VPN connection）。分支数量上升会线性增加连接、配置和运维复杂度。
English
When several branch offices connect to one VPC, each branch needs a separate Site-to-Site VPN between its Customer Gateway and the VPC's Virtual Private Gateway. The number of connections—and therefore configuration and operational complexity—grows linearly with the number of branches.
Transcript
01:08 so if you have multiple branch offices,
01:10 then all these VPN connections will terminate
01:13 on the same virtual private gateway,
01:15 and now you can further add the complexity
01:17 by adding multiple VPCs.
01:19 Then those many VPN connections needs to be maintained,
01:23 and as you might have guessed already,
01:25 this network architecture can be greatly simplified
01:28 by using the transit gateway,
01:30 so what you can rather do is
01:33 instead of connecting multiple VPCs
4. 多个 VPC 进一步放大 VPN Full Mesh
时间范围：01:33–01:37
总结 / Summary
中文
增加多个虚拟私有云（Virtual Private Cloud, VPC）后，每个 VPC 都有自己的虚拟私有网关（Virtual Private Gateway, VGW），并要与本地侧分别建立虚拟专用网络连接（Virtual Private Network connection, VPN connection）。VPC 与分支同时扩张时会形成大量点到点连接，接近难以维护的全网状拓扑（full-mesh topology）。
English
Adding multiple VPCs multiplies the problem because each VPC has its own Virtual Private Gateway and separate VPN connectivity to the on-premises side. As both VPCs and branches grow, the design approaches a difficult-to-maintain full mesh of point-to-point connections.
Transcript
01:35 or different VPN connections,
01:36 you just add the transit gateway.
5. 用 Transit Gateway 汇聚 VPC 与 VPN
时间范围：01:37–02:40
总结 / Summary
中文
中转网关（Transit Gateway, TGW）作为区域级路由器（regional router），可集中附加多个 VPC，并让站点到站点虚拟专用网络连接（Site-to-Site VPN connection）终止在 TGW 的虚拟专用网络附件（VPN attachment）上，而不是分别终止在多个虚拟私有网关（Virtual Private Gateway, VGW）上。这样各分支只需接入中心 TGW，所有已附加 VPC 便可通过集中路由实现混合连接（hybrid connectivity），显著简化拓扑。
English
A Transit Gateway acts as a regional router that centralizes attachments from many VPCs. Site-to-Site VPN connections terminate on VPN attachments at the TGW instead of on separate Virtual Private Gateways. Branches connect to this central hub, and every attached VPC can participate in hybrid connectivity through centralized routing, greatly simplifying the topology.
Transcript
01:39 Now, you know that transit gateways
01:41 are the regional routers,
01:43 so in a given AWS region, you can create a transit gateway,
01:47 and then you can attach all these VPCs
01:50 to that transit gateway,
01:52 and now, instead of terminating your VPN connection
01:55 or the virtual private gateways,
01:57 you can terminate that on the transit gateway.
02:01 Now, for that, you use VPN attachment.
02:04 Now rest of the VPN features remains almost same
02:08 with some differences,
02:09 which we are going to talk about soon,
02:12 but ultimately, you have now all your VPN
02:15 terminating on the transit gateway,
02:18 and to further scale this architecture,
02:20 if you have multiple branch offices,
02:22 then, of course, you will have multiple VPN connections
02:25 terminating on the same transit gateway,
02:27 so this is one of the very popular architecture
02:30 when you want to implement the hybrid connectivity
02:33 between AWS VPCs and your on-premises data center network.
02:38 Okay, so I hope that is understood.
02:40 Now, one more additional feature
6. Accelerated Site-to-Site VPN 与 AWS Global Accelerator
时间范围：02:40–04:37
总结 / Summary
中文
加速站点到站点虚拟专用网络（Accelerated Site-to-Site VPN）利用 AWS 全球加速器（AWS Global Accelerator），把客户网关（Customer Gateway, CGW）的流量先送到最近的 AWS 边缘站点（AWS edge location），再主要沿 AWS 骨干网络（AWS backbone network）到达中转网关（Transit Gateway, TGW），从而减少公网路径并优化性能。该功能仅支持终止在 TGW 上的虚拟专用网络附件（VPN attachment），不支持终止在虚拟私有网关（Virtual Private Gateway, VGW）上的连接。
English
Accelerated Site-to-Site VPN uses AWS Global Accelerator to route Customer Gateway traffic to the nearest AWS edge location and then carry most of the path over the AWS backbone to the Transit Gateway. This reduces the portion that traverses the public internet and can improve path performance. Acceleration is supported only when the VPN terminates on a TGW, not on a Virtual Private Gateway.
Transcript
02:43 that AWS VPN provides
02:45 when you connect that to the transit gateway
02:47 is accelerated VPN.
02:50 Now, what that means, so here, on the right side,
02:53 you have corporate data center,
02:54 and here you have transit gateway.
02:57 Now, earlier in this lecture,
02:59 we saw that you directly have this VPN connection
03:02 terminating on the transit gateway,
03:04 and this is how it works,
03:06 but you can optimize the network path of this connection.
03:10 Now, by default, the VPN traffic
03:12 will go over your Internet service provider's network,
03:16 so it will land into AWS region over this transit gateway,
03:20 but this connection goes over the Internet.
03:23 Now, you can use AWS global accelerator feature
03:27 of AWS site-to-site VPN
03:30 where your traffic is first routed
03:32 to the nearest edge location that AWS has,
03:35 and we are going to talk about the edge locations
03:38 mainly in the CloudFront section,
03:40 but ultimately, these are the point of presence locations
03:43 across the globe.
03:44 There are 400-plus,
03:46 but the way it optimizes your network traffic
03:48 is that the traffic from on-premise network
03:51 goes to the nearest edge location,
03:54 and from there,
03:55 it is already connected to AWS backbone network,
03:58 so your path to the transit gateway
04:01 mainly stays on the AWS network,
04:04 and small part of your network goes over the Internet,
04:08 and one thing here to understand
04:10 is that you can only use AWS global accelerator
04:14 when you terminate your VPN connection
04:16 on the transit gateway.
04:18 It is not supported
04:20 if you are terminating your VPN connection
04:22 on the virtual private gateway,
04:24 so basically, the architecture
04:26 that we had started this lecture with,
04:29 so this is another important way
04:31 in which you can optimize your network traffic
04:33 while using site-to-site VPN with transit gateway.
04:37 Okay, so with that, now let's look at another benefit
7. VGW 的 1.25 Gbps 聚合吞吐量限制
时间范围：04:37–06:12
总结 / Summary
中文
即使在虚拟私有网关（Virtual Private Gateway, VGW）上建立多个虚拟专用网络连接（Virtual Private Network connection, VPN connection），VGW 的聚合吞吐量仍受 1.25 Gbps 限制。每条虚拟专用网络隧道（VPN tunnel）本身最高也是 1.25 Gbps，而且 VGW 不支持等成本多路径（Equal-Cost Multi-Path, ECMP），因此不能把多个等价链路同时用于负载均衡来提升总带宽。
English
Creating multiple VPN connections on a Virtual Private Gateway does not raise its aggregate throughput beyond 1.25 Gbps. Each VPN tunnel is also limited to 1.25 Gbps, and a VGW does not support ECMP, so equal-cost links cannot be used simultaneously to increase aggregate bandwidth.
Transcript
04:40 of using the VPN with transit gateway,
04:44 and this time,
04:45 it is about increasing the total aggregated bandwidth
04:49 between the on-premise network and AWS,
04:51 so going back to our original architecture
04:54 where we had the VPC
04:55 with virtual private gateway or VPN gateway,
04:58 and you could connect directly to the customer gateway.
05:01 Now, what if you want to have the additional bandwidth
05:05 between these two networks?
05:07 So obviously, you would think
05:08 that you can have multiple VPN connections,
05:11 and then you can send the traffic
05:13 on both these connections at the same time,
05:15 therefore you get double the bandwidth,
05:17 but that's not true.
05:19 Now, that's for the reason
05:20 that virtual private gateway device here
05:22 has the limit of 1.25 Gbps aggregated bandwidth,
05:27 and you can't increase that,
05:30 and at the same time,
05:31 you know that VPN tunnel also has 1.25 Gbps
05:35 of maximum bandwidth limit,
05:37 and, in general, if you want to load balance the traffic
05:41 across multiple connections,
05:43 then you need to have ECMP, that is equal cost multipath,
05:48 which is like, you know, sending the traffic
05:50 on both the links at the same time,
05:54 and virtual private gateway doesn't support the ECMP.
05:58 Now, for that reason,
06:00 you can't have the higher bandwidth
06:03 than 1.25 Gbps
06:05 if you are terminating your VPN connection
06:07 on the virtual private gateway.
06:10 Okay, so what you can do in that case,
8. Transit Gateway 上的 BGP、ECMP 与聚合带宽
时间范围：06:12–08:39
总结 / Summary
中文
中转网关（Transit Gateway, TGW）支持动态路由（dynamic routing）和等成本多路径（Equal-Cost Multi-Path, ECMP）。当两条虚拟专用网络连接（Virtual Private Network connection, VPN connection）各含两条 1.25 Gbps 的互联网协议安全隧道（Internet Protocol Security tunnel, IPsec tunnel），并且 AWS 与客户路由器两侧都正确配置边界网关协议（Border Gateway Protocol, BGP）和 ECMP 时，理论聚合带宽可达到 5 Gbps。不过单流（per-flow），即单个传输控制协议连接（Transmission Control Protocol connection, TCP connection），仍只会使用一条隧道，因此最高保持 1.25 Gbps；多流量才能利用聚合容量。
English
A Transit Gateway supports dynamic routing and ECMP. With two VPN connections, each containing two 1.25-Gbps IPsec tunnels, correctly configured BGP and ECMP on both AWS and the customer routers can provide up to 5 Gbps of theoretical aggregate bandwidth. A single TCP flow still uses only one tunnel and remains capped at 1.25 Gbps; multiple concurrent flows are needed to use the aggregate capacity.
Transcript
06:12 you can use a transit gateway.
06:14 Now you are having multiple VPN connection
06:16 terminating on the same transit gateway,
06:19 and you enable the dynamic routing,
06:22 and you also enable the ECMP on both these VPN connections.
06:26 Now, on the customer router side,
06:28 you also need to take care of the BGP as well as ECMP.
06:33 Once you do that,
06:34 your traffic flowing from AWS to on-premises
06:37 or on-premises to AWS
06:39 can be load balanced across these two connections,
06:42 which means you get benefit of total aggregated bandwidth
06:46 across these two connections.
06:49 Now, if you want to calculate the total bandwidth
06:51 or, say, total effective bandwidth,
06:54 you know that every VPN connection
06:55 has two IPsec tunnels,
06:58 and every tunnel has the maximum bandwidth
07:01 of 1.25 Gbps,
07:03 so effective bandwidth out of this network architecture
07:07 will be up to 5 Gbps.
07:10 Now, I said effective
07:12 because the bandwidth and network throughput
07:14 depends on lot of factors,
07:16 but theoretically, you can consider
07:18 that you can combine the total aggregated bandwidth
07:22 across all these VPN connections.
07:26 Now, one more thing to understand
07:27 is that though you are getting more aggregated bandwidth,
07:31 the per-flow bandwidth is still limited to 1.25 Gbps
07:37 Now, per flow means per TCP connection,
07:40 so if you are sending, say,
07:42 100-GB file over a single TCP connection,
07:46 it will go through either of these four tunnels,
07:49 and every tunnel is still limited to 1.25 Gbps bandwidth,
07:53 so for that TCP connection,
07:55 you will still be limited to 1.25 Gbps bandwidth,
07:59 but if you are sending four files at the same time,
08:02 then total bandwidth could be up to 5 Gbps,
08:06 so I hope that is clear,
08:08 so now, in this case,
08:09 we are terminating both these VPN connections
08:11 on the same customer router side,
08:13 but you can also terminate these VPN connections
08:16 on different customer router side.
08:19 Only thing that you need to take care
08:21 is that when you advertise the BGP parameters,
08:24 for example, the local preference,
08:26 the MED values, the AS path, the ASN numbers,
08:30 they are exactly same
08:32 if you want to enable the ECMP, right?
08:36 Now, with that, we will slightly change this architecture,
08:39 and now we have two different routers,
9. Dual VPN 的特定路由与 BGP 故障转移
时间范围：08:39–10:27
总结 / Summary
中文
两条虚拟专用网络连接（Virtual Private Network connection, VPN connection）可终止在不同的客户路由器（customer router）上，但要实现等成本多路径（Equal-Cost Multi-Path, ECMP），两边通告的本地优先级（local preference）、多出口鉴别器（Multi-Exit Discriminator, MED）、自治系统路径（Autonomous System path, AS path）和自治系统编号（Autonomous System Number, ASN）等边界网关协议属性（Border Gateway Protocol attribute, BGP attribute）必须一致。示例把 192.168.0.0/24 拆成两个 /25 特定路由分配到不同 VPN，同时在两条链路上通告 /24 聚合 BGP 路由；某条链路故障时，聚合路由可让流量转移到仍可用的连接。该设计必须使用 BGP，不能使用静态路由（static routing）。
English
Two VPN connections can terminate on different customer routers, but equal BGP attributes—such as local preference, MED, AS path, and ASN—are required for ECMP. The example assigns two /25 specific routes from 192.168.0.0/24 to separate VPNs while advertising the aggregate /24 through BGP on both. If one VPN fails, the aggregate route allows traffic to fail over to the remaining connection. This design requires BGP and cannot use static routing.
Transcript
08:42 and suppose your corporate data center has the CIDR
08:45 of 192.168.0.0/24.
08:52 Then what you can do is
08:54 you can enable the ECMP on both these VPN connections,
08:58 and you can additionally configure the routes
09:01 such that you configure specific route
09:05 on a particular VPN connection.
09:07 For example, the first half of the CIDR traffic
09:11 will go through the first VPN connection
09:13 and second half of the CIDR
09:16 will go through the second connection,
09:18 and on top of this, you can also advertise the BGP routes,
09:23 which is aggregated route over both these VPN connections,
09:27 so if any of the VPN connection
09:30 is unhealthy or terminates,
09:32 then also, your traffic is routed
09:35 over the other active VPN connection,
09:37 so this kind of traffic routing you can do
09:40 to enable the ECMP along with the BGP routing,
09:44 so what I want you to take from this
09:47 is that with transit gateway and a VPN connection,
09:51 you can have the ECMP,
09:52 and you can have higher aggregated bandwidth.
09:55 Now, for that,
09:56 remember that you need to have the BGP routing configured.
09:59 You can't use the static routing.
10:02 Okay, I hope that is clear,
10:04 so as I said, we are going to talk more
10:06 about the VPN and transit gateway
10:08 in the VPN section as well,
10:10 but in this lecture,
10:11 I just wanted to touch upon these important concepts,
10:14 and I hope that is clear.
10:17 Now, with that, let's move on
10:18 to the next type of the attachment
10:20 that is direct connect attachment with transit gateway.
10:24 Thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
本讲说明中转网关虚拟专用网络附件（Transit Gateway VPN attachment）如何替代多个虚拟私有网关（Virtual Private Gateway, VGW）的一对一连接，把多个 VPC 与分支的站点到站点虚拟专用网络（Site-to-Site VPN）集中到区域级中转网关（Transit Gateway, TGW）。TGW 还支持加速虚拟专用网络（Accelerated VPN），通过 AWS 全球加速器（AWS Global Accelerator）把大部分路径放到 AWS 骨干网络（AWS backbone network）上；并支持边界网关协议（Border Gateway Protocol, BGP）与等成本多路径（Equal-Cost Multi-Path, ECMP），把多条 1.25 Gbps 隧道聚合成更高总吞吐量。需要牢记，单流仍受单隧道 1.25 Gbps 限制，ECMP 需要两端动态路由属性一致且不支持静态路由（static routing）。
English
Transit Gateway VPN attachments replace a growing mesh of one-to-one Virtual Private Gateway connections by centralizing Site-to-Site VPN connectivity for many VPCs and branches on a regional TGW. The TGW also enables Accelerated VPN through AWS Global Accelerator and supports BGP with ECMP to combine several 1.25-Gbps tunnels into higher aggregate throughput. A single flow remains limited by one tunnel, and ECMP requires consistent dynamic-routing attributes on both sides rather than static routing.
返回顶部 ↑