Lecture 85: Transit Gateway & Direct Connect
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:40
- 来源：Udemy Lecture 33514850
- Slide 数量：4
- 画面切换：00:35、01:25、04:31
扫描说明
逐条检查了 Udemy 页面中的 117 条 Transcript cue，并对全长约 5:40 的视频画面逐段扫描。依据标题页、无 TGW 的 Private VIF 架构、通过 Transit VIF 连接 TGW 的架构，以及通过 Public VIF 承载 IPsec VPN 的加密架构四张独立 Slide，共划分出 4 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Transit Gateway 与 Direct Connect 的组合
时间范围：00:00–00:35
总结 / Summary
中文
AWS Direct Connect（DX）为本地数据中心（on-premises data center）与 AWS 提供专用物理连接（dedicated physical connectivity）。中转网关（Transit Gateway, TGW）可与 Direct Connect 网关（Direct Connect Gateway, DXGW）组合，让这条专线扩展到多个区域、账户和大量虚拟私有云（Virtual Private Cloud, VPC）。
English
AWS Direct Connect provides dedicated physical connectivity between an on-premises data center and AWS. A Transit Gateway can be combined with a Direct Connect Gateway so that the private connection reaches many VPCs across regions and accounts.
Transcript
00:00 Hi.
00:01 Now in this lecture, let's understand
00:02 how Transit Gateway works with AWS Direct Connect.
00:06 For those who do not know what is Direct Connect,
00:08 it's actually a physical connectivity
00:10 between AWS and your on-premises data center.
00:14 Actually, we have covered the Transit Gateway scenarios
00:18 and architectures in very, very detail,
00:20 in the Direct Connect section.
00:22 So in this lecture, I'm not going
00:24 to go too deep into all this topic,
00:27 but let's try to understand at very high level
00:30 how you can use Transit Gateway with the Direct Connect.
2. 不使用 Transit Gateway：Private VIF 与 DXGW
时间范围：00:35–01:25
总结 / Summary
中文
不使用中转网关（Transit Gateway, TGW）时，专用虚拟接口（Private Virtual Interface, Private VIF）把 Direct Connect 连接到 Direct Connect 网关（Direct Connect Gateway, DXGW），再由 DXGW 关联不同区域中的虚拟私有网关（Virtual Private Gateway, VGW）和 VPC。该模型可跨区域，但视频中的当前配额示例最多关联 10 个 VPC，因此面对数百个 VPC 时扩展性不足。
English
Without a Transit Gateway, a Private Virtual Interface connects Direct Connect to a Direct Connect Gateway, which then associates with Virtual Private Gateways and VPCs in different regions. The model is cross-Region, but the quota shown in the lecture allows at most ten VPCs, so it does not scale well to hundreds of VPCs.
Transcript
00:35 Okay, so very first thing,
00:36 what if there is no Transit Gateway?
00:38 How do you connect your on-premise network
00:40 over a Direct Connect to AWS?
00:44 Now, for that you have to typically use a Private VIF,
00:48 and then Private VIF connects to the Direct Connect gateway,
00:52 and this Direct Connect gateway
00:54 can be connected to multiple VPCs in different AWS regions.
00:59 Now, as of today,
01:00 there is a limit of connecting maximum 10 VPCs,
01:04 which means if you have hundreds of VPCs
01:06 which you want to connect,
01:07 then this architecture doesn't help.
01:10 And exactly to solve that problem,
01:12 you can rather use Transit Gateway.
01:15 So in that case, the architecture looks a little different.
01:19 So instead of using the Private VIF,
01:22 you have to use something called Transit VIF.
01:25 And as I said, we are going to cover this in very detail
3. Transit VIF、DXGW 与多区域 Transit Gateway
时间范围：01:25–04:31
总结 / Summary
中文
采用中转虚拟接口（Transit Virtual Interface, Transit VIF）时，Direct Connect 先接入 Direct Connect 网关（Direct Connect Gateway, DXGW），再由 DXGW 关联不同区域中的中转网关（Transit Gateway, TGW）；每个 TGW 可继续汇聚大量 VPC，从而获得更好的多区域（multi-Region）、多账户（multi-account）扩展性。视频给出的当时配额是：单条专用 Direct Connect 连接（dedicated Direct Connect connection）最多创建 4 个 Transit VIF，单个 DXGW 最多关联 6 个 TGW，因此理论上可覆盖 24 个 TGW。配额会变化，应以当前 AWS 文档为准。还需计入 TGW 按 GB 收取的数据处理费（per-GB data processing charge）；大量数据经 DX 传输时，这项成本可能影响架构选择。
English
With a Transit VIF, Direct Connect reaches a Direct Connect Gateway, which associates with Transit Gateways in different Regions. Each TGW can aggregate many VPCs, providing much greater multi-Region and multi-account scale. The lecture's then-current quotas allow four Transit VIFs per dedicated Direct Connect connection and six TGWs per DXGW, yielding a theoretical 24 TGWs; these quotas can change and should be checked against current AWS documentation. The design also incurs per-GB TGW data-processing charges, which can be significant for high-volume Direct Connect traffic.
Transcript
01:29 in the Direct Connect section.
01:31 Okay, so what you do,
01:33 you have a Direct Connect, you create a Transit VIF
01:36 and you associate this Transit VIF
01:38 with a Direct Connect gateway.
01:41 And now you can connect Direct Connect gateway
01:44 to the Transit Gateway in different AWS regions.
01:48 And you already know that
01:50 one Transit Gateway in a given region
01:52 can be connected to hundred and thousands of VPC.
01:56 So this architecture provides you that scale.
02:01 And again, with respect to some limits and quotas,
02:03 as of today, you can connect up to six Transit Gateways
02:07 to the same Direct Connect gateway.
02:10 And on a single dedicated AWS Direct Connection,
02:15 you can create up to four Transit VIFs.
02:18 So if you do your calculations,
02:20 that means on a single AWS Direct Connect connection,
02:24 you can connect up to 24 Transit Gateways
02:28 in different AWS regions.
02:31 Now, again, don't quote me for this limit numbers,
02:34 they always change, but as of today, that's how they look.
02:39 Okay, so this is much better architecture
02:41 with respect to the scalability, again,
02:43 they can be across different AWS account.
02:47 That means your Direct Connect can be in
02:49 different AWS account and your Transit Gateways and VPCs
02:53 could again be in different AWS accounts.
02:57 Okay, now before we move on to the next architecture,
03:00 just I wanted to make a small comment.
03:03 Whenever you use Transit Gateway,
03:05 there is additional charge for per GB data processed
03:09 by the Transit Gateway.
03:10 So if you ask me,
03:12 I'm not a great fan of using Transit Gateway
03:15 when there is too much data being transferred over
03:18 DX connection because there is
03:21 per GB data processing charge.
03:23 So I have covered this in detail
03:25 in the Direct Connect section
03:27 where I have shown different scenarios
03:30 where I have made some suggestion
03:32 around when to use Transit Gateway
03:34 and when it is not recommended to use Transit Gateway.
03:38 So do watch that lecture in Direct Connect section.
03:42 Okay, now one more architecture,
03:44 and this is with respect to the security of the network.
03:48 Now, if you see this architecture,
03:50 all the traffic from on-premises,
03:52 which is reaching to VPC is going unencrypted.
03:56 But maybe some enterprises have the compliance requirement
04:00 to have the traffic encrypted at layer three or layer four,
04:04 and in that case, this architecture doesn't support that.
04:08 But if you just change this architectural a little,
04:11 you can achieve IP-layer encryption.
04:15 And for that, what you need to just do is
04:18 instead of using the Transit VIF
04:20 and connecting to the Transit Gateway like this,
04:24 you rather make an IPSec VPN connection
04:28 to your Transit Gateways.
04:29 Now how that will look.
4. 通过 Public VIF 建立 IPsec VPN 加密
时间范围：04:31–05:40
总结 / Summary
中文
原生 Transit VIF 路径并不提供第三层加密（Layer 3 encryption）。有合规加密要求时，可在 Direct Connect 上创建公有虚拟接口（Public Virtual Interface, Public VIF），通过它访问中转网关虚拟专用网络端点（Transit Gateway VPN endpoint）的公有 IP，并建立互联网协议安全虚拟专用网络（Internet Protocol Security Virtual Private Network, IPsec VPN）。这样本地到各 TGW 的流量仍经 Direct Connect 传输，同时在第三层实现加密。
English
A native Transit VIF path does not provide Layer 3 encryption. When compliance requires encrypted transport, a Public VIF can reach the public IP addresses of Transit Gateway VPN endpoints, allowing IPsec VPNs to terminate on each TGW. Traffic still follows Direct Connect while gaining Layer 3 encryption.
Transcript
04:31 Now for that on AWS Direct Connect,
04:34 you should create the Public VIF.
04:36 Now, Public VIF allows you to connect
04:38 to all AWS public IPs.
04:42 And if you know about the Transit Gateway VPN Endpoints,
04:46 Transit Gateway provides a pair of public IPs
04:49 where you can terminate your VPN connection.
04:52 So in this case, from the Direct Connect,
04:55 you can have that IPSec VPN connection terminated
04:59 on every Transit Gateway.
05:02 And in that case, the traffic between
05:04 Direct Connect and the Transit Gateway will be encrypted.
05:09 Now, I just added this
05:10 because we have seen some questions around this scenario
05:13 and that's where you need to know that.
05:16 So I hope that is clear.
05:19 Now with respect to Direct Connect,
05:21 I think that's what you need to know at this moment.
05:23 And as I said, there are more scenarios
05:26 that we are going to cover in the Direct Connect section.
05:31 So that's it about this lecture.
05:33 And now let's understand about some additional features
05:35 of Transit Gateway.
05:37 Thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
本讲对比了 Direct Connect（DX）接入 AWS 的三种思路：专用虚拟接口（Private VIF）经 Direct Connect 网关（Direct Connect Gateway, DXGW）直接关联虚拟私有网关（Virtual Private Gateway, VGW），适合较少 VPC；中转虚拟接口（Transit VIF）经 DXGW 关联多个中转网关（Transit Gateway, TGW），适合多区域（multi-Region）、多账户（multi-account）和大规模 VPC；公有虚拟接口（Public VIF）承载互联网协议安全虚拟专用网络（Internet Protocol Security Virtual Private Network, IPsec VPN），用于满足第三层加密（Layer 3 encryption）要求。采用 TGW 时要同时评估配额和按 GB 数据处理费（per-GB data processing charge）。
English
The lecture compares three Direct Connect patterns: a Private VIF through a Direct Connect Gateway to Virtual Private Gateways for a limited number of VPCs; a Transit VIF through the DXGW to multiple Transit Gateways for multi-Region, multi-account scale; and a Public VIF carrying IPsec VPNs when Layer 3 encryption is required. TGW quotas and per-GB data-processing charges must be included in the design decision.
返回顶部 ↑