网络课程笔记

00:00 Hello, and welcome to this lecture,

00:01 Multicast with Transit Gateway.

00:03 Now, this is another topic which may come into your exam,

00:06 but may not be into too much of detail.

00:09 So it's important to just know

00:10 about what is multicast

00:12 and what are the features available in Transit Gateway

00:15 for supporting multicast traffic.

00:17 And then, that should be good enough.

00:19 So, first, we'll start with very basics, what is multicast.

00:22 And then, we'll see how Transit Gateway

00:24 supports multicast traffic.

00:27 So what is multicast?

00:28 By the definition if you just Google it, right,

00:30 you would know that multicast is like sending the packet

00:34 to multiple destination at the same time.

00:36 So instead of sending one-to-one message

00:39 from source to the destination,

00:41 which is typically a unicast,

00:43 you are just sending the message once to an IP address

00:46 and it gets delivered automatically

00:49 to multiple receivers at the same time.

00:52 So that's essentially is a multicast.

00:55 Now, in case of multicast, there could be multiple sources

01:00 who are sending these messages

01:01 and there could be multiple destinations

01:03 who are receiving those messages.

01:05 So you can create kind of multicast groups.

01:07 And then, you can define who are the sources,

01:10 who are the destinations in that group.

01:12 And then, message starts flowing.

01:14 Now, for multicast typically there is a class D address

01:17 that you allocate to the multicast group.

01:20 And that address should be from the range

01:22 224.0.0.0 to 239.255.255.255.

01:27 So you need to associate one group ID

01:30 for your multicast group.

01:31 And then, if you send a single message

01:34 from the source to the multicast group IP address,

01:37 then it gets delivered to all the receivers in that group.

01:41 And the multicast protocol is connectionless

01:44 based on the UDP.

01:45 And it's one-way communication.

01:46 That means traffic flows from source

01:49 to the destination only.

01:51 Now, few example of the multicast are like,

01:53 you know, TV or media.

01:55 So, you know that you can watch any channel

01:58 and, like you, there are many people

02:00 who are watching those channel on the TV.

02:02 So media companies will use multicast

02:04 to really deliver the content

02:07 to all the subscriber of that channel.

02:10 Similarly, conference calls, group chat, OTT platform.

02:13 So it's everywhere basically, right.

02:15 For updating the stock exchange information or transactions,

02:20 to all the third-parties who are interested,

02:22 you can also use multicast there.

02:24 So it's important protocol.

02:26 And then, AWS now supports multicast with transit gateways.

02:30 Now, few components of the multicast are multicast domain,

02:34 which is basically an umbrella

02:36 under which you can then define multicast group.

02:39 And then, within that multicast group,

02:40 you can define members.

02:42 So member can join the multicast group,

02:45 they can leave the multicast group.

02:47 It is kind of subscription to certain OTT platform, right.

02:50 You can subscribe and unsubscribe.

02:52 Likewise, you can join or leave the multicast group,

02:55 so that you start getting the message

02:58 or you stop receiving the message.

03:00 And finally, it uses the IGMP protocol

03:03 for this group memberships,

03:04 which is Internet Group Management Protocol.

03:07 So any member can use this IGMP protocol messages

03:11 to join or leave the group.

03:13 And we'll talk more about that shortly.

03:15 So essentially, that is multicast.

03:17 And if you now look at how

03:19 AWS Transit Gateway supports the multicast,

03:22 you have to enable the multicast feature

03:25 while you create the transit gateway.

03:27 That means after you create the transit gateway,

03:29 you can't enable that.

03:30 So remember this thing.

03:32 It supports both IPv4 and IPv6 IP addressing for multicast.

03:36 And then, it also supports hybrid integration

03:39 with external applications,

03:41 which means if you want to have the group members

03:43 outside of, you know, AWS instances, you could also do that.

03:48 So, you could have your sources

03:50 of the multicast traffic outside of AWS,

03:52 and then sending all the traffic

03:54 to EC2 instances in the VPC,

03:57 which are attached to your transit gateway.

03:59 That is possible.

04:01 Now, for membership of the multicast group,

04:04 there are two ways typically,

04:06 static membership and dynamic membership.

04:08 For static membership, you can use AWS, CLI or SDK

04:12 using an API call instance in the multicast group,

04:16 can join the group or it can leave the group.

04:18 Or if instance supports the IGMP protocol,

04:21 then it can also use IGMP join or leave messages

04:24 to, you know, join or leave the group.

04:27 So now, let's look at how the multicast traffic flows

04:29 into the VPC or how the architecture looks like, right.

04:33 So this is a simple architecture that is a VPC.

04:35 There are multiple subnets and across multiple AZs.

04:39 And then, you have transit gateway

04:40 which is attached to the VPC.

04:44 And then, ENIs have been provisioned into every AZ.

04:47 And while we created this transit gateway,

04:49 we also enabled the multicast for this.

04:52 Now, in this case, you first create the multicast domain,

04:56 and then your subnet will be participating

04:59 in this multicast domain.

05:01 So one subnet can be part

05:03 of only one multicast domain at the same time.

05:07 And then, once you have those subnets defined,

05:09 you can then have multicast group created.

05:12 A group is nothing but a group of ENIs into your subnet.

05:16 So you can say, I want ENI one, two and three

05:19 be part of my multicast group.

05:21 It's not necessary to have all the ENIs in the subnet

05:24 to be a part of the group.

05:25 So it is kind of, you know, your decision,

05:28 which instances becomes part of your multicast group.

05:31 And then, you have to also assign the class D address

05:34 to your multicast group, as we just spoken about.

05:38 And then, group membership can be configured

05:41 using AWS, CLI or SDK,

05:43 or dynamically using IGMP protocol.

05:46 So you can send the traffic to multicast group.

05:48 And then, all the members in that group

05:50 will receive that traffic.

05:52 And then, this works for across the VPCs as well.

05:55 That means you could have multiple VPCs

05:57 attached to the same transit gateway.

05:59 And you can create a multicast group,

06:01 which has instances across the VPCs, right.

06:05 So that means one message can go to different VPCs

06:08 and different, EC2 instances in those VPCs.

06:12 And it works across multiple accounts as well.

06:15 That means, not necessarily you should have

06:16 just transit gateway and VPC from the same AWS account.

06:20 So, that's about how the traffic flows

06:23 in case of transit gateway multicast.

06:25 Now, you could also do another thing,

06:27 as I said, you can integrate transit gateway

06:30 with external multicast services.

06:32 So maybe you want to send a multicast message

06:35 from your on-premises application to AWS EC2 instances.

06:40 Maybe their subscriber of the, you know

06:43 media or video files, right.

06:46 Now, in this case, if you directly attach

06:48 your corporate data center to transit gateway

06:52 over Direct Connect, it doesn't help.

06:54 Because transit gateway does not support multicast

06:56 over Direct Connect or Connect attachment, right.

07:00 For this, you need to do something different.

07:02 And what you can do in that case,

07:04 first, you connect your on-prem data center to VPC

07:07 using any underlying transport mechanism.

07:10 It could be VPN, or it could be DX.

07:12 So let's take an example of Direct Connect, right,

07:15 or over the internet as well.

07:17 Once that connectivity is established,

07:19 you can have your virtual router configured into your VPC.

07:23 And this virtual router can then create a GRE tunnel

07:26 with your on-premises router.

07:29 Now, that is really an SD-WAN kind of network

07:32 where you are extending your corporate data center to AWS.

07:36 And once this GRE tunnel is enabled,

07:39 you can then bring in the transit gateway,

07:41 and can attach all these EC2 instances inside your VPC,

07:45 ENIs to this transit gateway and create a multicast domain,

07:49 and then, can create a multicast group.

07:51 And now, this multicast router from on-premises

07:54 can send the traffic to your virtual router,

07:59 which are part of your multicast group as a source,

08:03 and then, it'll send this traffic to the transit gateway,

08:06 and then, transit gateway will then multicast it

08:08 to all the members in the multicast group.

08:11 So, that's how you can integrate

08:12 your on-premise data center multicast services with AWS.

08:18 So, essentially these are the two use cases.

08:20 You can use multicast within the VPC

08:22 and you can also integrate with third-party services.

08:25 Now, exam perspective, few important things for you to know.

08:29 So, first, transit gateway support routing multicast traffic

08:33 between subnets of attached VPC.

08:35 We just learned that.

08:36 Now, one subnet can be a part

08:38 of only one multicast domain at a time.

08:40 Host, that means ENI in the subnet,

08:43 can be part of either one or multiple multicast groups

08:46 within the same multicast domain.

08:49 Now, multicast group membership is managed using VPC console

08:53 or CLI or using IGMP, which is dynamic, right.

08:57 And then, multicast group member

08:58 can use join or leave messages, which are supported by IGMP,

09:02 to join the group or leave the multicast group dynamically.

09:07 Now, in order to renew the multicast group membership,

09:12 transit gateway issues IGMP query message

09:15 to all the members every two minutes.

09:17 And if members wants to continue

09:19 to be a part of your multicast group,

09:23 then they would respond to the join message.

09:25 And then, their membership is renewed.

09:28 Now, there are other things to consider

09:31 that the members that do not support IGMP

09:34 can still join the group using static membership.

09:38 And that can be done using VPC console or AWS CLI.

09:42 So in a nutshell, to join the multicast group

09:44 there are two options.

09:45 Statically using the AWS CLI or VPC,

09:49 or dynamically using IGMPv2 protocol.

09:52 So in case of AWS multicast domain

09:55 supports few attributes and that defines the behavior

09:58 how the members could join the group,

10:00 or which members can send the traffic.

10:02 So IGMPv2Support attribute determines

10:05 how the group members join or leave the multicast group.

10:07 If this attribute is set,

10:09 then members can join or leave the message

10:13 by sending these messages to the transit gateway.

10:16 And if this attribute is not enabled,

10:20 that means you would have to do that statically

10:22 using AWS CLI or VPC console.

10:26 There is another attribute called StaticSourcesSupport.

10:29 Okay, if this attribute is set,

10:31 then, in the multicast domain,

10:32 you're defining that there is a set of sources in the group.

10:36 Only they can send the message, right.

10:39 Those are the machines who can initiate

10:42 this multicast domain message.

10:44 If this attribute is not set,

10:46 then any member in the group can send the message, right.

10:49 But if you want to restrict that,

10:51 then you can set this StaticSourcesSupport attribute

10:54 on the multicast domain, and you can designate,

10:56 like these are the sources who can send

10:59 the multicast message in the group.

11:03 Additionally, multicast sender

11:05 should be only Nitro System instance.

11:07 Now, what is Nitro System?

11:08 It is specially built hardware by AWS,

11:11 which is much more performant.

11:13 And it bypasses a lot of hypervisor level latencies.

11:18 It is built by AWS ground-up.

11:21 And you will see all next generation instances

11:24 are based on the AWS Nitro System.

11:27 So only a Nitro System instance can be a multicast sender.

11:32 But any non-Nitro instance can be a multicast receiver.

11:35 And in that case, you would have to disable

11:37 the source/destination check on that instance,

11:40 if it is non-Nitro instance.

11:43 Multicast routing is not supported

11:45 over AWS Direct Connect, or site-to-site VPN,

11:48 or Transit Gateway peering attachment,

11:50 or Connect attachment.

11:51 We just talked about that.

11:52 And that's where we had, you know,

11:54 GRE tunnel configured from on-premises to AWS.

11:57 And then, we could have the multicast domain

12:00 across a hybrid network.

12:02 Further, you also need to make sure

12:04 that your network ACL for the subnets

12:07 and the security group for the host

12:10 which are participating in the multicast domain and group,

12:14 should allow the respect to traffic for IGMP protocol,

12:18 as well as sending and receiving this multicast traffic.

12:22 Now, with respect to that,

12:23 if you have the network ACL configured,

12:25 then you should have the inbound rules in the network ACL,

12:29 should allow the IGMP protocol two traffic from 0.0.0.0/32.

12:34 And this traffic for IGMP query

12:37 is sent to the fixed IP address.

12:39 And this is a standard for multicast

12:42 class D address, 224.0.0.1/32.

12:45 And similarly, for actually sending the multicast traffic,

12:48 you need to allow the UDP traffic from the remote host.

12:52 Similarly, the outbound traffic

12:54 from your subnets to the outside, right.

12:57 If your host needs to leave the multicast group,

13:00 then they need to send the request over IGMP2

13:04 224.0.0.2/32 IP address.

13:08 And then, in order to join the group,

13:10 they need to send a join message

13:12 to multicast group IP address.

13:13 Now, this group IP address is something that you designate

13:16 when you create a multicast group.

13:18 And then, finally, actual multicast traffic

13:21 flows over to the UDP.

13:23 Similarly, for the security group.

13:25 For IGMP query, you should allow the inbound traffic

13:28 from 0.0.0.0/32, and also allow the inbound traffic

13:33 from the remote host which is sending the inbound traffic.

13:37 And for the outbound traffic again, for IGMP leave message,

13:41 you should be able to send that message to 224.0.0.2/32.

13:46 And similarly, for joining the group,

13:48 you should be able to send the outbound message

13:50 from your host to multicast group IP address.

13:53 And in order to send the multicast group message,

13:56 you don't send it to individual hosts, right.

13:57 You send it to a multicast group IP address,

14:00 which you, again, allocate while you create

14:02 the multicast group.

14:03 So that outbound traffic over UDP should also be allowed.

14:07 So remember this thing at the high level,

14:09 that you need to, you know, have the right rules

14:12 into your network ACL and security groups.

14:15 Okay, and just one final thing.

14:17 You can also share your multicast domain

14:20 with AWS accounts inside your organization.

14:24 Or if your organization unit inside organization,

14:26 this multicast domain can be shared

14:27 with those organization units as well.

14:30 That means the VPCs and the subnets

14:33 that participate in a multicast domain

14:36 could be a part of different AWS account,

14:38 different organization unit, or even the AWS account

14:42 across different AWS organization, and not just yours.

14:46 Just that for sharing this multicast domain

14:48 with other AWS accounts,

14:50 you need to be owner of this multicast domain.

14:53 So, if someone has shared this domain with you,

14:56 you can't further share with other AWS accounts.

14:59 And then, multicast domain sharing also integrates

15:02 with AWS Resource Access Manager, that is AWS RAM.

15:05 And we'll talk more about AWS RAM later

15:08 when we talk about the shared transit gateways.

15:11 But overall, these are the thing

15:12 that you should be knowing for your exam.

15:15 So just a quick recap.

15:16 AWS Transit Gateway supports multicast

15:19 with IGMP version two protocol,

15:22 which means that the subnets inside a VPC

15:24 can be a part of multicast domain.

15:27 And then, host with their ENIs

15:29 can be a part of multicast group.

15:31 And then, you can also integrate

15:33 the multicast domain externally

15:36 with third-party multicast services using GRE tunnel.

15:40 And we have seen that architecture, how it works.

15:43 So, that's it for this lecture.

15:46 Maybe there could be a question

15:47 around multicast in the exam,

15:48 and with the information that we covered in this lecture,

15:51 you should be able to answer that.

15:53 So thanks for watching this lecture and let's move on.