网络课程笔记

00:00 Hello and welcome to this lecture.

00:02 Now that you understood how transit gateway works and we already covered different attachment

00:07 types of the transit gateway.

00:09 Now with this knowledge, we can definitely build a lot of interesting architectures and

00:15 then these architectures can support different network routing scenarios.

00:20 Now one of such architecture is centralize the networking access through transit gateway

00:25 and you will typically come across this kind of architecture in the enterprises where there

00:30 are a lot of VPCs and then you want to have better control over the traffic which flows

00:35 through this VPCs and typically for that you will have a shared services VPC and all the

00:41 traffic going to the internet or to other VPCs you can route through this shared services VPC.

00:49 So it looks something like this.

00:51 On the left side you have application VPCs and on the right side you have shared services VPC.

00:56 Then you connect all these VPCs using the transit gateway and now if you want to have

01:01 centralized egress access, then all the traffic will be routed through this shared services VPC.

01:08 So any of the application VPCs doesn't have their own internet gateway, but rather all

01:15 the traffic to internet is routed to this shared services VPC.

01:20 And similarly, you can also monitor all the traffic which is going to internet or any

01:25 traffic that flows between the VPCs through this network appliances which you can deploy

01:30 in shared services VPC.

01:33 So here in next two to three lectures, we are going to talk about all such architectures

01:39 and for your networking certification exam, these are very important architectures because

01:45 I'm sure there will be questions around such scenarios.

01:49 So make sure that you understand all these architectures well enough.

01:54 So first use case that we will talk about is how do you implement the centralized egress

02:00 access using the transit gateway, which means all these application VPCs, when they want

02:06 to reach to the internet, the traffic should flow through this shared services VPC.

02:12 So architecture will look something like this.

02:14 On the left side, you have application VPCs, on the right side you have egress VPC and

02:19 then you connect all these VPCs to the transit gateway.

02:23 Now with respect to the traffic flow, the most important part here is how do you configure

02:28 the route tables and that's how the traffic will be routed to the right destination.

02:34 So if you talk about the route table for this VPC, that is for the application subnet, we

02:39 are saying that all the traffic to the internet will go to the transit gateway, which is obvious.

02:46 Now with respect to the routing for this attachment of the VPCs, now typically all these spoke

02:52 VPC attachment will have a common route table because routing requirements are the same.

02:57 So this route table will look something like this.

03:00 Again we are saying that all the traffic going to internet will go through this egress VPC

03:05 attachment and additionally we have added this black hole route.

03:10 Now this black hole route right now is to prevent the inter VPC communication and shortly

03:16 I am going to talk more about this black hole route table entry.

03:20 Okay, so this is a route table for this attachment in which you have route propagated for egress VPC attachment.

03:27 So I hope that is clear.

03:29 Now for the route table of egress VPC attachment, typically all the traffic will flow back from

03:35 the internet and you need to route back it to respective VPCs.

03:38 So as you might have guessed, this would have the route propagated from both these attachment

03:44 to respective VPC CIDR ranges, right?

03:44 So that's obvious.

03:49 And now as the traffic from this VPC reaches to the transit gateway ENI is here in the

03:55 egress VPC, all this traffic has to be forwarded to the NAT gateway and that's where there

04:02 will be a route table entry for this subnet to forward all the traffic.

04:06 Now for NAT gateway subnet, the route table entry will have default route to the internet,

04:12 which is obvious and for all the return traffic from the internet, it will send the traffic

04:17 back to the transit gateway.

04:20 And from there, as there is this route table here, it will be sent back to the respective VPCs.

04:27 So this is how you will configure your route tables.

04:30 So if instance A here initiates the traffic to the internet, the flow will look something

04:36 like this, right?

04:38 And similarly, the return traffic will come back from the internet and go to the originating instance.

04:45 Now, in this case, you know that transit gateway tries to maintain the traffic in the same

04:50 AC in which it is originated.

04:53 So if instance B, for example, here initiates the traffic, then transit gateway will send

04:58 it to the NAT gateway in different AC.

05:02 And doing that actually helps you with the high availability of the NAT gateways as well

05:07 as your inter AC data transfer cost is saved.

05:12 So this is a better architecture where you are leveraging multiple availability zones.

05:18 So just keep that in mind.

05:19 Okay, so important thing to know about this architecture is that we have NAT gateways

05:25 in each AC, which provides high availability as well as it saves inter AC data transfer cost.

05:32 And in this case, if any of the AC fails, then also your traffic will be routed to another

05:37 AC automatically.

05:38 Now, with respect to the NAT gateway performance, because we are now centralizing all the egress

05:45 through a NAT gateway, it shouldn't happen that NAT gateway is a bottleneck and in that

05:50 case you should know NAT gateway performance.

05:53 So as of today, it supports 55,000 simultaneous connection to a unique destination and with

06:00 respect to the bandwidth, it can scale up to 100 Gbps.

06:04 Now this bandwidth limits might change in the future, but this is how it looks as of today.

06:09 Now, earlier I talked about the black hole route in the attachment route table, right?

06:16 Now let's try to understand more about why we need that route.

06:20 So this is the architecture.

06:22 Now what if you remove this black hole route, right?

06:25 Now let's try to trace down then what happens if VPC A tries to communicate with VPC B.

06:33 So in that case, traffic again will originate here.

06:37 Now with this route table, it will go to the transit gateway.

06:41 Now at this point, there is only one route that is a default route, which goes to egress VPC attachment.

06:47 So it will go here, it will go to the NAT gateway.

06:50 And now because the destination is VPC B here, NAT gateway will use this second route

06:50 here to return back the traffic to the transit gateway and then it will go like this.

07:03 Now this is not very efficient in the sense that inter-VPC communication is also going

07:09 through the NAT gateway.

07:09 So you will pay additional cost of the NAT gateway.

07:13 So rather, if you want to allow the inter-VPC communication, you should add the route table

07:19 entries right here in this particular route table.

07:23 So it will look something like this, right?

07:26 Now you are propagating the corresponding attachment routes into the same route table

07:32 and now the traffic directly goes from one VPC to another through the transit gateway.

07:38 It doesn't go through this shared services VPC.

07:38 But in this architecture, we did not want to allow inter-VPC communication and that's

07:47 where we had added that black hole route.

07:50 So I hope that is clear.

07:52 Okay, so this is one of the architecture that is very common and we have seen questions around this.

07:58 So make sure you understand all the routes that you see in this route table.

08:03 And now finally, before we stop for this lecture, you need to also understand the cost element here.

08:09 Now centralizing access through the NAT gateway doesn't necessarily give you a lot of cost benefits.

08:15 That's for the reason that transit gateway itself has two costs associated with it.

08:21 One per attachment and also data processing charge per GB.

08:27 So if you make your calculation, it doesn't really make a lot of difference.

08:32 But I would say this kind of architecture is more beneficial if you want to have more

08:37 control over your traffic.

08:40 And that's where you will see this kind of architecture more in the enterprises where

08:44 there are hundreds of VPCs and there is a separate team who manages the transit gateway

08:49 and shared services VPC.

08:52 Okay, so I hope that is clear.

08:54 With that, we will stop for this lecture.

08:56 So thanks for watching and stay tuned.