网络课程笔记

00:01 Hello, and welcome to this lecture.

00:03 Now, in this lecture, we are going to see

00:04 how you can centrally inspect the traffic

00:07 using the virtual network appliances.

00:11 Now in the AWS world, AWS had launched a new type

00:14 of the load balancer called Gateway Load Balancer,

00:17 which works with this network appliances

00:19 to transparently inspect or intercept your traffic,

00:24 and then you can route this traffic to network appliances.

00:26 And finally, that packet can be delivered

00:29 to your destination application.

00:32 So Gateway Load Balancer is a special load balancer

00:34 for the reason that it uses the encapsulation protocol

00:37 like GENEVE Protocol,

00:39 and that's where the entire traffic load

00:42 through the Gateway Load Balancer is transparent to you.

00:45 And we are going to cover Gateway Load Balancer

00:48 in more detail in the security section of this course.

00:52 But in this lecture, let's focus more

00:54 on the networking element with respect

00:56 to the Transit Gateway

00:58 and how do you configure the route table

01:00 to enable this kind of traffic inspection?

01:04 So quickly, if you don't know

01:05 about the Gateway Load Balancer,

01:07 so basically you can intercept any traffic

01:10 whether you are receiving that traffic from the internet,

01:12 or if two EC2 instances

01:14 within different VPCs are communicating with each other,

01:17 all those network traffic can be intercepted.

01:20 Because what you can do is in your route table, you can say,

01:23 the destination is Gateway Load Balancer endpoint,

01:26 which are nothing but the private links.

01:29 And then this private links takes your traffic

01:31 to the Gateway Load Balancer,

01:33 which has your network appliances as the target.

01:36 So as of now, no need to get into more detail here,

01:38 but just understand that we are going

01:40 to use Gateway Load Balancer to send our all traffic

01:43 to the network appliances.

01:46 Now, in the previous lecture we already talked about

01:49 how you can have the routing configured

01:52 if you want to send traffic to the internet.

01:54 Now there we are just adding

01:56 one more traffic inspection layer,

01:58 so it'll look something like this.

02:01 Now this is the first scenario where we want

02:03 to inspect the traffic

02:05 when you send the traffic from one VPC to another.

02:08 So what we are saying is this first VPC wants

02:11 to send the traffic to second VPC here,

02:13 but all the traffic should go

02:14 through this network appliances.

02:16 And for that, if you see on the right side,

02:18 we have traffic inspection VPC

02:21 in which we have Gateway Load Balancer end points,

02:24 which takes our traffic transparently

02:27 to the Gateway Load Balancer.

02:28 And then Gateway Load Balancer

02:29 uses GENEVE encapsulation protocol to send this traffic

02:32 to the network appliances, right?

02:35 So with that, let's see now how you configure the routing

02:39 for this traffic to flow end to end.

02:42 Now, very first thing, your VPC route tables,

02:45 which are very similar to what we had seen earlier.

02:48 So there is a default route to take all the traffic

02:51 to the transit gateway.

02:53 Next, if you want to talk about the attachment route table

02:56 for this VPC, then there will be just one route,

03:00 which takes all the traffic

03:01 to the traffic inspection VPC attachment.

03:05 And now here we don't have the black hole route

03:07 because we want to actually enable the traffic

03:10 between these two VPCs.

03:12 But all this traffic should be routed

03:13 through this network appliances,

03:16 and that's where we have just this single route.

03:18 Okay, now, if you talk about the route table

03:21 for this attachment, then it is very similar

03:24 to the earlier architecture where hidden traffic will go

03:28 to the respective VPCs, right, so I hope that is clear.

03:32 Now is the important thing

03:33 where as the traffic reaches to this transit gateway ENIs

03:37 in the traffic inspection VPC,

03:39 we want to send all this traffic

03:42 to the Gateway Load Balancer endpoint,

03:44 and that's where you have the default route,

03:47 which takes traffic to this Gateway Load Balancer endpoint.

03:52 Now, once the traffic reaches

03:53 to the Gateway Load Balancer endpoint,

03:54 then everything is transparent,

03:57 which means Gateway Load Balancer will take that traffic

03:59 to the Gateway Load Balancer.

04:00 From there, it'll go to the appliance,

04:02 and appliance will inspect the traffic.

04:05 We'll send it back to the Gateway Load Balancer to back

04:08 to this Gateway Load Balancer endpoint.

04:10 So at this moment,

04:12 after the traffic reaches back

04:14 to the Gateway Load Balancer endpoint,

04:15 it has to now again send it back to the transit gateway

04:18 so that it can be delivered to the right destination.

04:23 So if you talk about the route table

04:25 for this subnet in which you have Gateway Load Balancer

04:27 and the appliances,

04:29 then you just need this additional aggregated route

04:32 to send the traffic back to the transit gateway.

04:37 So now if you want to send traffic from this instance A

04:40 in VPC A to the instance B in this VPC B,

04:44 then flow will look something like this.

04:46 So it'll go to the transit gateway.

04:49 From there, it'll take this transit gateway route table

04:53 for this attachment, it'll go to this ENI

04:57 because there is this route propagation.

05:01 Then as it reaches to the transit gateway ENI,

05:03 it'll take this default route

05:05 to the Gateway Load Balancer.

05:07 At this point, it'll go to the Gateway Load Balancer

05:10 to the appliance back to the Gateway Load Balancer,

05:13 back to the Gateway Load Balancer endpoint.

05:15 And now again, it'll take now this route table

05:18 to take this back to the transit gateway

05:20 and transit gateway will deliver

05:22 through this attachment route table to the VPC B

05:26 and to the target B, right?

05:29 And similarly, the return traffic

05:31 from instance B will go back to the instance A.

05:35 Now, at this moment, if you remember the earlier lecture,

05:37 we have to typically enable the appliance more

05:41 for transit gateway at this point.

05:43 That's because otherwise the traffic from this instance B,

05:49 which is in different AZ,

05:49 might go to this transit gateway ENI number two,

05:53 and then to different gateway endpoint,

05:56 and which creates asymmetric flow

05:58 for the network appliances.

06:01 And that might reject your traffic

06:03 because for symmetric flow,

06:05 it should see both the original request

06:07 and the return packet.

06:10 So if you enable the appliance mode,

06:12 transit gateway will make sure

06:13 that the return traffic will go to the same AZ or ENI

06:18 in this inspection VPC.

06:21 So return traffic will flow something like this.

06:25 Right, so traffic ultimately goes back to instance A,

06:30 and this is how you configure the Gate Load Balancer

06:33 for inter VPC traffic inspection.

06:36 So I hope that is clear.

06:40 Now, let's add some more complexity to this architecture.

06:43 Now what we want to do is we also want

06:46 to monitor the traffic, which is going out to the internet.

06:50 And in the earlier lecture, we already saw that

06:52 we need NAT gateway in this traffic inspection VPC

06:57 to send traffic to the internet

06:59 from this traffic inspection VPC.

07:02 So our architecture now will look something like this.

07:06 So we have added two more subnets in two different AZs

07:09 and we have provision NAT gateways,

07:11 and then there is internet gateway.

07:13 Now, with respect to the routing,

07:15 there are few changes that we need to do.

07:18 So most of the things on the left side are as it is.

07:22 Now, if you see this appliance

07:25 and Gateway Load Balancer endpoint route table,

07:27 we have added one more route,

07:30 which says if the traffic is going to internet,

07:32 then it should go to the NAT gateway.

07:36 And on the NAT gateway side, of course,

07:38 we need to have the default route going to the internet,

07:40 but the return traffic from the internet will go back

07:43 to this Gateway Load Balancer endpoint,

07:47 and that's where we have this aggregated route,

07:48 which takes the traffic back

07:51 to Gateway Load Balancer endpoint,

07:53 and again, it does the traffic inspection

07:54 for the returning traffic,

07:56 and it sends it back to the destination inside the VPC.

08:01 So again, if you want to trace down this traffic,

08:03 then instance A here originates the traffic,

08:07 but now we are sending it to the internet.

08:09 So it'll go here.

08:10 From there, it'll go to the transit gateway,

08:13 to the transit gateway ENI in the traffic inspection VPC.

08:17 Now using this route,

08:20 it'll go to the Gateway Load Balancer endpoint,

08:21 and now the traffic inspection happen.

08:25 So Gateway Load Balancer endpoint sends it

08:26 to the load balancer, to the appliance coming back

08:28 from the appliance,

08:30 goes back to the Gateway Load Balancer endpoint.

08:33 And at this moment, Gateway Load Balancer uses this route

08:37 to send the traffic to the NAT gateway.

08:41 Then NAT gateway uses default route

08:43 to send it to the internet and it goes out to the internet.

08:48 Now, similarly, for the return traffic,

08:50 the traffic will come back from the internet,

08:52 again to the NAT gateway.

08:55 Now we know that NAT gateway keeps the internal table

08:59 with which it knows that from

09:01 where the original request had come.

09:03 So it might have the IP address of instance A here,

09:07 and that's where NAT gateway now

09:10 will use this route table entry that is 10.0.0.0/8

09:14 and send this traffic back

09:16 to the Gateway Load Balancer endpoint.

09:19 And again, Gateway Load Balancer will send this traffic

09:22 for inspection to the load balancer,

09:25 to the appliance, back from the appliance

09:27 and back to the Gateway Load Balancer endpoint.

09:30 Now, at this point,

09:31 Gateway Load Balancer will now see again in the root table,

09:35 and because there is this aggregate route for the VPC CIDRs,

09:39 it'll send this traffic to the transit gateway.

09:43 And again, using this route table,

09:45 the packet will be delivered back to the instance A, right?

09:50 And that's how entire flow happens.

09:52 So I hope that is clear to you.

09:56 So I know that there are a lot

09:57 of route tables in this architecture,

10:00 but if you carefully look at the traffic flow,

10:03 I'm sure you will understand

10:04 why these routes are configured in this fashion.

10:08 And to be honest, if you understand this entire network flow

10:11 and you can come up with similar design, then I think

10:14 that you really understand AWS networking well,

10:18 and you can definitely crack your AWS exam.

10:22 Okay, with that, let me just cover few more things

10:25 around this architecture.

10:27 And more importantly,

10:28 this is all about the Gateway Load Balancer

10:31 because as I said, they are special.

10:33 So in this architecture,

10:35 we used Gateway Load Balancer endpoint,

10:37 which ultimately routes traffic

10:39 to the Gateway Load Balancer,

10:40 and then we don't need to do anything further

10:42 for traffic engineering.

10:44 Gateway Load Balancer encapsulates the traffic

10:47 using GENEVE protocol, and it uses the UDP port 6081

10:54 to send traffic to the network appliances.

10:56 Now, with respect to the Gateway Load Balancer,

10:59 it is important that you maintain the traffic flow.

11:01 That means originating traffic

11:04 and return traffic has to be handled

11:05 by the same network appliance.

11:07 And that's where if you enable the appliance mode

11:11 in transit gateway, you get that stickiness of the session.

11:14 So you typically will use Gateway Load Balancer

11:18 with appliance mode with transit gateway,

11:22 right, so I hope that is clear.

11:23 Now, if you're interested in diving further deep

11:26 into this architecture, then I'll suggest to go

11:29 through this interesting blog on AWS site,

11:33 which walks you through all the steps

11:35 to configure this network architecture.

11:38 So I'll leave it up to you if you wanna explore it further.

11:41 So we will stop here for this lecture,

11:44 and we are going to talk about more such architecture

11:46 in the following lecture.

11:48 Thanks for watching and stay tuned.