Lecture 89: TGW Architecture: Centralized traffic inspection with AWS Network Firewall
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：03:41
- 来源：Udemy Lecture 56330005
- Slide 数量：2
- 画面切换：01:24
扫描说明
逐条检查了 Udemy 页面中的 44 条 Transcript cue，并对全长约 3:41 的视频画面逐段扫描。依据 AWS Network Firewall 集中检查标题页和完整架构/流量图两张独立 Slide，共划分出 2 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 用 AWS Network Firewall 替代第三方 Firewall
时间范围：00:00–01:24
总结 / Summary
中文
上一讲使用 Gateway Load Balancer（GWLB）和部署在 EC2 上的第三方防火墙（third-party firewall）完成集中检查；AWS Network Firewall（ANFW）则提供 AWS 原生、完全托管的网络防火墙服务（fully managed network firewall service），支持深度包检测（Deep Packet Inspection, DPI）、入侵防御系统（Intrusion Prevention System, IPS）和入侵检测系统（Intrusion Detection System, IDS）。采用 ANFW 后无需自行部署、扩缩或维护防火墙实例和 GWLB。
English
The previous architecture used a Gateway Load Balancer with third-party firewalls running on EC2. AWS Network Firewall is an AWS-native, fully managed firewall service that provides deep packet inspection, intrusion prevention, and intrusion detection. Using ANFW removes the need to deploy, scale, and maintain firewall instances and a GWLB.
Transcript
00:00 Alright, so in the last lecture, we saw the architecture where you can use your own third
00:06 party firewalls and you can host them behind the gateway load balancer and then host everything
00:12 into the inspection VPC and then route the east-west traffic through this gateway load
00:17 balancer and the third party firewalls.
00:19 However, in AWS, there is a native service for firewall and that is AWS Network Firewall.
00:27 And we are going to talk about AWS Network Firewall in the later section.
00:31 But essentially, it is like fully managed network firewall for you, which can do the
00:36 same thing that typically any third party firewall will do.
00:40 So AWS Network Firewall allows you to do deep packet inspection, IPS, IDS, everything.
00:48 So if you see, instead of deploying your own network firewalls on to the EC2 instances
00:54 and then using the gateway load balancer, it is much easier to use AWS Network Firewall.
01:00 So now, in this lecture, let's talk about how can you design the similar architecture
01:05 for the centralized traffic inspection, but using the AWS Network Firewall.
01:11 So architecture wise, it will be quite similar to the gateway load balancer one.
01:15 But as you can see here, now we don't have the gateway load balancer endpoints.
01:20 And we don't have those third party firewall EC2 instances as well.
01:24 Instead, we simply have the network firewall endpoints that you will provision inside this inspection VPC.
2. Inspection VPC 中的 Network Firewall Endpoint 路由
时间范围：01:24–03:41
总结 / Summary
中文
整体中转网关（Transit Gateway, TGW）拓扑与 GWLB 方案相似：应用 VPC 子网把默认路由送到 TGW，辐条附件（spoke attachment）的 TGW 路由表把流量指向检查 VPC 附件（inspection VPC attachment），检查附件的 TGW 路由表传播目标 VPC CIDR。主要变化发生在检查 VPC：TGW ENI 子网的默认路由直接指向网络防火墙端点（Network Firewall Endpoint），端点完成托管检查；端点子网再用 10.0.0.0/8 聚合路由把已检查流量送回 TGW。实例 A 到实例 B 的东西向流量（east-west traffic）因此依次经过 TGW、检查 VPC 的 TGW ENI、Network Firewall Endpoint，再返回 TGW 到目标 VPC。检查 VPC 仍然存在，相关子网、路由表与 TGW 组件仍需管理。
English
The overall Transit Gateway topology remains similar to the GWLB design. Application subnets send default traffic to the TGW; the spoke-attachment TGW route table forwards it to the inspection-VPC attachment; and the inspection attachment route table propagates the destination VPC CIDRs. The main change is inside the inspection VPC: the TGW-ENI subnet sends default traffic directly to an AWS Network Firewall endpoint, which performs managed inspection, and the endpoint subnet uses an aggregate 10.0.0.0/8 route to return inspected traffic to the TGW. East-west traffic from instance A to instance B therefore traverses the TGW, inspection-VPC TGW ENI, Network Firewall endpoint, and the TGW again before reaching the destination. The inspection VPC and its subnets, route tables, and TGW components still have to be managed.
Transcript
01:33 And that's it really, rest of all the heavy lifting of actually hosting the network firewall,
01:39 scaling it, everything will be taken care by AWS.
01:43 And if you see the architecture now is exactly similar to the previous one.
01:47 So the route table for the VPCs will be exactly like same.
01:51 And the route table for this attachment for the spoke VPCs will be exactly like earlier.
01:57 And same with the attachment for the traffic inspection VPC.
02:02 And now because we don't have the gateway load balancer, and instead we have the network
02:06 firewall endpoint, the only change will be there in this transit gateway ENI route table,
02:12 where we are sending all the traffic to this network firewall endpoint.
02:16 And further for the network firewall endpoint subnet, it is again same as a previous route
02:22 table, all the return traffic will go to the transit gateway.
02:27 So in this case, if instance A wants to talk to instance B, that is East West traffic,
02:32 then of course, the traffic will go to the transit gateway ENI from there it will go
02:36 to the transit gateway.
02:37 And now from there, it will go to the transit gateway ENI in the inspection VPC.
02:42 And now it will be forwarded to this network firewall endpoints.
02:42 Now, as I said, this network firewall endpoint is internally connected to actual AWS network
02:51 firewall, which is completely managed by AWS.
02:54 So it will do the traffic inspection, and it will return the traffic and the return
02:59 traffic will again go through the transit gateway to the target VPC through this VPC attachment.
03:07 Right, so this is how this architecture will look like if you use network firewall instead
03:14 of using the gateway load balancer.
03:16 So this is another architecture that you can see.
03:19 And here important to note is that you still need this inspection VPC and still you need
03:25 to manage all these components.
03:27 And this hints toward a better architecture that we are going to discuss in the next lecture.
03:32 So, with that, now let's look at the next architecture for the centralized traffic inspection.
整讲总结 / Overall Summary
中文
AWS Network Firewall（ANFW）把第三方防火墙（third-party firewall）与 Gateway Load Balancer（GWLB）的部署、扩缩和维护替换成托管服务。集中检查架构仍以中转网关（Transit Gateway, TGW）和检查 VPC（inspection VPC）为中心：辐条附件默认路由到检查附件，TGW ENI 子网默认路由到 Network Firewall Endpoint，端点子网用内部 CIDR 聚合路由返回 TGW，从而让跨 VPC 的东西向流量（east-west traffic）双向经过防火墙。ANFW 简化了防火墙层，但不消除检查 VPC、TGW 附件和路由表的运维。
English
AWS Network Firewall replaces the deployment, scaling, and maintenance of third-party firewalls and a GWLB with a managed service. The centralized design still revolves around a Transit Gateway and an inspection VPC: spoke attachments default to the inspection attachment, the TGW-ENI subnet defaults to the Network Firewall endpoint, and the endpoint subnet returns internal CIDRs to the TGW. Inter-VPC east-west traffic is therefore inspected in both directions. ANFW simplifies the firewall layer but does not eliminate the inspection VPC, TGW attachments, or route-table operations.
返回顶部 ↑