Lecture 90: TGW Architecture: Centralized traffic inspection with Network Function attachmnt
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：02:23
- 来源：Udemy Lecture 56330011
- Slide 数量：3
- 画面切换：01:02、01:12
扫描说明
逐条检查了 Udemy 页面中的 29 条 Transcript cue，并对全长约 2:23 的视频画面逐段扫描。依据原 AWS Network Firewall 检查 VPC 架构、移除检查 VPC 组件的过渡画面，以及 Network Function Attachment 简化架构三个独立 Slide/画面阶段，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 原有 AWS Network Firewall Inspection VPC 架构
时间范围：00:00–01:02
总结 / Summary
中文
传统 AWS Network Firewall（ANFW）集中检查仍需一个专用检查 VPC（inspection VPC），在多个可用区（Availability Zone, AZ）中部署网络防火墙端点（Network Firewall Endpoint）和中转网关弹性网络接口（Transit Gateway Elastic Network Interface, TGW ENI），并维护 TGW ENI 子网路由表、端点子网路由表及检查 VPC 附件路由。虽然防火墙本身是托管服务，但外围网络结构仍较复杂。
English
The traditional AWS Network Firewall centralized-inspection design still requires a dedicated inspection VPC, Network Firewall endpoints and TGW ENIs in multiple Availability Zones, and route tables for the TGW-ENI subnets, endpoint subnets, and inspection-VPC attachment. The firewall is managed, but the surrounding network structure remains complex.
Transcript
00:00 Alright, so hopefully this is the last architecture for centralized traffic inspection that you should know.
00:08 And in this architecture, we are going to further simplify the architecture, which you just saw.
00:13 And this is possible because if you remember, towards the start of the session, when we
00:18 talked about the transit gateway attachment, I said that there is now a new attachment
00:23 type that is a network function attachment that transit gateway can have.
00:28 And exactly, it does the same thing, instead of now managing the AWS network firewall endpoints,
00:34 you can directly connect it to the transit gateway.
00:38 So which means now AWS network firewall natively integrates with the transit gateway.
00:45 So now, if you use this attachment, then this architecture further gets simplified.
00:52 And if you see everything that you see on the right side, that is the inspection VPC,
00:57 then the network firewall endpoints provisioned across multiple AZs, then all these root tables,
2. 移除 Inspection VPC 与 Endpoint Route Tables
时间范围：01:02–01:12
总结 / Summary
中文
网络功能附件（Network Function Attachment）把 AWS Network Firewall 原生连接到中转网关（Transit Gateway, TGW），因此检查 VPC、跨 AZ 的防火墙端点、TGW ENI 子网以及相关 VPC 路由表都可从架构中移除。应用 VPC 与 TGW 的基本路由保持不变，检查服务则成为 TGW 直接可选的附件下一跳。
English
A Network Function Attachment connects AWS Network Firewall natively to the Transit Gateway. The inspection VPC, per-AZ firewall endpoints, TGW-ENI subnets, and their VPC route tables can therefore be removed. The application-VPC routing remains, while the inspection service becomes a direct TGW attachment next hop.
Transcript
01:02 you don't need anything there.
01:02 So everything is gone.
01:07 And instead, you need to simply create the network firewall and create an attachment
01:12 to the transit gateway.
3. Network Function Attachment 的简化流量路径
时间范围：01:12–02:23
总结 / Summary
中文
在简化架构中，只需创建 AWS Network Firewall，并为 TGW 创建网络功能附件（Network Function Attachment）。东西向流量（east-west traffic）从实例 A 进入 TGW 后，TGW 路由表把它经 Network Function Attachment 送到 ANFW；检查完成的返回包再回到 TGW，并按目标 VPC 附件路由送到实例 B。相比 GWLB 加第三方防火墙、或 ANFW Endpoint 加 Inspection VPC 的方案，这种模式减少了 VPC、子网、端点和路由表的管理，但考试中三种架构都可能出现，需要能够区分。
English
In the simplified design, create AWS Network Firewall and attach it to the TGW through a Network Function Attachment. East-west traffic from instance A reaches the TGW, is routed through the attachment to ANFW, returns to the TGW after inspection, and is delivered through the destination-VPC attachment to instance B. Compared with either GWLB plus third-party firewalls or ANFW endpoints in an inspection VPC, this approach removes much of the VPC, subnet, endpoint, and route-table management. All three architectures may still appear on the exam and should be distinguished.
Transcript
01:15 And that is network function attachment.
01:18 So if you see this architecture is much more simplified, and the flow of the traffic will
01:23 remain exactly same, where the east west traffic will go to the transit gateway.
01:29 And from there, it will go to the AWS network firewall through this network function attachment.
01:29 Right, so this is how it works.
01:39 Now before we stop, just one thing to remember is that this is still relatively a new feature
01:44 in the transit gateway and for the AWS network firewall.
01:47 So in your exam, it is possible that you might get scenarios across all three architectures
01:53 that we talked about, that is using the third party network firewalls using the gateway
01:57 load balancer, then otherwise using the network firewall endpoints in the inspection VPC.
02:04 And further, with the latest update, you don't even need to have the inspection VPC, rather
02:09 you can directly create this network function attachment.
02:12 Right, so I hope all these three architectures that we talked about is clear to you.
02:17 And with that, now let's look at some other transit gateway architectures.
整讲总结 / Overall Summary
中文
网络功能附件（Network Function Attachment）让 AWS Network Firewall（ANFW）直接成为中转网关（Transit Gateway, TGW）的原生附件，从而消除传统集中检查中的检查 VPC（inspection VPC）、多可用区防火墙端点（Network Firewall Endpoint）以及相关子网和路由表。应用 VPC 的流量仍先进入 TGW，但 TGW 可直接把流量送到 ANFW 检查，再把返回流量转发到目标 VPC。它是三种常见集中检查模式中最简化的一种；另外两种是 Gateway Load Balancer（GWLB）加第三方设备，以及 ANFW Endpoint 加 Inspection VPC。
English
A Network Function Attachment makes AWS Network Firewall a native Transit Gateway attachment, eliminating the traditional inspection VPC, per-AZ firewall endpoints, and their subnets and route tables. Application-VPC traffic still reaches the TGW first, but the TGW can send it directly to ANFW for inspection and then forward the returned packet to the destination VPC. It is the simplest of the three common centralized-inspection patterns, alongside GWLB with third-party appliances and ANFW endpoints in an inspection VPC.
返回顶部 ↑