Lecture 98: Introduction to AWS Site-to-Site VPN
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：12:08
- 来源：Udemy Lecture 26077306
- Slide 数量：6
- 画面切换：02:11、03:19、04:02、06:34、09:04
扫描说明
逐条检查了 Udemy 页面中的 166 条 Transcript cue，并对全长约 12:08 的视频画面逐段扫描。依据 AWS Connectivity Options、AWS Private Connectivity Options、AWS VPN connectivity options、How Site-to-Site VPN works in AWS，以及两页 AWS Site-to-Site VPN Fundamentals，共划分出 6 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. AWS 连接选项总览
时间范围：00:00–02:11
总结 / Summary
中文
访问亚马逊云服务（Amazon Web Services, AWS）资源既可以经过公共互联网（Public Internet），也可以采用私有连接（private connectivity）。主要私有连接选项包括站点到站点 VPN（AWS Site-to-Site VPN）、客户端 VPN（AWS Client VPN）和 AWS Direct Connect。选择方案时需要区分连接对象、加密要求、带宽与稳定性，以及是否依赖互联网传输。
English
AWS resources can be reached over the public internet or through private connectivity. The principal private options are AWS Site-to-Site VPN, AWS Client VPN, and AWS Direct Connect. The right choice depends on who or what is connecting, encryption requirements, bandwidth and consistency needs, and whether the transport may traverse the public internet.
Transcript
00:00 Hello and welcome to this new section, AWS Site to Site VPN.
00:05 Now, if you ask me to pick three topics for AWS Certified Advanced Networking Exam, then I'll pick
00:13 AWS Direct Connect, AWS Transit Gateway, and then AWS Site to Site VPN.
00:19 So please make sure that you understand AWS Site to Site VPN really well and you can design the architecture.
00:25 You can answer the questions related to different scenarios which we will be covering in this section.
00:32 Okay.
00:32 So let's get started with this section.
00:35 And in this section let's understand the fundamentals of AWS site to site VPN as in what it offers,
00:41 why to use that.
00:43 And then going forward we will do some exercises as well.
00:46 And we'll understand more about AWS site to site VPN.
00:50 Right.
00:51 Okay.
00:51 So let's get started.
00:53 Now we already talked about this maybe in bits and pieces, but let me put things together right.
00:59 So if you want to access any AWS resources, for example, your EC2 instances or your databases, then
01:07 of course you just connect to AWS console, or you get a public IP of that AWS resource and connect
01:13 it over the internet.
01:15 So that's the, you know, very common way to access AWS over the internet.
01:22 Now, while this works, not many companies would want to do that always, right?
01:27 Because maybe they don't want to expose their AWS resources to the outside world.
01:32 So rather they want to access those AWS resources privately, right?
01:38 Now, when it comes to accessing the AWS resources privately and securely, then there are different
01:44 ways to access AWS resources.
01:47 So primarily there are these three ways in which you can access AWS resources, like your databases
01:56 or the EC2 instances which are inside your VPC and which doesn't have the public IPS.
02:01 is now.
02:02 If you want to access those, you can use either AWS Site to Site VPN or AWS client VPN or AWS Direct
02:09 Connect.
02:10 Right.
2. 私有连接：VPN 与 Direct Connect
时间范围：02:11–03:19
总结 / Summary
中文
站点到站点 VPN（AWS Site-to-Site VPN）和客户端 VPN（AWS Client VPN）通过互联网承载流量，但使用加密隧道（encrypted tunnel）保护通信；AWS Direct Connect 则提供从客户网络到 AWS 的专用物理连接（dedicated physical connection），不经过公共互联网。VPN 通常部署更快、成本较低，而 Direct Connect 更适合需要稳定带宽和可预测网络性能的场景。
English
AWS Site-to-Site VPN and AWS Client VPN carry traffic over the internet but protect it with encrypted tunnels. AWS Direct Connect provides a dedicated physical path from the customer network to AWS without using the public internet. VPN is generally faster and less expensive to deploy, whereas Direct Connect better suits workloads that need consistent bandwidth and predictable network performance.
Transcript
02:11 So this connectivity is more secure and it is private.
02:16 And in this particular section we will be primarily focusing on AWS site to site VPN.
02:23 Okay.
02:24 Now further, if you divide this secure and private connectivity again you can divide that into two
02:30 different categories.
02:31 So AWS Site to Site VPN and AWS client VPN.
02:35 Traffic still goes over the internet and there is one star mark there.
02:40 And I will talk about that a little later.
02:42 But this traffic goes over the internet.
02:45 But it is secure and it is encrypted.
02:48 And that's where it is called private connectivity.
02:50 However, if you want a dedicated connection to AWS, then of course you can use AWS Direct Connect.
02:58 And we have the following section where we dive deep into AWS Direct Connect.
03:04 So in this lecture, let's focus on the connectivity over the internet.
03:09 And out of that we will focus on AWS site to site VPN.
03:14 Now what is the difference between site to site VPN and client VPN.
03:17 So it is as simple as this.
3. Site-to-Site VPN 与 Client VPN 的适用对象
时间范围：03:19–04:02
总结 / Summary
中文
站点到站点 VPN（AWS Site-to-Site VPN）用于把企业数据中心（corporate data center）或分支网络整体连接到一个或多个虚拟私有云（Virtual Private Cloud, VPC）。客户端 VPN（AWS Client VPN）面向单个远程用户或终端设备，让用户通过客户端软件安全访问 AWS 或本地资源。前者是网络到网络（network-to-network），后者是用户到网络（user-to-network）。
English
AWS Site-to-Site VPN connects an entire corporate data center or branch network to one or more VPCs. AWS Client VPN serves individual remote users or endpoint devices through client software, providing secure access to AWS or on-premises resources. The former is network-to-network connectivity, while the latter is user-to-network connectivity.
Transcript
03:19 If you have your corporate data center and if you want to connect that privately to the AWS VPCs, then
03:26 it will be AWS Site to Site VPN.
03:29 However, if you are working from home and if you want to privately access some VPC resources, then
03:36 you will have the client VPN.
03:38 So your machine becomes part of this network so that you can access these resources privately.
03:46 That means using the private IPS without those resources required to have the public IPS.
03:51 So that's the basic difference, right?
03:54 So I hope it is clear.
03:55 And with that now let's understand how AWS site to site VPN works okay.
4. AWS Site-to-Site VPN 的组成与双隧道
时间范围：04:02–06:34
总结 / Summary
中文
AWS 站点到站点 VPN（AWS Site-to-Site VPN）在 AWS 网络与客户企业网络之间建立连接。AWS 端可以终止在虚拟私有网关（Virtual Private Gateway, VGW）或中转网关（AWS Transit Gateway, TGW），客户侧由客户网关（Customer Gateway, CGW）代表本地 VPN 设备。每个 VPN 连接默认提供两条互联网协议安全隧道（Internet Protocol Security, IPsec tunnels），用于提高高可用性（High Availability, HA）；客户设备应同时配置两条隧道。
English
AWS Site-to-Site VPN establishes connectivity between the AWS network and a customer corporate network. On the AWS side, the VPN terminates on either a Virtual Private Gateway or an AWS Transit Gateway, while a Customer Gateway represents the on-premises VPN device. Every VPN connection supplies two IPsec tunnels for high availability, and the customer device should be configured to use both.
Transcript
04:02 So as you can see here on the left side you have AWS regions.
04:06 And inside that you will have your VPCs.
04:09 And inside VPCs you will have your EC2 instances, your databases, everything right.
04:15 And on the right side you have your corporate data center.
04:18 Now what we are saying that AWS Site to Site VPN allows the private connectivity between these two networks,
04:25 right?
04:26 So VPN connection is established between AWS network and the customer corporate network.
04:33 Now how do you set up this VPN.
04:36 Now for that there are two ways.
04:38 First, you can have a virtual private gateway, which is also called as VPN gateway, which is attached
04:45 to your VPC.
04:47 And on the customer side.
04:49 Also, you need a router and VPN endpoint.
04:53 So once you have that, you can create a secure VPN connection between these two endpoints, right.
05:01 So that's the one way to set up a VPN where you have the VPN gateway, which is attached to your VPC,
05:07 but you can also use AWS Transit Gateway to terminate your VPN connection on AWS side.
05:15 So in that case, the architecture will be something like this.
05:18 Where in AWS region you will have transit Gateway, and then multiple VPCs might be connected to this
05:25 transit gateway.
05:26 And then you create a VPN connection which terminates on this transit gateway.
05:33 Right.
05:33 So I hope it is clear now, further, with respect to the high availability of the network traffic,
05:40 the VPN connection is actually made up of two VPN tunnels and the two tunnels, of course, for high
05:47 availability.
05:48 So if you just double click into the VPN connection, you will see that there are two different tunnels
05:54 and you can configure these tunnels into different mode, for example active active or active passive.
06:00 And we are going to talk about that later in this section, but just understand that these two tunnels
06:07 are for high availability.
06:09 So if one tunnel goes down, your traffic can still go through another tunnel, right?
06:15 So just to recap, there is a VPN connection which you can terminate on AWS side either on a virtual
06:20 private gateway or VPN gateway.
06:23 And other way to connect to AWS is using the Transit gateway, right?
06:28 So I hope it is clear.
06:29 With that, let's just cover the basic fundamentals of VPN.
5. Site-to-Site VPN 的协议基础
时间范围：06:34–09:04
总结 / Summary
中文
虚拟专用网络（Virtual Private Network, VPN）让不同私有网络中的主机通过加密连接通信，并主要工作在开放式系统互连模型第三层（OSI Layer 3）。VPN 可分为站点到站点（site-to-site）和客户端到站点（client-to-site）两种形式。AWS 托管的站点到站点 VPN 使用互联网协议安全（Internet Protocol Security, IPsec）；通用路由封装（Generic Routing Encapsulation, GRE）与动态多点 VPN（Dynamic Multipoint VPN, DMVPN）不是该托管服务支持的隧道类型。
English
A Virtual Private Network enables hosts in separate private networks to communicate through an encrypted connection and primarily operates at OSI Layer 3. VPNs are commonly categorized as site-to-site or client-to-site. AWS managed Site-to-Site VPN uses IPsec; GRE and DMVPN are not supported tunnel types for this managed service.
Transcript
06:34 And then we will do some labs around that so that you actually see what we are discussing in this lecture.
06:41 Right.
06:42 So as we said VPN allows host to communicate privately.
06:46 When we say host that means host which are there on premises and the host or EC2 instances or databases
06:53 which are there on the AWS side.
06:55 So they can communicate privately over the untrusted intermediary network, which is nothing but internet.
07:03 But this traffic is in encrypted format.
07:06 That means even if there is a man in the middle attack, nobody can understand what that traffic is,
07:12 right?
07:12 So you are safe.
07:14 Further, when we say site to site VPN, it is layer three VPN.
07:19 So if you look at the OSI model of networking, there is a logic link layer that is layer two.
07:25 And then there is IP layer that is layer three.
07:28 So this VPN works at IP layer.
07:31 Further, as we said, VPN has two forms site to site VPN and the client VPN.
07:38 So of course site to site VPN connects two different networks and client to site VPN connects client
07:43 devices like laptops to the private network like AWS VPC.
07:49 Further, there are also VPN types and AWS supports IPsec VPN as of now.
07:55 So IPsec is IP security.
07:58 And this is what we are talking here.
08:00 But other than IPsec VPN there are also other types of VPN.
08:04 For example, gray that is generic routing encapsulation, and typically it supports multicast or broadcast.
08:12 However, if you talk about the IPsec VPN, it supports only unicast.
08:16 That means it connects just two networks and it can only transport the IP packets.
08:22 However, gray VPN can also transport non IP packets as well.
08:27 Further, there is dmvpn that is dynamic multipoint VPN which is like hub and spoke model of the VPN
08:35 where even the spoke branches can communicate over the VPN connection.
08:40 Now again, these are not supported by AWS managed VPN.
08:44 And if you really want to do that, then you would have to use your own VPN solution.
08:50 So for example, you can deploy those VPN solution on EC2 instances.
08:55 Then you can have probably GRE or Dmvpn, but AWS managed site to site VPN is IPsec VPN, right?
6. VGW、路由、ASN 与隧道认证
时间范围：09:04–12:08
总结 / Summary
中文
虚拟私有网关（Virtual Private Gateway, VGW）是虚拟私有云（Virtual Private Cloud, VPC）的 AWS 托管 VPN 端点，一个 VPC 同一时间只能挂载一个 VGW。连接支持静态路由（Static Routing）或通过边界网关协议（Border Gateway Protocol, BGP）进行动态路由（Dynamic Routing）。VGW 可使用私有自治系统编号（private Autonomous System Number, ASN）；未指定时 AWS 默认分配 64512。VPN 隧道端点可以使用预共享密钥（pre-shared key, PSK）或私有证书颁发机构证书（Private Certificate Authority certificate）进行认证。
English
A Virtual Private Gateway is the AWS-managed VPN endpoint for a VPC, and only one VGW can be attached to a VPC at a time. The connection supports static routing or dynamic routing with BGP. A VGW can use a private Autonomous System Number, with AWS assigning 64512 by default when none is specified. Tunnel endpoints can authenticate with pre-shared keys or certificates issued by a private certificate authority.
Transcript
09:04 Further, a few more things to understand about AWS site to site VPN is that, as we said, it can be
09:10 terminated on the virtual Private gateway and this gateway is attached to your VPC.
09:17 So you can only attach single virtual private gateway to a VPC.
09:22 Then AWS site to site VPN supports both static and dynamic routing.
09:27 And we are further going to see this in the following lectures.
09:30 But in the earlier section we already talked about what is static routing, what is dynamic routing,
09:36 what is BGP and how the routes are exchanged.
09:40 So AWS VPN supports both the static routing and the dynamic routing.
09:46 Further, when you configure your VPN in the BGP mode, that is dynamic routing, you have to provide
09:53 the autonomous system number that is ASN for your virtual private gateway.
09:58 So you can provide either two byte ASN or the four byte ASN.
10:03 But if you don't provide anything, then AWS will use a default ASN of number 64512.
10:11 Now, sometimes in your exam you might have this kind of question around what is the default ASN that
10:18 AWS assigns to Virtual Private gateway?
10:21 So that number is 64512.
10:24 So just remember that.
10:27 Now just one more thing which is worth mentioning is that when you create the VPN connection and actually
10:32 we will do an exercise to set that up.
10:35 During that.
10:36 There are two tunnels, as we said.
10:37 Right.
10:38 And in order to set up that connection on both the sides, you need some kind of authentication for
10:45 those tunnels.
10:46 So for tunnel authentication, AWS supports two mechanism, the Pre-shared keys, which we will actually
10:54 use during our exercise or otherwise.
10:57 It can also use private CA certificate which are issued by AWS private CA authority.
11:05 So both these methods are available.
11:07 And as I said during our exercise we will see how Pre-shared keys are used.
11:13 Right.
11:14 Okay.
11:15 So I think this knowledge is sufficient to do an exercise where we'll set up actual VPN connection.
11:21 But before that, I think one important thing to know is that how does AWS VPN support the IPv4 and
11:28 IPv6 traffic?
11:30 Because that really depends on which IP addresses you are using on both sides of the VPN connection.
11:37 So for example, on Virtual Private Gateway, which IP you are using, and on the customer gateway side
11:42 which IP you are using.
11:44 So let's quickly discuss that in the next lecture.
11:46 And then we will get into the exercise.
11:50 Okay.
11:50 So with that I hope you now understand the basics of AWS site to site VPN, how it works and basic components
11:57 of that.
11:58 And now let's understand more about IPv4 and IPv6 traffic.
12:02 So that's it about this lecture.
12:04 And now let's go to the next lecture.
12:06 Thank you.
整讲总结 / Overall Summary
中文
AWS 站点到站点 VPN（AWS Site-to-Site VPN）通过互联网协议安全（IPsec）把本地网络连接到 AWS。AWS 侧端点可以是虚拟私有网关（VGW）或中转网关（TGW），客户侧由客户网关（CGW）表示；每个连接包含两条隧道以实现高可用性（HA）。服务支持静态路由或基于边界网关协议（BGP）的动态路由，并可用预共享密钥（PSK）或私有 CA 证书认证。它与面向个人用户的客户端 VPN（Client VPN）以及不经过公共互联网的 AWS Direct Connect 解决不同的连接需求。
English
AWS Site-to-Site VPN connects an on-premises network to AWS with IPsec. The AWS endpoint can be a Virtual Private Gateway or Transit Gateway, while the customer side is represented by a Customer Gateway; each connection includes two tunnels for high availability. The service supports static or BGP dynamic routing and tunnel authentication through pre-shared keys or private CA certificates. It addresses different needs from user-oriented Client VPN and from AWS Direct Connect, whose dedicated path does not traverse the public internet.
返回顶部 ↑