Lecture 99: IPv4 and IPv6 traffic over AWS Site-to-Site VPN
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：08:09
- 来源：Udemy Lecture 51779035
- Slide 数量：3
- 画面切换：00:21、05:21
扫描说明
逐条检查了 Udemy 页面中的 102 条 Transcript cue，并以每条 cue 对应的画面为时间轴逐段扫描全长约 8:09 的视频。依据 IPv4 and IPv6 support、VPN outside and inside IP addresses、IPv4 and IPv6 traffic 三张独立 Slide，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Site-to-Site VPN 的 IPv4 与 IPv6 支持概览
时间范围：00:00–00:21
总结 / Summary
中文
本课说明 AWS 站点到站点 VPN（AWS Site-to-Site VPN）如何组合使用互联网协议第四版（Internet Protocol version 4, IPv4）与互联网协议第六版（Internet Protocol version 6, IPv6）。理解外部隧道地址（outside tunnel address）和内部隧道地址（inside tunnel address）的区别，是判断 VPN 实际承载哪种协议流量的基础。
English
This lecture explains how AWS Site-to-Site VPN combines IPv4 and IPv6 addressing. The key prerequisite is understanding the distinction between outside tunnel addresses, which establish the tunnel, and inside tunnel addresses, which carry routed packets.
Transcript
00:00 Okay, so in this short lecture, let's quickly cover how AWS Site to site VPN support the IPv4 and
00:07 IPv6 traffic.
00:09 And we are talking about this because in your exam there might be questions around this.
00:14 And also while doing the exercise you will see some of the terms that we cover in this lecture.
00:21 Okay.
2. Outside IP 与 Inside IP 的职责
时间范围：00:21–05:21
总结 / Summary
中文
每条互联网协议安全隧道（Internet Protocol Security tunnel, IPsec tunnel）都有外部 IP 地址（outside IP address）和内部 IP 地址（inside IP address）。外部地址是 AWS 隧道端点与客户网关（Customer Gateway, CGW）可通过互联网互相到达的公网地址，用于建立 IPsec 连接；内部地址用于隧道内实际数据包的路由。IPv4 内部地址通常从链路本地范围（link-local range）169.254.0.0/16 中分配，并为每条隧道使用 /30 网段。每个 VPN 连接有两条高可用隧道，因此两条隧道分别拥有各自的 outside/inside 地址。
English
Each IPsec tunnel has outside and inside IP addresses. Outside addresses are internet-reachable public addresses on the AWS tunnel endpoint and the Customer Gateway, and they establish the IPsec connection. Inside addresses route the actual packets carried through the tunnel. IPv4 inside addresses are typically allocated from the 169.254.0.0/16 link-local range using a /30 subnet per tunnel. Because a VPN connection has two highly available tunnels, each tunnel receives its own outside and inside address pair.
Transcript
00:21 So this is how typically the VPN works.
00:25 As we said right on the left side you have either virtual private gateway or a transit gateway.
00:30 And on the right side you have the customer gateway.
00:33 And then there is a VPN connection between those two gateways.
00:37 Now when you actually set up the VPN connection, you have to configure your VPN tunnels.
00:44 And as we said, there are two tunnels for high availability.
00:48 So there is tunnel endpoint one and there is tunnel endpoint two.
00:53 And then you have to connect this customer gateway to this both the tunnels.
00:58 Now in order to connect to this tunnel endpoints of course, you need to have the IP addresses assigned
01:05 to this tunnel endpoints, and AWS will assign those IP addresses.
01:11 And this will be public IP addresses because otherwise from customer gateway you cannot connect to AWS,
01:17 right?
01:18 So there should be some public connectivity for this tunnel endpoints.
01:23 And then once the VPN is established then you can send traffic through those tunnels privately.
01:30 This is how it actually works.
01:32 So when you create this tunnel connection for that, as I said, you need public IPS and it is also
01:40 called as outside IPS.
01:42 So you will hear this term outside IPS inside IPS during the exercise.
01:47 So here we are talking about this public IPS which are the outside IPS.
01:52 So every tunnel will have its own IP.
01:56 And of course customer gateway also will have its own public IP which is the outside IP on the customer
02:02 gateway side.
02:03 So with these two outside IPS you can create the IPsec VPN tunnel, right?
02:10 So that's about the first tunnel.
02:12 Similarly there will be another tunnel another outside IP.
02:15 And then you create another VPN tunnel.
02:19 So here just remember that there are these outside IPS which are public IPS on both the side.
02:26 So basically when you create the virtual private gateways then AWS will automatically create these two
02:33 IPS and it will provide you as a part of VPN configuration.
02:38 Okay.
02:39 So that's about the outside IPS which is used to create this tunnel connection.
02:45 However, in order to actually send the IP packets, these outside IPS are not used.
02:52 These outside IPS are only used for the connection.
02:55 That means at IP layer the routing happens.
02:58 So for example from the corporate data center, if you have to route traffic then this IP address will
03:04 be used.
03:05 But in order to actually send the traffic through this tunnel, there will be inside IPS on both sides
03:12 of the tunnel.
03:13 And this inside IPS are allocated from the private IP address.
03:17 Range 169.254.0.0 16.
03:22 So if you talk about this first tunnel, then there will be a private inside IP, Cidr range on AWS
03:29 site and on the customer gateway side.
03:32 And this range has to be with slash 30 prefix.
03:35 So it can be 169.254.0.1 30.
03:40 And this is just for an example.
03:42 Similarly there will be similar IP range on the customer gateway side.
03:46 And same for another tunnel as well.
03:49 So once you have this inside IP addresses configured then actual IP packets will flow using this inside
03:58 tunnel IP addresses.
04:00 So the bottom line is in order to create the VPN tunnels, you need this outside IP addresses and for
04:09 actually sending the traffic, you need this inside IP addresses.
04:14 And that's where it really depends which type of IP addresses it is.
04:19 Whether we are talking about IPv4 addresses for the outside IP or inside IPS, or we are talking about
04:26 IPv6 addresses for outside IP or the inside IPS, because that decides whether this VPN tunnel will
04:34 support IPv4 or IPv6 traffic.
04:39 So overall you can see there could be four combinations.
04:42 For example, all IPS are IPv4 addresses.
04:46 Something like what you see on the screen or all IPS can be all IPv6 addresses, right?
04:53 Or outer IPS could be IPv4 and inner IPS could be IPv6 or outer IPS could be IPv6, and inner IPS could
05:02 be IPv4.
05:04 Now all these combinations are possible when you create the VPN tunnels and depending on that, IPv4
05:13 or IPv6 traffic is supported through these tunnels.
05:17 So let's quickly look at those four options and their implications.
3. 四种 Outer/Inner IP 组合与限制
时间范围：05:21–08:09
总结 / Summary
中文
外部与内部地址存在四种组合。IPv4 外部 + IPv4 内部是默认配置，虚拟私有网关（Virtual Private Gateway, VGW）、中转网关（Transit Gateway, TGW）和 AWS Cloud WAN 均支持；IPv4 外部 + IPv6 内部可在 IPv4 隧道中传输 IPv6 流量，但只支持 TGW 与 Cloud WAN；IPv6 外部 + IPv6 内部提供完整 IPv6 传输，同样只支持 TGW 与 Cloud WAN；IPv6 外部 + IPv4 内部允许使用 IPv6 隧道寻址承载传统 IPv4 应用，也只支持 TGW 与 Cloud WAN。单个站点到站点 VPN 连接（Site-to-Site VPN connection）不能同时承载 IPv4 和 IPv6；若两种流量都需要，必须创建两个独立 VPN 连接。
English
There are four outer/inner address combinations. IPv4 outer plus IPv4 inner is the default and is supported by VGW, Transit Gateway, and Cloud WAN. IPv4 outer plus IPv6 inner carries IPv6 traffic through an IPv4 tunnel, while IPv6 outer plus IPv6 inner provides end-to-end IPv6 transport; both require Transit Gateway or Cloud WAN. IPv6 outer plus IPv4 inner uses IPv6 tunnel addressing while carrying legacy IPv4 applications and also requires Transit Gateway or Cloud WAN. One Site-to-Site VPN connection cannot carry IPv4 and IPv6 simultaneously, so both protocols require separate VPN connections.
Transcript
05:21 So if there is IPv4 outer IP addresses which are also called as tunnel addresses and IPv4 for inner
05:29 packet transmission, then it's a default configuration of AWS site to site VPN.
05:36 And it is supported on virtual private gateways and Transit gateway.
05:41 And for AWS cloud Wan.
05:43 Now we have covered AWS cloud Wan in the separate section.
05:46 So just hold on until we reach there.
05:49 But the point here is that this is a default VPN configuration and it supports IPv4 traffic of course.
05:56 Now if you have IPv4 addresses for outer tunnel and IPv6 for the inner packets, then it allows IPv6
06:04 traffic within the IPv4 VPN tunnels.
06:08 Right.
06:08 Which means actual traffic will be IPv6.
06:12 And this configuration is only supported on the Transit Gateway and AWS cloud Wan.
06:17 So it is not supported if you are using Virtual Private Gateway.
06:23 Further, if you have IPv6 addresses for both outer and inner configurations, then it allows complete
06:31 IPv6 traffic.
06:32 So if your application is completely IPv6 based, that means there are no IPv4 addresses being used.
06:39 Then you should use this configuration.
06:42 Whereas if you are not using IPv6 addresses at all, then you should use this first configuration,
06:50 right?
06:51 And finally there is this fourth option where you have IPv6 outer tunnel and then IPv4 for inner transport.
06:59 In that case it allows the IPv6 routing.
07:02 That means your applications can be reached over IPv6 addresses, but tunnel can only support IPv4 traffic.
07:11 And again, this is only supported on the Transit Gateway and AWS cloud van.
07:17 Okay.
07:18 While you can configure everything that we talked about.
07:21 But it means that at any moment of time, either VPN tunnel will support IPv4 traffic or IPv6 traffic.
07:29 So it won't support both IPv4 and IPv6 traffic at the same time.
07:36 So just remember that.
07:38 And if you want to support both the traffic through VPN then you have to create a separate VPN connection.
07:45 Okay, so I hope it is clear how the IPv4 and IPv6 traffic is supported on AWS site to site VPN.
07:52 And with this knowledge, now let's do an exercise where we will set up IPv4 tunnels from AWS to simulated
08:02 on premise network.
08:04 So with that now let's go to the exercise.
08:07 Thank you.
整讲总结 / Overall Summary
中文
AWS 站点到站点 VPN（AWS Site-to-Site VPN）用外部 IP 地址（outside IP address）建立 IPsec 隧道，用内部 IP 地址（inside IP address）路由隧道内的数据包。外部/内部地址可分别选择 IPv4 或 IPv6，但虚拟私有网关（VGW）只支持默认的 IPv4 外部 + IPv4 内部组合；涉及 IPv6 的组合需要中转网关（TGW）或 AWS Cloud WAN。最重要的限制是单个 VPN 连接一次只能承载一种协议族，双栈需求必须使用分离的 IPv4 与 IPv6 VPN 连接。
English
AWS Site-to-Site VPN uses outside IP addresses to establish IPsec tunnels and inside IP addresses to route packets through them. Outer and inner addressing can independently use IPv4 or IPv6, but VGW supports only the default IPv4-outer/IPv4-inner combination; IPv6 combinations require Transit Gateway or AWS Cloud WAN. Most importantly, a single VPN connection carries only one protocol family at a time, so dual-stack transport requires separate IPv4 and IPv6 VPN connections.
返回顶部 ↑