Lecture 101: Accelerated Site-to-Site VPN (Using AWS Global Accelerator)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:20
- 来源：Udemy Lecture 51791839
- Slide 数量：5
- 画面切换：00:37、01:52、03:43、04:36
扫描说明
逐条检查了 Udemy 页面中的 103 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 7:20 的视频。依据标题、普通公网 VPN 路径、Global Accelerator 加速路径、AWS 控制台配置和重要限制五个独立画面阶段，共划分出 5 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Accelerated Site-to-Site VPN 概览
时间范围：00:00–00:37
总结 / Summary
中文
加速站点到站点 VPN（Accelerated Site-to-Site VPN）使用 AWS Global Accelerator 优化客户网络到 AWS 的 VPN 数据路径。它不改变 IPsec 隧道（IPsec tunnel）的基本安全模型，而是让流量更早进入 AWS 全球网络（AWS global network），以改善跨公网传输的性能与可靠性。
English
Accelerated Site-to-Site VPN uses AWS Global Accelerator to optimize the VPN path between a customer network and AWS. It does not change the basic IPsec security model; instead, it moves traffic onto the AWS global network earlier to improve performance and reliability.
Transcript
00:00 Okay, now that you know how AWS Site to Site VPN works, let's look at some of the features and one
00:05 of the feature of site to site VPN that is important to know is accelerated site to site VPN.
00:12 And for that you can use AWS Global Accelerator.
00:16 Now we have covered AWS Global Accelerator separately in the CloudFront section.
00:22 And that's where in this lecture we are not diving too much deep into the global accelerator.
00:28 But let us see the application of global accelerator for accelerating the site to site VPN connectivity.
00:36 Okay.
2. 普通公网 VPN 路径的问题
时间范围：00:37–01:52
总结 / Summary
中文
普通站点到站点 VPN（Site-to-Site VPN）通过公共互联网（public internet）连接客户网络与中转网关（Transit Gateway, TGW）或虚拟私有网关（Virtual Private Gateway, VGW）。数据包可能穿越多个无法控制的运营商网络，因而受到延迟（latency）、拥塞（congestion）和网络中断（network disruption）的影响，造成带宽不稳定甚至隧道中断。
English
A standard Site-to-Site VPN crosses the public internet between the customer network and a Transit Gateway or Virtual Private Gateway. Packets may traverse multiple third-party networks, exposing the connection to latency, congestion, network disruptions, inconsistent bandwidth, and possible tunnel failure.
Transcript
00:37 So in general, when you create the site to site VPN connection, typically you will have your customer
00:43 network somewhere at the distance place and then you will have your AWS region.
00:48 And then you will have either virtual Private gateway or the transit gateway on which you will terminate
00:54 the VPN connection.
00:55 Right.
00:56 Now all this traffic goes over the internet, as we already discussed.
01:00 And this internet is generally made up of lot of different networks.
01:05 That means the packet has to travel through all those different networks.
01:10 Something like this.
01:11 Right.
01:12 And you don't necessarily control all these intermediary networks.
01:17 And that's where many a times you may face challenges, for example having increased latency or there
01:24 is congestion in the traffic, or there is some network disruption somewhere in any of the network.
01:30 And then your VPN connection might get terminated or it might not give the required bandwidth.
01:37 So all this is happening because all the traffic is going over the different networks, right?
01:45 Now how do you solve this problem?
01:47 So for that you need to use accelerated site to site VPN connection.
3. 通过 Edge Location 进入 AWS Backbone
时间范围：01:52–03:43
总结 / Summary
中文
加速 VPN 通过任播 IP（anycast IP）把客户流量引导到最近的边缘站点（edge location），然后经 AWS 骨干网络（AWS backbone network）到达中转网关（TGW）。只有客户到最近边缘站点的一小段经过本地互联网服务提供商网络（ISP network），主要长距离路径由 AWS 管理，从而减少公网跳数并提高可预测性。
English
Accelerated VPN uses anycast IPs to steer customer traffic to the nearest edge location, after which the AWS backbone carries it to the Transit Gateway. Only the short path to the edge uses the local ISP network, while AWS manages the long-haul segment, reducing public-internet hops and improving predictability.
Transcript
01:52 Now in this case what happens now between your data center and AWS region.
01:59 Right.
01:59 Where you want to set up the VPN connection you can route this traffic through AWS edge locations.
02:07 Now again, in the CloudFront section, we have covered in detail what is edge location.
02:12 But in short, these are like the networking hub, which can be used by CloudFront service to deliver
02:18 your content at lowest latency.
02:21 And they can also cache your content.
02:24 But in the context of site to site VPN, they are used to optimize your network path.
02:29 And that is because all these edge locations are connected to AWS region using AWS backbone network,
02:37 which means when now traffic flows to the transit gateway over the VPN, first time it will hit the
02:44 nearest edge location.
02:46 So there is very less network path which goes over your network service provider.
02:51 But as I said, this edge location is connected to AWS region over AWS backbone network.
02:58 So this traffic is completely congestion free.
03:01 It is managed by AWS and that's where it can give you reliable connectivity.
03:07 So in order to have this kind of VPN, you have to use AWS edge location to route that traffic.
03:15 And how do you use edge locations?
03:17 So for that you use AWS Global Accelerator Service.
03:21 So all these edge locations are part of AWS Global Accelerator.
03:26 Now question you might have where do you really enable this VPN acceleration.
03:31 Right.
03:32 So let me quickly show you that in AWS console.
03:35 And then we will talk about some important things that you should know about.
03:39 Accelerated site to site VPN connection.
03:43 Okay.
4. 在新建 VPN 时启用 Acceleration
时间范围：03:43–04:36
总结 / Summary
中文
在 AWS 控制台创建 VPN 连接（VPN connection）时，终止目标必须选择中转网关（Transit Gateway, TGW），随后勾选启用加速（Enable acceleration）。该选项调用 AWS Global Accelerator，并会产生额外费用。加速只能在创建新连接时启用，现有 VPN 连接不能原地转换，必须重新创建。
English
In the AWS console, a new VPN connection must terminate on a Transit Gateway before Enable acceleration can be selected. The option uses AWS Global Accelerator and incurs additional charges. Acceleration cannot be added to an existing VPN connection; a new connection must be created.
Transcript
03:43 So I am into my VPC console.
03:45 And now if you go to the VPN section and if you go to the site to site VPN connection, and if you try
03:50 to create a new connection here you can choose where it terminates.
03:56 Now remember that acceleration is only supported on the transit gateways, so it is not supported on
04:01 Virtual Private gateway.
04:03 So you have to select the transit gateway.
04:05 And I'm not selecting all other option.
04:07 What I wanted to show you is this.
04:10 So it says enable acceleration.
04:12 And that's where it uses AWS Global Accelerator Service.
04:17 Now another thing to remember is that you can only select this option while creating the VPN connection.
04:23 Once you create that you can't change that later, right?
04:27 So just remember that.
04:29 Okay.
04:30 So going back to our discussion, a few important things that you need to know is that it is only supported
5. Accelerated VPN 的关键限制
时间范围：04:36–07:20
总结 / Summary
中文
考试重点包括：只支持以中转网关（TGW）为终点，不支持虚拟私有网关（VGW）；只能在新建连接时开启；AWS 提供两个静态任播 IP（static anycast IP），它们不同于普通 VPN 端点地址；必须启用 NAT 穿越（NAT Traversal, NAT-T）；Internet Key Exchange 协商（IKE negotiation）必须由客户网关（Customer Gateway, CGW）发起；并且会收取额外费用。
English
Key constraints are: only Transit Gateway termination is supported, not VGW; acceleration is enabled only at connection creation; AWS supplies two static anycast IPs that differ from normal VPN endpoint IPs; NAT Traversal must be enabled; IKE negotiation must be initiated by the Customer Gateway; and additional charges apply.
Transcript
04:36 on the transit gateway.
04:37 That means if you are terminating your VPN on the virtual private gateways, then you can't have this
04:43 VPN acceleration.
04:45 Second, it can only be enabled while creating the VPN connection, which means that you can't enable
04:51 that on the existing VPN connection.
04:55 So in your exam, if there is a question which says that you want to accelerate the VPN, in that case,
05:01 you can't really do that on existing connection.
05:04 So the answer should be you should create a new connection and that too should terminate on AWS Transit
05:11 Gateway.
05:12 And while creating the connection you have to enable the acceleration further.
05:17 How it works.
05:18 So again, as I said, we will cover that in detail in the CloudFront section.
05:23 But AWS basically provides two anycast IPS for the global acceleration.
05:29 So whenever you create the VPN tunnel, you have to use these two IPS for setting up that VPN connection
05:36 and not the one which by default Transit Gateway will provide otherwise.
05:41 Right.
05:41 So these are anycast IPS.
05:42 That means they route the traffic to the nearest edge location.
05:45 The IP still remains same, and it uses then edge locations to route your traffic to AWS region.
05:53 Now another important thing for having the VPN acceleration you have to have Nat traversal enabled.
06:00 Now what is Nat traversal?
06:01 How it works.
06:02 We are going to talk about that shortly, but just remember this thing further.
06:09 There is always this IP negotiation that happens which means who initiates the VPN connection request
06:16 right?
06:17 It can be started from the customer side, or it can be started from the AWS side.
06:22 But for accelerated site to site VPN, it has to be started from the customer gateway side.
06:28 But otherwise, if you are terminating your VPN on the Virtual Private gateway without acceleration,
06:34 even you can configure that AWS will initiate the key negotiation.
06:39 So this is another thing that you should know.
06:43 And finally it comes with some additional charge.
06:46 Now because the pricing change I'm not quoting how the charge is, but just remember that it cost you
06:52 little extra when you enable the acceleration on your VPN connection, right?
06:58 So I hope it is clear what is accelerated site to site VPN, and what is the purpose and what are some
07:04 important thing that you should remember.
07:07 So thanks for watching.
07:08 And with that, let's talk about some other important features of AWS site to site VPN connection.
07:15 So thanks for watching and let's go to the next lecture.
07:18 Thank you.
整讲总结 / Overall Summary
中文
加速站点到站点 VPN（Accelerated Site-to-Site VPN）借助 AWS Global Accelerator 的任播 IP（anycast IP）和边缘站点（edge location），把流量尽早送入 AWS 骨干网络（AWS backbone network），从而绕开较长且不可控的公网路径。它只支持中转网关（TGW），必须在创建新 VPN 连接时启用，同时要求 NAT-T 和由 CGW 发起 IKE 协商，并会增加成本。
English
Accelerated Site-to-Site VPN uses AWS Global Accelerator anycast IPs and edge locations to place traffic onto the AWS backbone as early as possible, avoiding a long and unpredictable public-internet path. It supports only Transit Gateway, must be enabled when creating a new VPN connection, requires NAT-T and CGW-initiated IKE negotiation, and adds cost.
返回顶部 ↑