Lecture 103: VPN Route Propagation (Static vs Dynamic)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:45
- 来源：Udemy Lecture 26077728
- Slide 数量：3
- 画面切换：00:14、03:31
扫描说明
逐条检查了 Udemy 页面中的 100 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 4:45 的视频。依据标题、静态与动态路由规则、站点到站点 VPN 路由传播示意三个独立画面阶段，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPN 路由传播概览
时间范围：00:00–00:14
总结 / Summary
中文
站点到站点 VPN（Site-to-Site VPN）支持静态路由（static routing）和动态路由（dynamic routing）两种路由传播方式。两者的主要区别在于网络前缀变化后，是由管理员手工维护两端路由表（route table），还是通过边界网关协议（Border Gateway Protocol, BGP）自动交换与传播路由。
English
Site-to-Site VPN supports static routing and dynamic routing. The key difference is whether administrators manually maintain route tables on both ends when network prefixes change, or whether Border Gateway Protocol automatically exchanges and propagates those routes.
Transcript
00:00 Hello and welcome to this lecture.
00:01 So let's try to understand
00:02 how the Route Propagation happens in case of VPN,
00:06 and you know that there is two types of routings
00:09 that VPN supports, the Static routing
00:11 and the Dynamic routing, and let's understand
2. 静态路由与动态路由的差异
时间范围：00:14–03:31
总结 / Summary
中文
静态路由（static routing）要求在 VPN 两端预先定义 CIDR 范围，并在新增网络时手工更新双方路由表（route table）；变化不会自动传播。动态路由（dynamic routing）使用 BGP 自动学习新前缀，并在 AWS 路由表中传播。课程强调 AWS 路由表最多接受 100 条传播路由（propagated route），因此本地网络（on-premises network）不应发布超过 100 条 BGP 路由；若前缀过于细碎，可用路由汇总（route aggregation）将多个较小 CIDR 合并为较大的 CIDR。
English
Static routing requires CIDR ranges to be predefined on both VPN endpoints and both route tables to be updated manually when networks are added. Dynamic routing uses BGP to learn new prefixes automatically and propagate them into AWS route tables. The lecture emphasizes a limit of 100 propagated routes in an AWS route table, so the on-premises network should not advertise more than 100 BGP routes; route aggregation can combine many small CIDRs into a larger prefix.
Transcript
00:14 how it works with respect to AWS site-to-site VPN.
00:18 So we had already done the setup
00:20 where we had AWS side of the VPN dominated
00:24 on Virtual Private Gateway, and on the other side,
00:26 we had a Customer Gateway, which was simulated,
00:29 but then ultimately does the job.
00:32 Now, in case of Static VPN,
00:33 what happens, like you have to update the route tables
00:37 on both sides of the connection, and you have to say like,
00:40 if the traffic is going to particular destination
00:42 on the right side, then the batch,
00:45 the traffic should go through Virtual Private Gateway
00:48 and similarly, route table you need to maintain
00:50 on the Customer Gateway side,
00:52 that if the destination is AWS CIDR,
00:55 then the traffic should go through the Customer Gateway.
00:59 Now, if network changes on any side of the VPN,
01:02 for example, on Customer Gateway side,
01:05 you extend that network to some other network.
01:08 That means you have for the VPN connection
01:11 to a third network.
01:13 In that case, AWS network won't know
01:16 that now your Customer Gateway can also be used
01:20 to reach to a third network, right?
01:22 In that case on AWS side,
01:24 you need to update your route table
01:26 for your subnets of course and tell that
01:28 if the traffic is going for that network C,
01:31 then also it should take the path through VPN gateway.
01:35 So that means all these route table update
01:38 has to be done manually, that's a Static routing.
01:42 In case of Dynamic routing through BGP, of course,
01:46 both the end leams the new network changes automatically.
01:50 So that's how the BGP works, right?
01:53 So on AWS side,
01:55 the new routes are automatically propagated
01:58 in the route tables, I will see that in some demo as well.
02:02 Now, one thing to note,
02:04 there is that AWS side of the route tables,
02:06 that means the route table, which are attached to subnets,
02:09 cannot have more than a hundred propagated routes.
02:12 Now that's a limitation on AWS side,
02:15 which means if on the customer side,
02:19 if you are sending more than hundred routes through BGP,
02:23 your connection might break,
02:25 and we don't know how the exact behavior it would be,
02:29 but the chances are your VPN connection can get terminated
02:33 because AWS side of the network cannot tolerate
02:36 or cannot accept more than hundred propagated routes.
02:40 So in that case,
02:41 what you are to make sure that these BGP connections
02:45 or BGP routes, you are not publishing
02:47 more than a hundred routes.
02:49 Now, how you can restrict your number of routes
02:52 to a hundred, maybe,
02:53 if you are sending too many small CIDR routes,
02:57 for example, you are sending 10.10.0.024,
03:02 10.10.1.24,
03:05 Now, you know that all these ranges
03:07 are a part of maybe a larger CIDR that is 10.10.0016
03:12 So what you can do,
03:12 you can consolidate all these CIDRs into probably one big
03:16 or large CIDR, and then you publish that
03:19 or the BGP instead of sending the small CIDRs.
03:24 So that's what you need to understand
03:26 while setting up the BGP and route propagation
03:29 on the AWS side.
3. Site-to-Site VPN 中的路由配置
时间范围：03:31–04:45
总结 / Summary
中文
静态路由（static routing）模式下，公司数据中心（corporate data center）需要把 VPC CIDR 的路由指向客户网关（Customer Gateway, CGW），AWS 侧则把本地 CIDR 的路由指向虚拟私有网关（Virtual Private Gateway, VGW）。动态路由（dynamic routing）模式下，两端通过外部 BGP（external BGP, eBGP）自动共享路由，不必逐条更新路由表，只需为 CGW 和 VGW 指定自治系统编号（Autonomous System Number, ASN）。
English
With static routing, the corporate data center points the VPC CIDR toward the Customer Gateway, while AWS points the on-premises CIDR toward the Virtual Private Gateway. With dynamic routing, the endpoints use external BGP to share routes automatically; individual route-table entries do not need manual updates, and the CGW and VGW Autonomous System Numbers must be specified.
Transcript
03:31 So let's see how it works. You know,
03:33 there is a Corporate data center and there is VPC.
03:36 In that case, we are setting the Virtual Private Gateway
03:39 on AWS side and Customer Gateway on the customer side,
03:43 and there is a site-to-site VPN connection
03:45 between these two.
03:46 On private subnet side,
03:47 there would be a route table,
03:49 in this rote table you will define an entry,
03:51 say, if the traffic destination is 10.3.0020
03:56 it has to go through Virtual Private Gateway.
03:58 Similarly, on the customer network side,
04:01 also there will be a route table.
04:03 It says if the traffic is going to 10.10.0016
04:07 which is a VPC CIDR,
04:09 the traffic should go through the Customer Gateway.
04:12 So in case of Static routing, you have to do that,
04:15 of course, on both the side of the network
04:17 and in case of Dynamic routing or using BGP,
04:20 they will automatically share these routes with each other,
04:24 we don't need to update the routing table.
04:26 So that's what the Static routing
04:29 and Dynamic routing has effect on route propagation.
04:34 So remember that on AWS side,
04:36 you can only accept a hundred routes
04:39 from the customer network side.
04:41 So that's it for this lecture, and thank you.
整讲总结 / Overall Summary
中文
站点到站点 VPN（Site-to-Site VPN）的静态路由（static routing）依赖两端手工维护前缀，而动态路由（dynamic routing）借助 BGP 自动学习和传播路由。采用 BGP 时需留意 AWS 路由表最多接受 100 条传播路由（propagated route），必要时通过路由汇总（route aggregation）减少前缀数量。
English
Static routing for Site-to-Site VPN relies on manually maintained prefixes at both ends, whereas dynamic routing uses BGP to learn and propagate routes automatically. When using BGP, account for the AWS route-table limit of 100 propagated routes and aggregate prefixes when necessary.
返回顶部 ↑