网络课程笔记

00:00 Hello and welcome to this lecture.

00:01 Now in this lecture,

00:02 let's look at some additional scenarios,

00:05 when you have configured your site-to-site VPN tunnels

00:08 in active mode or passive mode.

00:11 Now, you know that AWS site-to-site VPN

00:14 provisions two tunnels, that's for high availability

00:18 and it's up to you how you configure this tunnels,

00:20 weather in active-active mode,

00:22 which means both the tunnels are up at the same time

00:25 and you can also configure it in active-passive mode,

00:28 that means only one tunnel is up at any moment of the time.

00:31 Now in this case, let's see how the routing happens.

00:34 So, whether you're using the static routing

00:38 or dynamic routing for your VPN connection

00:40 would affect the flow of the traffic,

00:42 now let's try to understand that.

00:44 Now this is a very much familiar architecture,

00:47 where you have VPC and a corporate data center

00:49 and they're connected using site-to-site VPN connection,

00:52 on AWS side, you have virtual private gateway

00:55 and on the customer network side, you have customer gateway

00:57 and we have shown two tunnels here,

00:59 that's what VGW does, right?

01:02 Now in this case, this is a static routing scenario,

01:05 that means you have already configured the routes

01:07 on both sides of the network

01:08 with the destination CIDR for respective network CIDRs.

01:13 Now if from the corporate data center,

01:15 if the traffic initiates, it goes to the CGW

01:18 and from there, based on your routing configuration,

01:21 it would flow through tunnel one or two

01:24 and it reaches AWS,

01:26 then it would reach to the destination EC2 instance here

01:29 and from there, the return traffic

01:30 will again head back to virtual private gateway.

01:34 Now there is one problem,

01:35 when VGW receives this traffic from AWS EC2 instance,

01:40 it has choice to send this traffic back

01:42 through tunnel one and tunnel two.

01:44 And in case of static routing,

01:48 it would make that choice randomly,

01:50 that means it can either send this traffic

01:52 through tunnel one

01:53 or it can send traffic through tunnel two.

01:56 Now, if it sends traffic back through tunnel one

01:59 there is no problem,

02:00 even if there is a firewall here

02:02 it would understand that this is a return traffic

02:04 for the request which I had just sent

02:06 and it will allow that traffic

02:08 because we are considering the stateful firewalls.

02:12 Now what if the traffic flows from tunnel two this time,

02:15 the return traffic we're talking about?

02:18 Now here, if there is a firewall on customer gateway side

02:21 and it's a stateful firewall,

02:23 it would probably reject this traffic,

02:26 because it does not have the state of the request

02:29 which was outgoing earlier, right?

02:32 It will say that, I don't understand this traffic

02:35 and it will probably drop this traffic

02:37 and this routing is typically called as asymmetric routing.

02:41 And that's a problem in some of the firewalls

02:46 and some firewall might support it

02:47 and in some firewall you might have to explicitly enable

02:50 the asymmetric routing.

02:53 So if you are using both the tunnels with static routing

02:58 in active-active mode,

02:59 then make sure that

03:00 on the customer gateway side of the firewall

03:02 you enable the asymmetric routing.

03:05 So that's one point.

03:07 Now, if your traffic originates on AWS side of the network,

03:11 for example, this EC2 instance here

03:13 wants to send some traffic to any of those servers

03:16 in corporate data center,

03:17 it will send the packet to virtual private gateway

03:20 and then this VGW will randomly select

03:24 one of the tunnel,

03:25 either tunnel 1 or tunnel two,

03:27 you can't really influence that decision

03:29 in case of static routing.

03:30 So this is just to make you understand that

03:33 in case of static routing

03:35 the tunnel selection happens randomly

03:37 on virtual private gateway side

03:39 and for the same reason,

03:41 you would have to have the asymmetric routing configured

03:44 on the other side of the network.

03:46 Okay now let's move on and look at a different scenario.

03:50 Now, again, we will look at the static routing

03:53 but this time we have active-passive tunnels.

03:55 Now what that means is,

03:57 only one of the tunnel up at any moment of the time.

04:00 So tunnel two is for example down,

04:03 if you remember our hands-on exercise,

04:05 we had set up opens one tunnel

04:07 and we had configured only one tunnel at that time,

04:10 we did not configure another tunnel.

04:12 Now this is a similar situation.

04:14 Now in this case,

04:15 let's walk through the same scenario again,

04:18 from your corporate data center

04:19 if traffic goes to AWS first,

04:22 it will go to customer gateway

04:24 from there only one tunnel is up,

04:26 there is no choice

04:27 and you have to get to the VGW,

04:30 VGW will send traffic to EC2

04:32 and from there return traffic will come to VGW,

04:34 now VGW will see that there is only tunnel up,

04:37 so there is no choice to go through another tunnel

04:39 of course it will send traffic back from the same tunnel

04:42 through which the traffic came.

04:44 So in that case,

04:45 you don't really need to worry about asymmetric routing

04:48 because there is only one active tunnel.

04:50 Now in this case what happens

04:51 if this tunnel goes down, right?

04:54 There is no high availability.

04:56 Now, that's your responsibility that if tunnel one goes down

04:59 you'd have to make sure tunnel two comes up automatically.

05:03 And that is more to do on your side of the network,

05:05 so many routers like Juniper or Cisco

05:10 would have some mechanism

05:12 where it can automatically detect

05:13 that the tunnel one is down

05:15 and then they will bring up the tunnel two automatically,

05:18 in case of open tunnel two,

05:20 we could have written some scripts

05:21 which continuously monitor the status of tunnel one

05:25 and if tunnel one goes down for some reason,

05:27 it will bring up the tunnel two.

05:29 Now that's active-passive tunnels in that sense.

05:32 AWS does not have to do anything there,

05:34 this is completely in your control,

05:37 which tunnel should be up at any moment.

05:39 So that's about the active-passive tunnels

05:42 in case of static routing.

05:44 Okay now let's move to the dynamic routing, what happens.

05:47 You know that in case of dynamic routing,

05:49 the routes are selected based on various BGP preferences.

05:53 So let's see how it affects your traffic flow.

05:57 So, this time, we have active-active tunnels

06:00 and it would make sense to have only active-active tunnels

06:02 because then there is no purpose of having two tunnels

06:06 for high availability, right?

06:07 If it's an active-passive,

06:09 then it's kind of static routing you're doing,

06:11 if tunnel goes down,

06:12 you would have to manually bring up the tunnel.

06:14 But with dynamic routing,

06:15 you can use both these tunnel at the same time,

06:18 in highly available fashion.

06:20 What that means is

06:21 you can influence the VGW side of the tunnel selection

06:26 and say, always use tunnel one probably for some CIDR

06:30 or maybe using some BGP attributes that we had learned,

06:35 so VGW will always use tunnel one

06:38 and in case tunnel one goes down,

06:40 it can automatically then switch over to tunnel two

06:42 for all the traffic,

06:43 now that's the benefit of using dynamic routing.

06:46 So in this case what we are saying is,

06:48 again, corporate data center is originating the traffic,

06:51 it goes to tunnel one and tunnel two

06:53 based on your configuration,

06:54 it will reach to virtual private gateway.

06:56 Now, if you know that if you look at the static routing,

06:59 same thing might happen here,

07:01 the VGW might send the traffic back through a tunnel two

07:05 which will cause asymmetric routing.

07:07 But with dynamic routing,

07:09 with BGP you have ways to influence the decision here

07:13 on the virtual private gateway side,

07:16 saying that, always use tunnel one,

07:18 because maybe I am pushing the more specific routes

07:22 through tunnel a one.

07:24 So advertise more specific prefixes

07:26 over tunnel one tunnel two.

07:27 What that means is,

07:29 maybe this server falls

07:31 into a subnet range of 192.168.0.0/24

07:35 and so for this BGP session

07:38 you can publish the CIDR as 192.168.0.0/24

07:44 and for tunnel two,

07:45 you might want to advertise 192.168.0.0/16.

07:49 Now /24 is more specific than /16,

07:54 so VGW will always prefer the tunnel one

07:57 for the return traffic, right?

07:59 As you know,

08:00 you can also influence the routing decision in case of BGP

08:04 using something called ASPATH,

08:06 that means if tunnel one has shorter ASPATH,

08:09 VGW will always prefer that particular path

08:12 rather than tunnel two path

08:14 if it is longer than the tunnel one is ASPATH,

08:16 so you can also influence that decision.

08:19 When ASPATHs are having the same length,

08:22 then you can use third BGP parameter,

08:24 that is MED, multi-exit discriminator.

08:28 What that means is

08:29 the lowest MED value would take the preference.

08:32 So from BGP end, from the customer gateway end

08:34 you can advertise different MED values

08:37 for both the tunnels

08:38 and here, VGW of course will choose the tunnel

08:42 which has lower MED values.

08:44 Now this is only possible in case of dynamic routing

08:47 because you are having to BGP peers,

08:50 one at VGW and other at CGW end.

08:53 In case of static routing there are no such BGP parameters

08:56 and that's where all that problem occurs.

08:58 But in this case, if you have lower MED values,

09:01 of course VGW will use tunnel one always

09:04 as a preferred tunnel

09:06 and then the traffic will go back to your data center

09:09 and there will be no asymmetric routing.

09:11 Now the best part is,

09:13 if tunnel one goes down for some reason,

09:15 you have another tunnel up all the time,

09:18 so all the traffic now will be routed through tunnel two.

09:21 So we are basically influencing the tunnel decision

09:24 on AWS side of the network

09:25 using this BGP parameters.

09:28 So this is very interesting

09:30 and very important to know for you,

09:33 may not be directly asked in a exam,

09:35 but maybe in your day to day work

09:37 you can analyze why you have asymmetric routing

09:40 and how to fix that.

09:42 So, that's it about the active-active

09:46 and active-passive routing.

09:48 So just a summary in case of static routing,

09:51 active-active tunnel mode,

09:52 AWS randomly select the tunnel

09:54 for the traffic originating from AWS

09:56 and make sure that you configure

09:59 or enable the asymmetric routing

10:01 on your customer gateway side of the firewall.

10:04 In case of static routing

10:05 with active-passive tunnel mode,

10:06 that means only one tunnel is up at the moment,

10:09 you don't have to really worry

10:10 because always that tunnel will be used

10:13 for both sides of the communication.

10:16 But it's your responsibility that

10:18 if one tunnel goes down for some reason,

10:20 another tunnel is brought up in possibly automated fashion.

10:25 Now in case of dynamic routing,

10:27 of course it will make sense

10:28 to have active-active tunnel mode only

10:30 because, active-passive,

10:32 you are just not leveraging

10:33 the high availability of the tunnels.

10:35 So in that case, all the BGP parameters

10:37 will come into the picture,

10:39 so you can influence the decision

10:41 on AWS side of the connection

10:44 that which tunnel to use

10:45 using maybe a more specific route,

10:48 more specific prefixes

10:50 or using shorter ASPATH

10:51 or lower multi-exit discriminator value.

10:55 So, that's how you can influence those routing decisions.

10:59 So that's it about this lecture,

11:01 I hope you understood the network flow

11:04 and thanks for watching.