Lecture 108: AWS Site-to-Site VPN Architectures
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:42
- 来源：Udemy Lecture 26204038
- Slide 数量：7
- 画面切换：00:27、01:49、02:19、03:20、04:57、05:18
扫描说明
逐条检查了 Udemy 页面中的 165 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 6:42 的视频。依据标题、架构类型总览、单连接 VGW、单连接 TGW、多连接 VGW、多连接 TGW 和冗余高可用七个独立幻灯片，共划分出 7 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Site-to-Site VPN 架构目标
时间范围：00:00–00:27
总结 / Summary
中文
本讲把 AWS 站点到站点 VPN（AWS Site-to-Site VPN）组合成几种常见架构模式，覆盖单一数据中心、多分支机构与高可用性（high availability）。设计重点包括 AWS 侧终止网关的选择、多条 VPN 连接的汇聚方式，以及如何消除客户网关（Customer Gateway, CGW）的单点故障。
English
This lecture organizes AWS Site-to-Site VPN into common architecture patterns for a single data center, multiple branch offices, and high availability. The design choices include the AWS-side termination gateway, how multiple VPN connections are aggregated, and how to eliminate a Customer Gateway single point of failure.
Transcript
00:00 Hello and welcome to this lecture.
00:01 Now we understood about how AWS Site-to-Site VPN works
00:06 now let's understand few architectural patterns.
00:09 So, this would involve high availability
00:12 of your VPN connection as well
00:14 as how do you connect, say multiple branches of your office
00:17 or multiple data centers to AWS VPC
00:21 using multiple connections.
00:23 So, let's see what all we are going to talk here.
2. 四类架构模式
时间范围：00:27–01:49
总结 / Summary
中文
课程列出四类模式：使用虚拟私有网关（Virtual Private Gateway, VGW）的单一 VPN 连接；使用中转网关（Transit Gateway, TGW）的单一连接；从一个 AWS 汇聚点连接多个分支机构的多条 VPN；以及通过冗余 VPN 连接提高可用性。虽然每条 VPN 已自带两条隧道，若两条隧道都终止在同一个 CGW，该设备仍可能成为单点故障。
English
The four patterns are a single VPN through a Virtual Private Gateway, a single VPN through a Transit Gateway, multiple VPN connections from one AWS hub to branch offices, and redundant VPN connections for higher availability. Although every VPN already has two tunnels, a single CGW terminating both remains a device-level single point of failure.
Transcript
00:27 Now, very first thing,
00:28 having a single VPN connection from AWS VPC
00:31 to your office networks or your data center.
00:35 Now, we have seen that that can be very well done
00:37 with virtual private gateway,
00:38 and that's what exercise also we did,
00:40 but there is one more networking component in AWS
00:43 that is transit gateway,
00:45 and we have altogether a different section for that.
00:49 But for completeness of the VPN architecture
00:52 we are also going to talk about transit gateway
00:55 in this lecture.
00:56 So, that's about having one connection between AWS
01:00 and on-prem data center or your branch office network.
01:04 Now, you could also have
01:05 multiple Site-to-Site VPN connection.
01:07 That means you can connect one VPC
01:09 to multiple branch offices all together.
01:12 Now, that is like having multiple VPN connection.
01:15 And we'll see how the architecture would look like.
01:18 And finally, we'll see how
01:19 to have redundant VPN connections.
01:22 Now, why that?
01:23 We already understood
01:25 that there are two VPN tunnels for high availability.
01:28 And that should actually suffice.
01:31 But on customer gateway side,
01:33 what if the gateway device itself goes down
01:36 and both the VPN tunnels terminate
01:38 on the same customer gateway.
01:40 In that case probably having a redundant VPN connection
01:43 would provide you much more resiliency of the connection.
01:46 So, let's look at these architectures one by one.
3. 使用 VGW 的单一 VPN 连接
时间范围：01:49–02:19
总结 / Summary
中文
最基本的模式是在 VPC 上附加一个虚拟私有网关（VGW），再与公司数据中心的客户网关（CGW）建立一条站点到站点 VPN 连接。AWS 为该连接配置两条 VPN 隧道（VPN tunnel）以提供链路级冗余，VPC 路由表把本地前缀指向 VGW。
English
The basic pattern attaches a Virtual Private Gateway to a VPC and creates one Site-to-Site VPN connection to the corporate data center's Customer Gateway. AWS supplies two VPN tunnels for link-level redundancy, and VPC route tables point on-premises prefixes to the VGW.
Transcript
01:49 So, this is the architecture we have been talking about
01:52 throughout this lecture.
01:53 We saw this and we had done an exercise around this.
01:56 So, here you have VPC and virtual private gateway
01:59 and on the right side you have customer network.
02:01 And then you connected this
02:03 to our Site-to-Site VPN connection.
02:05 And for high availability,
02:06 there are two VPN tunnels flowing through.
02:09 So, this, you know very well.
02:11 There is a slight change in this.
02:13 Instead of virtual private gateway
02:16 you can also use a transit gateway.
4. 使用 TGW 的单一 VPN 连接
时间范围：02:19–03:20
总结 / Summary
中文
也可以把 VPC 附加到中转网关（Transit Gateway, TGW），并让站点到站点 VPN 直接终止在 TGW。TGW 更适合同时互连多个 VPC 和本地网络，担当集中式传输枢纽；在单连接场景中，它承担与 VGW 类似的 VPN 终止和转发角色，但具有更强的扩展能力。
English
A VPC can instead attach to a Transit Gateway and terminate the Site-to-Site VPN directly on the TGW. Transit Gateway is better suited to centrally interconnecting multiple VPCs and on-premises networks. In the single-connection pattern it performs a role similar to a VGW but offers greater scalability.
Transcript
02:19 Now transit gateway
02:20 is a relatively new networking component.
02:23 It came in 2018,
02:25 but now transit gateway you'll see everywhere,
02:28 wherever you want to connect multiple VPCs together
02:31 and having the architecture,
02:32 like connecting VPCs to your on-premise network,
02:35 then transit gateway is useful.
02:37 Now, as I said there is a separate lecture
02:39 which covers transit gateway,
02:41 but in current exam at least
02:43 I haven't seen transit gateway coming as a topic.
02:46 But it's always good to know about that.
02:48 So, what I mean by this architecture is that
02:51 instead of having a virtual private gateway
02:54 you can also create a transit gateway,
02:56 attach your VPC to that.
02:58 And then transit can do the same thing
03:00 that virtual private gateway does.
03:02 You can connect or set up a Site-to-Site VPN connection
03:06 between customer gateway and a transit gateway.
03:09 So, that's another networking component you can use here.
03:12 So, that's pretty much it about having
03:15 a single Site-to-Site VPN connection
03:17 now let's look at other architectures.
5. 使用 VGW 连接多个分支
时间范围：03:20–04:57
总结 / Summary
中文
一个 VPC 不能同时附加多个 VGW，但一个 VGW 可以终止来自不同客户网关（CGW）的多条 VPN 连接，因此多个城市的分支机构可以分别连到同一 VPC。所有连接共享 VGW 约 1.25 Gbps 的聚合带宽（aggregate bandwidth），并不会因连接数量增加而线性扩容；分支较多或吞吐较大时需要把这一共享上限纳入容量规划。
English
A VPC cannot attach multiple VGWs, but one VGW can terminate multiple VPN connections from different Customer Gateways, allowing branch offices in several locations to reach the same VPC. All connections share the VGW's roughly 1.25 Gbps aggregate bandwidth; capacity does not scale linearly with the number of VPNs, so the shared limit must be included in sizing.
Transcript
03:20 What if I have multiple corporate data centers
03:23 and every corporate data center would have
03:26 its own customer gateway, right?
03:28 Maybe how branch offices there in the US
03:31 at multiple locations
03:32 and I want that all these branch offices
03:35 can communicate to my cloud workloads.
03:37 And those workloads are somewhere in,
03:39 maybe (indistinct) into one VPC.
03:42 Now, I don't have these branch offices connected
03:45 with each other, just to find an example,
03:47 but I want to make sure my VPC connects
03:50 to every branch office.
03:52 Now I don't need multiple virtual private gateways here.
03:56 And you can't even have,
03:57 you can't connect multiple VGWs to a single VPC.
04:00 You just need to have one virtual private gateway here,
04:03 attached to a VPC
04:04 and then you can have multiple VPN connection
04:07 to every customer gateway here.
04:09 So, all these will terminate
04:10 on the same virtual private gateway on AWS site.
04:14 Now, while having this setup,
04:15 remember that the aggregate bandwidth
04:18 that virtual private gateway provides is limited
04:21 by 1.25 Gbps.
04:23 So, it does not mean you have full connection.
04:25 That means the bandwidth will be multiplied by four, no.
04:28 It would be 1.25 Gbps only.
04:31 So, accordingly, you can imagine how much data
04:35 you can transfer if you have,
04:36 say up to eight or 10 connections your bandwidth,
04:40 here at virtual private gateway
04:42 would be shared by all these VPN connections.
04:46 Now, there is a better option to that.
04:48 As I said, there is a transit gateway as well,
04:50 which does not have that kind of bandwidth limitation.
04:54 So, you can very well replace this with transit gateway
6. 使用 TGW 连接多个分支
时间范围：04:57–05:18
总结 / Summary
中文
多分支架构也可以把 VGW 替换为中转网关（TGW）。各分支仍通过各自的客户网关（CGW）建立独立站点到站点 VPN，但连接集中终止在 TGW；这种方式更适合大规模混合网络（hybrid network），并避免课程中所强调的 VGW 共享带宽限制。
English
The multi-branch design can replace the VGW with a Transit Gateway. Each branch still creates an independent Site-to-Site VPN through its own Customer Gateway, but all connections terminate centrally on the TGW. This scales better for a large hybrid network and avoids the VGW shared-bandwidth constraint emphasized in the lecture.
Transcript
04:57 and again do the similar setup.
04:59 So, the point
05:00 is on VPC side you can have
05:02 either virtual private gateway or transit gateway
05:05 and then you can connect it
05:06 to multiple branch offices
05:08 using Site-to-Site VPN connection.
05:11 Okay, with that, let's also talk
05:13 about one more architecture,
05:15 which is high availability for your VPN connection.
7. 冗余 VPN 连接实现高可用
时间范围：05:18–06:42
总结 / Summary
中文
若两条隧道都终止在同一个 CGW，设备故障或维护会同时中断两条路径。高可用设计可部署至少两个客户网关，并从 AWS 网关分别建立两条独立 VPN 连接，总计形成四条隧道。这样一个 CGW 下线时，另一条 VPN 连接仍可保持连通；静态或 BGP 路由策略（routing policy）负责控制首选路径和故障转移。
English
When both tunnels terminate on the same CGW, a device failure or maintenance event can remove both paths. A high-availability design deploys at least two Customer Gateways and creates two independent VPN connections from the AWS gateway, yielding four tunnels in total. If one CGW goes offline, the other VPN remains available, while static or BGP routing policy controls preference and failover.
Transcript
05:18 So, as we understood we could have one private gateway here
05:22 and then one customer gateway and customer data center site.
05:25 And then there are two tunnels.
05:26 The problem is what if the customer gateway itself goes down
05:30 or you want to have some maintenance
05:32 for that customer gateway device.
05:33 In that case, both the tunnels will go down
05:36 at the same time.
05:37 So, rather what you can do,
05:38 you can have multiple customer gateways,
05:40 at least two on the right side,
05:43 and then you can have two VPN Site-to-Site connections
05:46 between your virtual private gateway
05:48 and the customer gateways on the other side.
05:51 So, this would provide you ultimately four tunnels.
05:53 And that means if one customer gateway
05:56 has a maintenance going on,
05:58 you still have the connectivity
05:59 through other VPN connection.
06:02 And all that outing and everything,
06:03 you can again configure in your out table,
06:05 which routes to be taken.
06:07 We already saw that;
06:08 how to influence those routing decision.
06:10 All that would apply here as well.
06:12 So, you can have a redundant VPN connection
06:16 for high availability.
06:18 Okay, so these are few architecture I wanted to talk first
06:22 and then later I will take some example,
06:24 like I'll provide a scenario,
06:26 like this is a scenario:
06:27 I want to have this kind of connectivity.
06:29 Then what would the architecture look like?
06:32 So, once you understand everything
06:33 about the VPN connections,
06:35 we'll get into that lecture shortly.
06:38 So, that's it for this lecture and thanks for watching.
整讲总结 / Overall Summary
中文
AWS 站点到站点 VPN 架构（AWS Site-to-Site VPN architecture）可由 VGW 或 TGW 终止，并可从单一数据中心扩展到多个分支。VGW 可汇聚多条连接，但共享约 1.25 Gbps 聚合带宽；TGW 更适合大规模集中互连。若要消除 CGW 单点故障，应使用两个客户网关和两条 VPN 连接，形成四条隧道。
English
AWS Site-to-Site VPN can terminate on a VGW or TGW and scale from one data center to multiple branches. A VGW can aggregate multiple connections but shares roughly 1.25 Gbps of aggregate bandwidth, while TGW is better for large centralized interconnection. To remove the CGW single point of failure, use two Customer Gateways and two VPN connections, creating four tunnels.
返回顶部 ↑