Lecture 109: AWS VPN CloudHub
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:31
- 来源：Udemy Lecture 26204104
- Slide 数量：3
- 画面切换：00:20、03:58
扫描说明
逐条检查了 Udemy 页面中的 104 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 4:31 的视频。依据标题、VGW 分离模式 CloudHub 及其要求、附加 VPC 后的扩展场景三个独立画面阶段，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPN CloudHub 概览
时间范围：00:00–00:20
总结 / Summary
中文
AWS VPN CloudHub 使用 AWS 站点到站点 VPN（AWS Site-to-Site VPN）把多个分支机构连接到云中的公共枢纽。它不仅用于分支到 AWS 的通信，也可让原本没有专线互连的本地站点（on-premises site）通过 AWS 中心实现站点间通信。
English
AWS VPN CloudHub uses AWS Site-to-Site VPN to connect multiple branch offices to a shared hub in the cloud. It supports not only branch-to-AWS communication but also site-to-site communication between on-premises locations that do not already have direct private links.
Transcript
00:00 Hello, and welcome to this lecture.
00:02 Now we are going to talk about, slightly,
00:04 a different architecture.
00:06 And this is very useful
00:07 and I have seen customers using this,
00:09 and now this is called a cloud hub,
00:11 VPN cloud in particular,
00:13 and let's understand what that means
00:15 and why we need VP as Cloud Hub
00:17 using AWS site-to-site VPN connection.
2. Detached VGW 构建 CloudHub
时间范围：00:20–03:58
总结 / Summary
中文
VPN CloudHub 可以让虚拟私有网关（Virtual Private Gateway, VGW）在分离模式（detached mode）下运行，即不附加任何 VPC，而由多个客户网关（Customer Gateway, CGW）分别建立 IPsec VPN 并通过 VGW 互通。各 CGW 必须采用动态路由（dynamic routing）并拥有唯一的 BGP 自治系统编号（BGP Autonomous System Number, ASN）；各站点 CIDR 不能重叠。课程给出的上限是最多连接 10 个 CGW。CloudHub 也可作为现有站点间链路的故障转移路径（failover path）。
English
VPN CloudHub can operate a Virtual Private Gateway in detached mode, without any VPC attachment. Multiple Customer Gateways establish separate IPsec VPNs and exchange routes through the VGW. Each CGW must use dynamic routing with a unique BGP Autonomous System Number, and site CIDRs must not overlap. The lecture states a limit of up to 10 CGWs. CloudHub can also serve as failover for existing site-to-site connectivity.
Transcript
00:20 So let's say you have multiple branch offices.
00:23 Now here we are not really talking about
00:25 connecting your network to AWS in particular.
00:27 Maybe you don't have anything
00:28 or any workload that is running in AWS,
00:33 there is no VPC, but you just have branch offices
00:36 and you want to make sure all branch offices
00:38 has a VPN connection between them, of course,
00:41 because you should be able to access all resources or
00:45 servers or applications which are deployed privately in the
00:49 given corporate data center.
00:51 You should be able to access that
00:53 from the other branch office network.
00:55 And typically for that,
00:56 you would connect this corporate data center
00:58 using a VPN connections like one-to-one connection.
01:01 You connect A to B, B to C and A to C kind of thing.
01:04 Or you could also do a transit routing.
01:07 Like if you want to go to C probably you go through B,
01:10 all those kinds of networking architectures are possible,
01:14 but AWS, virtual private gateway
01:18 can also be used to provide this
01:21 connectivity as a cloud hub.
01:23 That means your hub would be in the cloud,
01:25 and then you will connect all branch offices
01:28 to that cloud hub.
01:29 Now how the architecture looks like
01:31 it is something like this.
01:32 You have branch offices and you have VPN gateway
01:36 and you connect your branch offices
01:38 to get for using IP sec VPN.
01:41 That's what we are talking about so far
01:43 and what it makes it possible that
01:45 now all branch offices can communicate with each other.
01:49 Why are these, Virtual private gateway?
01:52 Now that's interesting.
01:53 And you might have noticed that
01:55 I haven't attached this VPN gateway to any VPC,
01:59 and that's the beauty of it.
02:01 VPN gateway can work without attaching it to the VPC.
02:05 Now it is called VPN gateway in detached mode.
02:09 So you can use VPN Gateway in a detached mode
02:12 and can have a cloud hub architecture
02:14 where you only connect branch offices
02:16 to that using IP sec VPN connection.
02:19 So each customer gateway must have a unique BGP ASN.
02:23 We learned about what is BGP and what is ASN?
02:26 And they should also have the dynamic routing enabled
02:30 that's because with dynamic routing,
02:33 you should not be having to set up a
02:35 static routing on VPN Gateway,
02:37 like how to route the traffic to different branch offices.
02:40 BGP would take care of that, and tomorrow,
02:43 if you connect a new network to a same
02:46 Virtual Private Gateway, you don't
02:47 need to really make any changes there.
02:50 Then there are some limitations like
02:53 the sites that you have should not be having overlapping
02:56 IP ranges, of course, that
02:58 because the VGW has to take a decision where to send
03:02 the traffic based on the destination IP ranges.
03:05 So all branch offices should have
03:07 different CIDR blocks.
03:09 Likewise, you could connect up to
03:12 10 such customer gateway to VPN Gateway,
03:16 and it can also serve as a failover connection.
03:18 What I mean that, it's possible that you already have
03:20 connectivity between these branch offices,
03:23 as we had seen in the earlier slide.
03:26 And what if that connection goes down?
03:28 So this can serve as a failover connection.
03:30 Then the traffic will go through AWS VPN,
03:33 and then from there, it will be routed
03:35 to your branch offices. But otherwise,
03:37 if the, your branch offices connection
03:39 is already live, traffic will go from there.
03:42 So these are some of the architecture
03:45 patterns that you can use while
03:47 connecting your corporate data centers.
03:49 So this is called VPN cloud hub.
03:51 Now, one more thing, of course,
03:53 if you have any workload in AWS
03:55 and you have this kind of branch offices,
3. CloudHub 附加 VPC
时间范围：03:58–04:31
总结 / Summary
中文
同一个 VPN 网关（VPN gateway）也可以附加到 VPC。此时形成完整的中心辐射模型（hub-and-spoke model）：每个分支既能通过 CloudHub 访问其他分支，也能访问 VPC 中的工作负载。BGP 动态路由会自动传播新增站点和 VPC 前缀，避免为每个分支手工维护大量静态路由。
English
The same VPN gateway can also attach to a VPC. The result is a complete hub-and-spoke design in which every branch can reach both other branches and workloads in the VPC. BGP dynamic routing propagates newly added site and VPC prefixes automatically, avoiding extensive manual static-route maintenance.
Transcript
03:58 you can also introduce VPC there.
04:01 That means now every branch office can talk to VPC,
04:04 as well as every branch office can talk to each other.
04:08 So this is kind of hub and spoke model for
04:11 connecting your branch offices to AWS,
04:13 as well as having the connectivity between themselves.
04:16 So remember this kind of architecture could be very useful
04:19 when you are operating at multiple branch offices at the
04:23 same time. So this is called VPN cloud hub.
04:26 Okay. So that's it for this lecture.
04:28 And thanks for watching.
整讲总结 / Overall Summary
中文
AWS VPN CloudHub 让多个客户网关（CGW）以站点到站点 VPN 汇聚到一个 VGW，并通过 BGP 在分支间交换路由。VGW 可以在不附加 VPC 的分离模式（detached mode）运行，也可进一步附加 VPC；要求各 CGW 使用唯一 ASN、CIDR 不重叠，且课程给出的规模上限为 10 个客户网关。
English
AWS VPN CloudHub aggregates multiple Customer Gateways onto one VGW through Site-to-Site VPN and exchanges branch routes with BGP. The VGW can run detached from any VPC or attach to a VPC as well. Each CGW needs a unique ASN, site CIDRs must not overlap, and the lecture gives a maximum of 10 Customer Gateways.
返回顶部 ↑