Lecture 124: Public VIF
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：10:01
- 来源：Udemy Lecture 27896598
- Slide 数量：30
- 画面切换：00:24、01:09、01:26、02:12、02:46、03:04、03:34、04:00、04:02、04:27、04:35、05:21、05:30、06:36、06:49、06:53、07:03、07:09、07:15、07:20、07:38、07:41、07:44、07:54、07:58、08:27、08:42、09:19、09:29
扫描说明
逐条检查了 Udemy 页面中的 235 条 Transcript cue，并以每条 cue 对应画面扫描了全长约 10:01 的视频。依据 Public VIF 理论幻灯片的逐步呈现、全球访问拓扑、AWS 路由发布规则、Public VIF 控制台创建流程以及结尾复习页，共划分为 30 个小节。正式截图均在锁定 Lecture 27896598、Autoplay 关闭、视频播放且底部控件隐藏后，按完整媒体边界截取并输出为 1364×770，逐张复核了左右与底部边界。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Public VIF 概览
时间范围：00:00–00:24
总结 / Summary
中文
公共虚拟接口（Public Virtual Interface, Public VIF）用于通过 AWS Direct Connect 访问 AWS 服务的公共端点（public endpoint）和 AWS 公共 IP 地址。
English
A Public Virtual Interface (Public VIF) uses AWS Direct Connect to reach public endpoints for AWS services and other AWS public IP addresses.
Transcript
00:00 Hello, and welcome to this lecture.
00:02 Now that you have understanding of the VIFs at high level,
00:05 now let's dig deep into individual VIFs.
00:08 So let's start with the public VIF.
00:09 So as you know,
00:10 the public VIF is used to access
00:12 the public endpoints on AWS site.
00:15 Now, when we say endpoint,
00:17 that means AWS services,
00:19 as well as public IP addresses on the AWS site.
00:22 And one thing to note here is that
2. 全球 AWS 公共 IP 可达性
时间范围：00:24–01:09
总结 / Summary
中文
Public VIF 的可达范围是全球 AWS 公共 IP，不受 Direct Connect 所在区域（Region）限制；这与连接虚拟私有网关（Virtual Private Gateway, VGW）的私有虚拟接口（Private VIF）不同。
English
A Public VIF can reach AWS public IPs globally, regardless of the Region containing the Direct Connect connection, unlike a Private VIF attached through a VGW.
Transcript
00:24 these IP addresses are accessible
00:27 from across the globe where AWS has regions.
00:30 That means it's not like
00:32 if you have Direct Connect connection
00:34 in only US region,
00:35 then you can only access public IPs in that region.
00:38 You can access public IPs
00:39 from across the regions where AWS has presence.
00:43 So that's one clear distinction between
00:46 the public VIF and the private VIF.
00:48 Now in case of private VIF,
00:50 if it is connected to the virtual private gateway,
00:54 which is attached to the VPC,
00:55 you can only access the VPC in the same region
00:57 in which you create the Direct Connect connection.
01:01 And in case of public VIF, it is not the case,
01:03 you can access all public services across the globe.
01:07 So just to explain it better,
3. 跨 Region 公共端点拓扑
时间范围：01:09–01:26
总结 / Summary
中文
即使 Direct Connect 位于美国区域，也能通过一条 Public VIF 访问法兰克福、孟买、北弗吉尼亚等多个区域（Region）的 AWS 公共服务端点。
English
Even when the Direct Connect connection is in a US Region, one Public VIF can reach AWS public service endpoints in Regions such as Frankfurt, Mumbai, and N. Virginia.
Transcript
01:09 this is how your connection looks like.
01:11 Now, if you have Direct Connect location
01:13 in the US region,
01:15 then also you can access all these services from AWS,
01:19 which are available as a public endpoint
01:21 from across the regions.
01:23 That's what this means.
4. VPC 外公共服务与 VPN 端点
时间范围：01:26–02:12
总结 / Summary
中文
Public VIF 可访问虚拟私有云（Virtual Private Cloud, VPC）之外的 Amazon S3、Amazon SQS、Amazon DynamoDB 等服务，也能到达 AWS 托管 VPN 的虚拟私有网关（Virtual Private Gateway, VGW）公共 IP。
English
A Public VIF reaches services outside a VPC, including Amazon S3, SQS, and DynamoDB, as well as public IPs used by AWS-managed VPN endpoints on a VGW.
Transcript
01:26 Moving on,
01:28 so you can access services outside VPC
01:31 like S3, SQS, Dynamo DB,
01:34 and all other public IP addresses.
01:37 Now, if you remember our discussions about the VPN
01:40 for high availability,
01:42 VPN creates two tenants,
01:44 and those two tenants have public IP addresses.
01:47 Now those public IP addresses also falls
01:49 into the category of the public IP addresses
01:52 that you can access over the public VIF.
01:55 Now, why we are talking about this at this moment,
01:57 because later we'll see,
01:59 how can you create the VPN or a Direct Connect.
02:03 And that's an important architecture
02:04 that we we'll discuss later,
02:06 but ideally is that
02:08 all public IPS are accessible over the public VIF.
5. 使用 /30 CIDR 建立 BGP 对等
时间范围：02:12–02:46
总结 / Summary
中文
创建 IPv4 Public VIF 时，客户通常要提供自有的 /30 无类别域间路由（Classless Inter-Domain Routing, CIDR）公共地址块，为 AWS 路由器和客户路由器建立边界网关协议（Border Gateway Protocol, BGP）对等。
English
For an IPv4 Public VIF, the customer normally supplies a customer-owned public /30 CIDR so the AWS and customer routers can establish BGP peering.
Transcript
02:12 Now in order to create a public VIF,
02:15 you need to provide the IPv4 addresses
02:18 so that there is a BGP peering happening
02:22 between AWS router and your side of the router.
02:25 Now for that, AWS expects you to provide /30 CIDR
02:28 of the public IP addresses.
02:31 Now, ideally this public IP addresses
02:33 should be owned by you if you are providing that CIDR,
02:37 and if you do not have those public IP addresses
02:39 for BGP peering,
02:40 then you can request AWS
02:42 to provide those CIDR IP addresses.
6. 由 AWS 提供 /31 对等地址
时间范围：02:46–03:04
总结 / Summary
中文
若客户没有自有公共对等地址，可提交支持请求，由 AWS 提供 /31 CIDR；其中一个地址分配给 AWS 路由器，另一个分配给客户路由器。
English
If the customer lacks public peering addresses, an AWS support request can provide a /31 CIDR, with one address for the AWS router and the other for the customer router.
Transcript
02:46 So in case of you don't have it,
02:48 then ask to AWS
02:50 and then AWS will provide you those public IP addresses
02:53 in the range of /31 range.
02:55 So one IP will be allocated to AWS side of the router
02:58 and the other IP will be allocated
03:00 to your customer router.
7. 发布客户 IPv4 前缀
时间范围：03:04–03:34
总结 / Summary
中文
客户还要指定希望通过 Public VIF 发布的 IPv4 地址前缀（IPv4 address prefix），以便 AWS 把返回流量路由到客户网络。
English
The customer must also specify the IPv4 address prefixes to advertise through the Public VIF so AWS can route return traffic to the customer network.
Transcript
03:04 Also, as you know, when you create public VIF,
03:07 you also need to provide the IP for address prefixes
03:10 that you want to advertise.
03:12 And we briefly touched upon that
03:13 in the last lecture as well.
03:13 This is how AWS knows your IP ranges on your site,
03:19 and then it can route the traffic
03:21 for the destination addresses
03:23 wire that public VIF.
03:26 When you provide this IP for public addresses prefixes,
03:30 AWS verifies that you own those IP address prefixes,
8. AWS 验证前缀所有权
时间范围：03:34–04:00
总结 / Summary
中文
AWS 会验证客户是否拥有或获授权发布这些公共 IP 前缀，避免错误或恶意发布他人地址导致流量被错误引流。
English
AWS verifies that the customer owns or is authorized to advertise the public prefixes, preventing accidental or malicious diversion of traffic for someone else's addresses.
Transcript
03:34 because it is possible
03:36 that you just advertise any random
03:37 public IP4 address prefixes,
03:40 which could be belonging to some other customers
03:43 and in that case, AWS will think that it's your address
03:46 and it will route all the traffic to your prior public VIF.
03:50 And that's not really the right way to do that.
03:53 So AWS verifies that you have authority
03:57 to advertise those prefixes.
9. AWS 路由发布规则导入
时间范围：04:00–04:02
总结 / Summary
中文
接下来关注 Public VIF 的反向路由发布：AWS 也会在同一边界网关协议（Border Gateway Protocol, BGP）会话中向客户发布公共前缀。
English
The next topic is reverse route advertisement: AWS also advertises public prefixes to the customer over the same BGP session.
Transcript
04:00 Now, moving on
10. AWS 发布 Amazon 公共前缀
时间范围：04:02–04:27
总结 / Summary
中文
AWS 通过 BGP 会话发布 Amazon 拥有的公共前缀，包括 Amazon EC2、Amazon S3 和 Amazon.com 等服务的地址。
English
AWS advertises Amazon-owned public prefixes over the BGP session, including addresses for services such as Amazon EC2, Amazon S3, and Amazon.com.
Transcript
04:02 AWS also advertises all Amazon prefixes
04:05 or the BGP session.
04:06 So the route exchange always happens
04:08 from both the in that means you provide your prefixes
04:11 and AWS will also provide or advertise its own prefixes
04:16 for all public IP ranges.
04:18 Now these include the prefixes
04:19 for services like EC2, S3
04:21 and including Amazon.com public IP addresses.
11. 不发布非 Amazon 前缀
时间范围：04:27–04:35
总结 / Summary
中文
Public VIF 只接收 Amazon 所有的前缀，不会由 AWS 发布非 Amazon 前缀，因此它不是通用互联网（Internet）传输连接。
English
A Public VIF receives only Amazon-owned prefixes; AWS does not advertise non-Amazon prefixes, so the VIF is not a general Internet transit connection.
Transcript
04:27 So AWS won't advertise the non Amazon prefixes.
04:30 That means all these prefixes will be owned by AWS.
12. 使用 ip-ranges.json 筛选路由
时间范围：04:35–05:21
总结 / Summary
中文
若只允许访问特定区域（Region）的 AWS 公共服务，可根据 ip-ranges.json 提取目标前缀，并在客户防火墙（firewall）中仅将这些地址列入允许列表（allowlist）。
English
To allow AWS public services only in selected Regions, extract the relevant prefixes from ip-ranges.json and allowlist only those addresses at the customer firewall.
Transcript
04:35 Now, we talked about the ip-rangesjson
04:38 and this is where it is applicable.
04:40 Now, suppose that through public VIF,
04:42 you only want to allow the communication
04:45 between on-premise data center
04:47 and AWS particular regional leap.
04:50 You don't want your on-premise data center
04:52 to access services from a remote region.
04:56 Now, as you know,
04:57 public VIF will provide access
04:58 to all public IP across the globe,
05:00 but then how do you restrict that access?
05:02 Now in this case, what you should do is
05:04 you should look at the ip-ranges.json
05:06 and filter out the IP ranges only for the region
05:09 you are interested in.
05:11 And then at your firewall,
05:12 you should only whitelist
05:14 those IP address ranges from the ip-ranges.json.
05:17 And this is where you can now filter
05:19 the traffic accordingly.
13. 客户路由器实施前缀限制
时间范围：05:21–05:30
总结 / Summary
中文
客户路由器的防火墙（firewall）可依据接收的 Amazon 前缀，对往返特定服务或区域的访问实施限制。
English
The firewall at the customer router can use the received Amazon prefixes to restrict traffic to and from selected services or Regions.
Transcript
05:21 Now at customer router firewall,
05:23 you can then restrict access to
05:25 and from specific Amazon prefixes.
14. 每个 BGP 会话最多 1000 条路由
时间范围：05:30–06:36
总结 / Summary
中文
客户向 AWS 发布的路由前缀每个 BGP 会话最多 1000 条，超限可能导致会话或路由异常；可使用路由汇总（route aggregation）合并连续前缀以控制数量。
English
A customer can advertise at most 1,000 route prefixes to AWS per BGP session. Exceeding the limit can disrupt routing or the session, so contiguous prefixes should be aggregated when possible.
Transcript
05:30 So one thing to understand is that
05:32 or to remember is that from customer router (indistinct)
05:36 when you publish or advertise your BGP routes,
05:39 maximum you can advertise 1000 routes
05:42 and that's a hard limit,
05:44 which means that if you send
05:47 or advertise more than 1000 routes from your end,
05:50 then it is possible that AWS route table
05:52 might not be able to cope up with that
05:54 and there is some problem with the BGP session.
05:58 BGP session may also go down
06:01 and in some cases routing may not happen appropriately.
06:04 So that's the limit you need to understand.
06:07 This is one important point with respect to your exam
06:10 so remember that in case of public VIF,
06:12 1000 prefixes from on-premise network.
06:18 Now, sometimes if you have more than 1000 prefixes,
06:17 then what you can do is,
06:18 you can aggregate those prefixes as one.
06:20 So for example, if there are two /28 prefixes
06:24 with the same base CIDR,
06:26 then maybe you can combine two /27 prefixes.
06:30 So all those things you can do at your end,
06:32 but make sure it does not cross 1000 limit.
15. Public VIF 创建演示
时间范围：06:36–06:49
总结 / Summary
中文
本节进入 AWS 管理控制台（AWS Management Console），演示创建 Public VIF 所需的主要参数。
English
The lecture now moves into the AWS Management Console to demonstrate the principal parameters required to create a Public VIF.
Transcript
06:36 So now let's look at the public VIF creation, walkthrough,
06:40 what all parameters it takes,
06:42 and then we will move to the private VIF as well.
06:46 So let me get back to the console.
16. 打开 Direct Connect 控制台
时间范围：06:49–06:53
总结 / Summary
中文
在 AWS Direct Connect 控制台中，从已有专用连接（dedicated connection）开始配置虚拟接口（Virtual Interface, VIF）。
English
The walkthrough begins in the AWS Direct Connect console, using an existing dedicated connection as the basis for the virtual interface.
Transcript
06:49 So I'm into my Direct Connect console
06:51 and now, as you know,
17. 检查现有 Connection
时间范围：06:53–07:03
总结 / Summary
中文
演示连接（connection）显示为 down，因为实验环境并没有真实 Direct Connect 物理链路；这不影响查看创建流程。
English
The demonstration connection is down because the lab has no physical Direct Connect circuit, but the configuration workflow can still be inspected.
Transcript
06:53 we already had one connection,
06:54 which is in downstate
06:56 because of course there is no connectivity
06:58 at the Direct Connect location.
07:01 Now we'll go to the virtual interfaces,
18. 进入 Virtual interfaces
时间范围：07:03–07:09
总结 / Summary
中文
进入虚拟接口（Virtual interfaces）页面；当前尚无 VIF，因此选择创建虚拟接口。
English
The walkthrough opens the Virtual interfaces page; because no VIF exists yet, it proceeds to create one.
Transcript
07:03 so far I do not have any virtual interface
07:06 so let's create the one.
19. 选择 Public Virtual Interface
时间范围：07:09–07:15
总结 / Summary
中文
在虚拟接口类型（virtual interface type）中选择公共（Public），开始填写 Public VIF 设置。
English
The Public option is selected as the virtual interface type, exposing the settings for a Public VIF.
Transcript
07:09 And in this case I will create public virtual interface
07:11 and of course you need to give some names,
20. 填写 VIF 名称
时间范围：07:15–07:20
总结 / Summary
中文
首先为虚拟接口命名，例如 myPublicVIF，便于在 Direct Connect 控制台中识别。
English
The virtual interface is first given a descriptive name, such as myPublicVIF, so it can be identified in the Direct Connect console.
Transcript
07:15 say my public VIF
07:17 and which connection on top of it
07:19 you want to create this VIF
21. 关联 Direct Connect Connection
时间范围：07:20–07:38
总结 / Summary
中文
从下拉列表选择承载该 Public VIF 的 Direct Connect 连接（connection）。
English
The Direct Connect connection that will carry the Public VIF is selected from the list.
Transcript
07:20 so I can select my connection.
07:24 Now, as you know, you have to provide the account ID,
07:27 whether my account ID or another account ID,
07:29 and in that case, it will be a whole state VIF
07:31 that means another account would have to accept
07:35 the VIF request in that account,
22. 指定 Virtual Interface Owner
时间范围：07:38–07:41
总结 / Summary
中文
虚拟接口所有者（virtual interface owner）可选择当前 AWS 账户或其他账户；若选择其他账户，会形成需由对方接受的托管虚拟接口（hosted VIF）。
English
The virtual interface owner can be the current or another AWS account; choosing another account creates a hosted VIF that the recipient must accept.
Transcript
07:38 but in this case, it's my own AWS account.
23. 设置 VLAN
时间范围：07:41–07:44
总结 / Summary
中文
配置虚拟局域网标识（Virtual LAN identifier, VLAN ID），示例使用 VLAN 100，以便在物理 Direct Connect 链路上区分该 VIF 的流量。
English
A Virtual LAN identifier (VLAN ID), such as VLAN 100, separates this VIF's traffic on the physical Direct Connect circuit.
Transcript
07:41 Now the VLAN tag, I can say a 100.
24. 设置 BGP ASN
时间范围：07:44–07:54
总结 / Summary
中文
填写客户路由器的边界网关协议自治系统编号（Border Gateway Protocol Autonomous System Number, BGP ASN）；可根据适用规则使用公共或私有 ASN。
English
The customer router's BGP Autonomous System Number (ASN) is entered; a public or private ASN may be used according to the applicable rules.
Transcript
07:44 BGP ASN, now this could be a public or private,
07:47 now, if it's a private,
07:48 I can give something like
07:49 any number in the range of what number you see here.
07:53 And then address family
25. 选择 Address Family
时间范围：07:54–07:58
总结 / Summary
中文
地址族（address family）决定 BGP 对等使用 IPv4 还是 IPv6；演示选择 IPv4。
English
The address family determines whether BGP peering uses IPv4 or IPv6; the walkthrough selects IPv4.
Transcript
07:54 as of now, we are dealing with only IPV4 addresses
26. 配置 BGP Peer IP
时间范围：07:58–08:27
总结 / Summary
中文
在 BGP 对等 IP（BGP peer IP）字段填写客户路由器与 Amazon 路由器地址；自有地址通常来自 /30 CIDR，没有地址时可向 AWS 申请 /31 CIDR。
English
The customer and Amazon router peer IPs are entered here. Customer-owned addresses normally come from a /30 CIDR; otherwise AWS can supply a /31 CIDR.
Transcript
07:58 and for BGP peer IPs, as you know,
08:00 you have deployed public IP ranges here
08:02 in the /30 CIDR range.
08:05 Now we don't have these IP addresses
08:07 that's why we can provide this,
08:09 but if you have it,
08:11 you can provide that IP ranges here.
08:13 If not, you can submit a ticket to AWS,
08:16 and then AWS will grant you /31 public IP addresses.
08:21 Note of which, one IP
08:22 you can keep to your router
08:23 and another IP you can give to AWS side of the router.
27. 填写要发布的 Prefixes
时间范围：08:27–08:42
总结 / Summary
中文
在要发布的前缀（prefixes to advertise）中列出客户公共网段。BGP 会话上限为 1000 条，但该控制台界面一次最多输入 100 条。
English
Customer public networks are entered under prefixes to advertise. The BGP session limit is 1,000 prefixes, while this console form accepts up to 100 entries.
Transcript
08:27 And finally,
08:28 the prefixes that you want to advertise
08:30 as you know that it should be maximum 1000
08:33 or over a BGP session,
08:35 but in this UI, you can only provide
08:37 a 100 prefixes as of now.
08:39 So that the setting that public VIF takes,
28. BGP Authentication Key 与提交
时间范围：08:42–09:19
总结 / Summary
中文
可自定义 BGP 身份验证密钥（BGP authentication key）；若留空，AWS 会生成随机密钥并写入可导出的路由器配置。完成必填项后即可创建虚拟接口。
English
A custom BGP authentication key can be supplied; if omitted, AWS generates one and includes it in the exported router configuration. The VIF can then be created after completing required fields.
Transcript
08:42 and additionally,
08:45 you can also have the BGP authentication key.
08:48 As I said, you can put your own authentication key,
08:51 and if you are not providing it,
08:53 then AWS will generate that authentication key
08:55 and then it will just put that in the configurations
08:59 and when you export this configurations
09:01 you will see the randomly generated authentication key.
09:05 So essentially those are the parameters it takes
09:08 for creating the public VIF.
09:09 Now, we don't have those IP addresses,
09:11 so we can't really create,
09:13 but essentially you should be able to do it
09:15 if you are willing to set this in the real world.
29. 创建流程回顾
时间范围：09:19–09:29
总结 / Summary
中文
演示环境缺少真实公共对等地址，因此未提交创建；重点是理解 Public VIF 类型、连接、所有者、VLAN、BGP ASN、对等地址和发布前缀等参数。
English
The demo is not submitted because the lab lacks real public peering addresses; the key takeaway is the set of parameters: VIF type, connection, owner, VLAN, BGP ASN, peer IPs, and advertised prefixes.
Transcript
09:19 So that's it about this lecture,
09:21 just remember few things which are very important
09:25 with respect to the public VIF.
09:26 While other things are also important,
09:28 but just three things.
30. Remember：Public VIF 三项要点
时间范围：09:29–10:01
总结 / Summary
中文
记住三点：Public VIF 可访问全球 AWS 公共 IP；IPv4 对等通常需要客户提供 /30 CIDR，或由 AWS 提供 /31；客户路由器每个 BGP 会话向 AWS 最多发布 1000 条路由前缀。
English
Remember three facts: a Public VIF reaches AWS public IPs globally; IPv4 peering normally uses a customer /30 or an AWS-provided /31; and the customer may advertise at most 1,000 routes per BGP session.
Transcript
09:29 Remember that public VIF enables your network
09:31 to connect to all AWS public IP is globally.
09:34 And then in order to create a public VIF BGP session,
09:38 you need to provide the public IP ranges
09:40 in the range of /30 CIDR,
09:42 if you don't have it, ask AWS to provide that.
09:45 And third from customer router into AWS,
09:48 maximum 1000 route prefixes can be advertised,
09:51 you cannot advertise more than that.
09:53 So that's it about the public VIF
09:56 and now let's get into the private VIF.
09:59 Thanks for watching.
整讲总结 / Overall Summary
中文
Public VIF 通过 AWS Direct Connect 提供到全球 AWS 公共端点的专用访问，但不承载非 Amazon 互联网路由。双方通过边界网关协议（Border Gateway Protocol, BGP）交换前缀：AWS 发布 Amazon 公共地址，客户发布经所有权验证的公共前缀。IPv4 对等通常使用客户 /30 CIDR 或 AWS 提供的 /31 CIDR；客户每个 BGP 会话最多向 AWS 发布 1000 条前缀，并可结合 ip-ranges.json 与防火墙（firewall）限制访问范围。
English
A Public VIF provides dedicated Direct Connect access to AWS public endpoints worldwide, but it does not carry non-Amazon Internet routes. AWS and the customer exchange prefixes over BGP: AWS advertises Amazon public ranges, while the customer advertises verified public prefixes. IPv4 peering normally uses a customer /30 CIDR or an AWS-provided /31 CIDR, and the customer may advertise at most 1,000 prefixes per BGP session. ip-ranges.json and firewall policy can further restrict the reachable AWS services and Regions.
返回顶部 ↑