Lecture 128: Direct Connect with Transit VIF and TGW
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：08:59
- 来源：Udemy Lecture 27896668
- Slide 数量：33
- 画面切换：00:14、00:25、00:31、00:38、00:41、01:05、01:09、01:13、01:31、01:42、02:40、03:01、03:11、03:27、03:30、03:36、03:58、04:07、04:21、04:28、05:27、05:37、05:50、05:54、06:01、06:10、06:15、06:36、06:48、06:55、07:05、07:55
扫描说明
逐条检查了 Udemy 页面中的 171 条 Transcript cue，并以每条 cue 对应画面扫描了全长约 8:59 的视频。依据幻灯片切换、拓扑组件渐显、路由标注、账户边界和总结页，共划分为 33 个小节。正式截图均在锁定 Lecture 27896668、Autoplay 关闭、关闭 Transcript 与课程侧栏、视频播放且播放器控件隐藏后，按完整媒体边界截取并输出为 1364×770；逐张复核了右侧、底部和左侧边界。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. DXGW、Transit VIF 与 TGW
时间范围：00:00–00:14
总结 / Summary
中文
本讲介绍 Direct Connect 网关（Direct Connect Gateway, DXGW）、传输虚拟接口（Transit Virtual Interface, Transit VIF）与传输网关（Transit Gateway, TGW）组合后的架构模式。
English
This lecture introduces architectural patterns that combine a Direct Connect Gateway, a Transit VIF, and Transit Gateways.
Transcript
00:00 Hi.
00:01 Now, in this lecture, let's look at the
00:04 DX Gateway with Transit VIF and with Transit gateways.
00:08 And let's look at the architectures that you can
00:10 build when you use these three components together.
00:13 So
2. 从 Direct Connect 连接开始
时间范围：00:14–00:25
总结 / Summary
中文
架构首先需要一条 Direct Connect 连接（Direct Connect Connection），可以是专用连接（Dedicated Connection）或托管连接（Hosted Connection）。
English
The architecture starts with either a Dedicated or Hosted Direct Connect connection.
Transcript
00:14 very first thing you know that you should have a DX connection
00:19 and it can be a Dedicated connection or a Hosted connection.
00:23 And once you have that connection,
3. 创建 Transit VIF
时间范围：00:25–00:31
总结 / Summary
中文
在 Direct Connect 连接上创建传输虚拟接口（Transit VIF），并将它附加到 Direct Connect 网关（Direct Connect Gateway, DXGW）。
English
Create a Transit VIF on the Direct Connect connection and attach it to a DXGW.
Transcript
00:25 you should create a Transit VIF and then you attach it to the DX Gateway.
4. 关联 Direct Connect Gateway
时间范围：00:31–00:38
总结 / Summary
中文
传输虚拟接口（Transit VIF）终止在 Direct Connect 网关（Direct Connect Gateway, DXGW），由 DXGW 提供跨区域的连接入口。
English
The Transit VIF terminates on the DXGW, which provides the global connectivity layer.
Transcript
00:31 And then this DX Gateway can be associated
00:34 with a Transit Gateway in a particular Region.
5. DXGW 关联 Transit Gateway
时间范围：00:38–00:41
总结 / Summary
中文
Direct Connect 网关（Direct Connect Gateway, DXGW）进一步关联特定区域中的传输网关（Transit Gateway, TGW）。
English
The DXGW is then associated with a Transit Gateway in a specific AWS Region.
Transcript
00:38 And this Transit Gateway further connects to
6. TGW 连接多个 VPC
时间范围：00:41–01:05
总结 / Summary
中文
传输网关（Transit Gateway, TGW）连接区域内的多个虚拟私有云（Virtual Private Cloud, VPC），形成 Direct Connect—Transit VIF—DXGW—TGW—VPC 的标准路径。
English
The TGW connects multiple VPCs, completing the standard Direct Connect–Transit VIF–DXGW–TGW–VPC path.
Transcript
00:41 multiple VPCs.
00:42 So this is a fairly standard architecture
00:45 with Transit VIF
00:47 and DX Gateway and Transit Gateway.
00:50 However, you can further scale this architecture
00:53 because you can create multiple Transit VIFs and also a single DX Gateway
00:59 you can attach to multiple Transit gateways.
01:02 So let's look at those architectures.
7. 多个 Transit VIF
时间范围：01:05–01:09
总结 / Summary
中文
一条 Direct Connect 连接（Direct Connect Connection）可通过多个传输虚拟接口（Transit VIF）扩展到多个 Direct Connect 网关（Direct Connect Gateway, DXGW）。
English
A Direct Connect connection can scale to multiple DXGWs through multiple Transit VIFs.
Transcript
01:05 So as of today,
01:06 on a single Dedicated DX connection,
8. Dedicated Connection 的 4 个 Transit VIF
时间范围：01:09–01:13
总结 / Summary
中文
课程录制时，每条专用 Direct Connect 连接（Dedicated Direct Connect Connection）最多可创建 4 个传输虚拟接口（Transit VIF）。
English
At recording time, one Dedicated Direct Connect connection supported up to four Transit VIFs.
Transcript
01:09 you can create up to
01:11 four Transit VIFs. So
9. 四个 DXGW 共用一条 Dedicated Connection
时间范围：01:13–01:31
总结 / Summary
中文
4 个传输虚拟接口（Transit VIF）可分别连接 4 个 Direct Connect 网关（Direct Connect Gateway, DXGW），共同使用同一条专用连接（Dedicated Connection）。
English
Four Transit VIFs can attach four separate DXGWs to the same Dedicated Connection.
Transcript
01:13 you can connect
01:15 four DX gateways
01:17 to a same DX connection
01:19 using four Transit VIFs.
01:21 And you know that a single DX Gateway
01:24 can further be then connected to multiple Transit gateways
01:28 in the same or different AWS regions.
10. 多个 Transit VIF 的完整拓扑
时间范围：01:31–01:42
总结 / Summary
中文
每个 Direct Connect 网关（Direct Connect Gateway, DXGW）可再关联多个区域的传输网关（Transit Gateway, TGW）及其虚拟私有云（Virtual Private Cloud, VPC）。
English
Each DXGW can in turn associate with Regional TGWs and their connected VPCs.
Transcript
01:31 So architecture will look something like this.
01:35 Now,
01:35 with respect to how many Transit gateways you can connect to a single DX Gateway.
01:40 So again, as of today,
11. 一个 DXGW 最多关联 6 个 TGW
时间范围：01:42–02:40
总结 / Summary
中文
课程录制时，单个 Direct Connect 网关（Direct Connect Gateway, DXGW）最多可关联 6 个传输网关（Transit Gateway, TGW）。结合每条专用连接（Dedicated Connection）的 4 个 Transit VIF，理论上可连接 24 个区域级 TGW；应查阅最新 AWS 配额。
English
At recording time, one DXGW could associate with six TGWs; combined with four Transit VIFs per Dedicated Connection, that allowed up to 24 Regional TGWs. Current AWS quotas should always be checked.
Transcript
01:42 there is a limit of six Transit gateways.
01:45 And with that,
01:47 now if you make your calculation
01:50 on a single Dedicated connection, you can create four Transit VIFs.
01:55 Every Transit VIF will connect to a one direct connect Gateway
01:59 and one direct connect Gateway can connect up
02:01 to six Transit gateways across different regions.
02:05 So four into six, that is 24. So you can connect
02:10 up to 24 Transit gateways in different AWS Region.
02:16 So with that, you can connect to almost 24 AWS Region on a single DX connection
02:22 and that gives you
02:23 kind of Global network in AWS world.
02:27 So again, these are the limits which
02:29 are currently applied and these limits will always change.
02:33 So refer to AWS documentation.
02:36 Whenever you are designing your architecture
12. 每个 TGW 通告 200 条路由
时间范围：02:40–03:01
总结 / Summary
中文
每个传输网关（Transit Gateway, TGW）可向本地网络（on-premises network）通告最多 200 条路由；路由数量较多时应使用路由聚合（route aggregation）。
English
Each TGW may advertise up to 200 routes toward on premises; route aggregation should be used when many prefixes are present.
Transcript
02:40 with respect to the routes, you can advertise up to 200 routes per
02:45 Transit Gateway
02:46 towards the
02:47 on
02:48 premise
02:48 network. Again, these numbers need not be remembered.
02:52 But if you are advertising many more routes than that,
02:56 then you should aggregate your routes.
13. AWS 账户所有权概览
时间范围：03:01–03:11
总结 / Summary
中文
传输虚拟接口（Transit VIF）架构的账户规则与私有虚拟接口（Private VIF）类似，但仍允许连接、TGW 和 VPC 分布在不同账户。
English
Transit VIF ownership rules resemble Private VIF rules while still allowing connections, TGWs, and VPCs across different accounts.
Transcript
03:01 With respect to the AWS account ownership. Similar rule applies as the private VIF
03:06 which means that your direct connect connection can be owned by
14. 账户所有权规则
时间范围：03:11–03:27
总结 / Summary
中文
传输虚拟接口（Transit VIF）与 Direct Connect 网关（Direct Connect Gateway, DXGW）必须由同一个 AWS 账户拥有；传输网关（Transit Gateway, TGW）可由其他账户拥有。
English
The Transit VIF and DXGW must be owned by the same AWS account, while TGWs may be owned by different accounts.
Transcript
03:11 a account
03:12 which is your account or it could be a Hosted connection.
03:16 In that case, your DX partner has the account,
03:19 but the connection is provision into your account.
03:21 So anyone can
03:23 have that
03:24 AWS
03:24 account.
03:25 But when you create a
15. Direct Connect 连接账户
时间范围：03:27–03:30
总结 / Summary
中文
底层 Direct Connect 连接（Direct Connect Connection）可以位于客户账户，也可以由合作伙伴通过托管连接（Hosted Connection）提供。
English
The underlying Direct Connect connection may be customer-owned or provisioned through a partner-hosted connection.
Transcript
03:27 Transit VIF or a DX Gateway,
16. Transit VIF 与 DXGW 同账户
时间范围：03:30–03:36
总结 / Summary
中文
图中的同一 AWS 账户（Same AWS Account）边界明确包围传输虚拟接口（Transit VIF）和 Direct Connect 网关（Direct Connect Gateway, DXGW）。
English
The Same AWS Account boundary explicitly contains both the Transit VIF and the DXGW.
Transcript
03:30 this should be a part of the same AWS account.
03:33 Now, this account can be same as the account one,
17. 连接可来自另一账户
时间范围：03:36–03:58
总结 / Summary
中文
Direct Connect 连接（Direct Connect Connection）可以位于另一个 AWS 账户，而传输虚拟接口（Transit VIF）与 Direct Connect 网关（Direct Connect Gateway, DXGW）仍必须同账户。
English
The Direct Connect connection may reside in another AWS account, while the Transit VIF and DXGW remain co-owned.
Transcript
03:36 but it can be also a different AWS account. But the point here is that
03:40 both the Transit VIF and DX Gateway should be part of the same AWS account.
03:46 And then on the left side, you have Transit gateways and the VPCs
03:51 again,
03:51 Transit Gateway can be in different AWS account
03:54 and even these VPCs can be in different AWS account.
18. TGW 与 VPC 可跨多个账户
时间范围：03:58–04:07
总结 / Summary
中文
传输网关（Transit Gateway, TGW）与虚拟私有云（Virtual Private Cloud, VPC）可分布在第三个或更多 AWS 账户中，支持灵活的多账户网络。
English
TGWs and VPCs may be distributed across a third or additional AWS accounts, enabling flexible multi-account networking.
Transcript
03:58 So in true sense,
03:59 you get a flexibility to have multi accounts
04:02 set up with respect to the network connectivity.
04:06 OK. Moving on.
19. 架构模式概览
时间范围：04:07–04:21
总结 / Summary
中文
接下来比较本地网络（on-premises network）到 VPC、跨区域 VPC 以及客户站点之间的路由模式。
English
The next patterns compare on-premises-to-VPC, cross-Region VPC, and customer-site routing.
Transcript
04:07 So now with Direct Connect Gateway and Transit Gateway,
04:12 let's look at how you can build architecture
04:15 to have a connective between on
04:16 premise
04:17 network and VPCs and also inter VPC communication.
20. VPC 与本地网络基础拓扑
时间范围：04:21–04:28
总结 / Summary
中文
两个区域的传输网关（Transit Gateway, TGW）通过同一 Direct Connect 网关（Direct Connect Gateway, DXGW）连接企业数据中心。
English
TGWs in two Regions connect to a corporate data center through the same DXGW.
Transcript
04:21 So this is the same architecture that we have been seeing
04:24 and you get a full Routing between the VPCs and
21. VPC 与本地网络完整路由
时间范围：04:28–05:27
总结 / Summary
中文
该架构在虚拟私有云（Virtual Private Cloud, VPC）与本地网络（on-premises network）之间提供完整路由。传输网关（Transit Gateway, TGW）按 GB 收取数据处理费，只应在确有区域级路由需求时使用。
English
The design provides full routing between VPCs and on premises. Because TGWs add per-GB data-processing charges, they should be used only when their Regional routing capabilities are needed.
Transcript
04:28 on-premises
04:28 network. Now this was also true when you were not using the Transit Gateway
04:34 and you were just using the Direct Connect Gateway,
04:37 attaching it to the VPC virtual private gateways
04:41 and similar connectivity you get with the Transit gateways.
04:46 However, I would like to mention one thing here is that
04:49 Transit Gateway has additional charge,
04:52 they have the charge of per GB data processed.
04:55 So if you don't need Transit Gateway don't use it.
04:59 But it is recommended for the large enterprises where
05:03 there are hundreds and thousands of the VPCs
05:06 and you have the true Hybrid connectivity.
05:09 OK. Coming back to the topic. So you have full connectivity between VPCs and
05:15 on-premises network.
05:17 But Transit gateways being the regional router,
05:20 you still don't have the connectivity between VPCs across these regions, right?
22. 同 Region VPC 可经 TGW 通信
时间范围：05:27–05:37
总结 / Summary
中文
同一区域中的虚拟私有云（Virtual Private Cloud, VPC）可通过传输网关（Transit Gateway, TGW）相互通信，同时也能访问本地网络（on-premises network）。
English
VPCs within the same Region can communicate through their TGW while also reaching on premises.
Transcript
05:27 So Routing between VPCs and
05:29 on-premises network is possible. VPCs
05:32 within the same Region now can communicate because Transit Gateway can allow that.
23. DXGW 不提供跨 Region VPC 传输
时间范围：05:37–05:50
总结 / Summary
中文
Direct Connect 网关（Direct Connect Gateway, DXGW）不是传递式路由器，因此不能单独为不同区域的虚拟私有云（Virtual Private Cloud, VPC）提供互通。
English
A DXGW is not transitive, so it cannot by itself provide VPC-to-VPC routing across Regions.
Transcript
05:37 But if you see the Routing between the VPCs across the Region is not possible,
05:42 because DX gateways are not transitive in nature.
05:47 So how do you solve this problem?
05:48 Now, in this architecture,
24. 跨 Region 路由被阻止
时间范围：05:50–05:54
总结 / Summary
中文
红色叉号直观显示跨区域 VPC 流量不能通过 Direct Connect 网关（Direct Connect Gateway, DXGW）中转。
English
The red X shows that cross-Region VPC traffic cannot transit through the DXGW.
Transcript
05:50 you can simply just add the Peering
25. 添加 TGW Peering
时间范围：05:54–06:01
总结 / Summary
中文
通过在不同区域的传输网关（Transit Gateway, TGW）之间建立对等连接（TGW Peering），可绕过 DXGW 的非传递式限制。
English
Peering the TGWs across Regions overcomes the DXGW's non-transitive limitation.
Transcript
05:54 between the Transit gateways across AWS regions.
05:57 And now these VPCs
05:59 across Region can communicate with each other.
26. 跨 Region VPC 完整互通
时间范围：06:01–06:10
总结 / Summary
中文
传输网关对等连接（Transit Gateway Peering）启用跨区域 VPC 路由，同时保留虚拟私有云（Virtual Private Cloud, VPC）到本地网络（on-premises network）的完整连接。
English
TGW Peering enables cross-Region VPC routing while preserving full VPC-to-on-premises connectivity.
Transcript
06:01 So you can very well do this thing.
06:04 So full Routing between VPCs and on-premises
06:07 network and also Routing between
06:09 inter VPCs.
27. 客户站点间路由问题
时间范围：06:10–06:15
总结 / Summary
中文
下一问题是多个客户站点（customer site）能否通过同一 Direct Connect 网关（Direct Connect Gateway, DXGW）互相通信。
English
The next question is whether multiple customer sites can communicate through the same DXGW.
Transcript
06:10 But how about the Routing between the customer sites?
28. 两个客户站点连接同一 DXGW
时间范围：06:15–06:36
总结 / Summary
中文
两个客户站点（customer site）分别通过 Direct Connect 位置、传输虚拟接口（Transit VIF）和同一个 Direct Connect 网关（Direct Connect Gateway, DXGW）连接 AWS。
English
Two customer sites connect to AWS through separate Direct Connect locations and Transit VIFs but share one DXGW.
Transcript
06:15 And we had seen similar pattern when
06:18 we were connecting DX Gateway directly to the VPCs.
06:22 And we know that this
06:24 kind of connectivity is not possible where site
06:28 A wants to communicate with the side B.
06:31 But now because we have Transit Gateway Peering in place,
06:34 do you think this routing is possible?
29. 同一 DXGW 下站点间路由仍不可用
时间范围：06:36–06:48
总结 / Summary
中文
即使区域传输网关（Transit Gateway, TGW）已经对等连接，两个站点共用同一个 Direct Connect 网关（Direct Connect Gateway, DXGW）时仍不能经由它互通。
English
Even with TGW Peering, sites that share one DXGW still cannot route traffic to each other through it.
Transcript
06:36 So the answer is no, even if these Transit gateways are peered,
06:41 but because they are connected to the same DX Gateway,
06:44 this Routing is not possible between the sites.
30. 站点间路由被拒绝
时间范围：06:48–06:55
总结 / Summary
中文
红色叉号强调 Direct Connect 网关（Direct Connect Gateway, DXGW）不提供客户站点到客户站点（site-to-site）的传输路由。
English
The red X emphasizes that the DXGW does not provide customer-site-to-customer-site transit.
Transcript
06:48 And for that, you have to do exactly the same thing.
06:51 You have to have multiple DX gateways,
31. 为每个站点使用独立 DXGW
时间范围：06:55–07:05
总结 / Summary
中文
解决方案是让每个客户站点（customer site）使用独立的 Direct Connect 网关（Direct Connect Gateway, DXGW），并保留区域间传输网关对等连接（Transit Gateway Peering）。
English
The solution is to give each customer site a separate DXGW while retaining TGW Peering between Regions.
Transcript
06:55 something like this.
06:57 And you should also have the Transit Gateway Peering.
07:01 And now there is a connectivity between Site-to-Site
32. 通过 TGW Peering 实现 Site-to-Site
时间范围：07:05–07:55
总结 / Summary
中文
使用多个 Direct Connect 网关（Direct Connect Gateway, DXGW）后，站点间流量可经传输网关对等连接（Transit Gateway Peering）转发，实现 VPC、本地网络和站点间的完整连通。新的 Direct Connect SiteLink 可让数据中心流量直接从 DX 位置转发，本讲后续会另行讨论。
English
With separate DXGWs, site-to-site traffic can traverse TGW Peering, providing full VPC, on-premises, and inter-site connectivity. Direct Connect SiteLink offers a newer alternative that forwards between data centers at DX locations.
Transcript
07:05 through this Transit Gateway Peering.
07:07 This is possible.
07:09 So this is an interesting pattern if you
07:11 want to enable the inter site connectivity.
07:14 Now again, this is kind of the pattern until last year, I will say.
07:18 But AWS then launched a new feature called Direct Connect SiteLink
07:25 which enables the connectivity between these data centers
07:29 without
07:30 the traffic going through the direct contact Gateway or a Transit Gateway.
07:34 That means traffic can be routed from the DX location itself.
07:39 So we will also visit those architectures.
07:41 But with respect to the Transit gateways, if you want to have the Site-to-Site
07:46 connectivity, then this is a pattern that you need to follow.
07:51 OK. With that, let's quickly summarize.
33. DXGW + TGW 总结
时间范围：07:55–08:59
总结 / Summary
中文
专用连接（Dedicated Connection）可使用多个传输虚拟接口（Transit VIF），托管连接（Hosted Connection）通常只能创建一个 VIF。传输网关（Transit Gateway, TGW）通过 Direct Connect 网关（Direct Connect Gateway, DXGW）接入，跨区域 VPC 通信依赖 TGW 对等连接（TGW Peering）。所有配额均应以最新 AWS Direct Connect 配额文档为准。
English
Dedicated Connections support multiple Transit VIFs, while Hosted Connections generally support one VIF. TGWs attach through a DXGW, and cross-Region VPC communication relies on TGW Peering. Always verify current AWS Direct Connect quotas.
Transcript
07:55 So if you're using a Transit VIF,
07:57 then there can be four Transit VIFs per DX Dedicated connection.
08:02 And if you're using the Hosted connection, then you can only create one VIF.
08:06 Now that's true even for the public or a private VIF
08:09 that you can only create one VIF on a Hosted connection.
08:14 TGW is associated with the DirectConnect gateways.
08:18 And as of today, you can
08:19 associate up to six Transit gateways to a single direct connect Gateway.
08:25 And for inter VPC communication,
08:27 you can peer the Transit gateways across the Region
08:31 and then you get full connectivity.
08:33 Now, these are the limits as of today that is until September 2023
08:39 and always look at the AWS direct connect quotas
08:42 for the latest limit while you design your architecture.
08:46 So that's it about this lecture.
08:48 Hope you understood the architectural pattern
08:51 that we discussed and going forward,
08:52 we have more architectures to discuss.
08:55 So thanks for watching.
整讲总结 / Overall Summary
中文
传输虚拟接口（Transit VIF）先连接 Direct Connect 网关（Direct Connect Gateway, DXGW），再由 DXGW 关联区域级传输网关（Transit Gateway, TGW）和多个虚拟私有云（Virtual Private Cloud, VPC）。架构可通过多个 Transit VIF、多个 DXGW 和多个 TGW 扩展；录制时每条专用连接最多 4 个 Transit VIF、每个 DXGW 最多 6 个 TGW、每个 TGW 可向本地通告 200 条路由，但这些数字必须以最新 AWS 配额为准。Transit VIF 与 DXGW 必须同账户。跨区域 VPC 互通需要 TGW Peering；客户站点间互通还需要独立 DXGW，或采用 Direct Connect SiteLink。
English
A Transit VIF connects to a Direct Connect Gateway (DXGW), which then associates with Regional Transit Gateways (TGWs) and multiple VPCs. The design scales through multiple Transit VIFs, DXGWs, and TGWs. At recording time, a Dedicated Connection supported four Transit VIFs, one DXGW supported six TGWs, and one TGW could advertise 200 routes, but current AWS quotas must be checked. The Transit VIF and DXGW must share an account. Cross-Region VPC communication requires TGW Peering, and customer-site transit additionally requires separate DXGWs or Direct Connect SiteLink.
返回顶部 ↑