Lecture 130: DX Routing policies and BGP communities
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：10:57
- 来源：Udemy Lecture 27896786
- Slide 数量：32
- 画面切换：01:27、01:59、02:17、02:40、03:24、03:31、03:46、04:06、04:10、04:24、05:49、05:52、06:13、06:20、06:30、06:43、07:09、07:13、07:15、07:22、07:40、07:54、08:30、08:37、08:45、08:55、09:53、09:57、10:03、10:07、10:30
扫描说明
逐条检查了 Udemy 页面中的 183 条 Transcript cue，并扫描了全长约 10:57 的视频。依据标题页、VPC 路由优先级渐显、路由选择示例、DX 路由策略概览及 Public/Private/Transit VIF 的 BGP 属性与社区标签渐显，共划分为 32 个小节。正式截图均在锁定 Lecture 27896786、Autoplay 关闭、关闭 Transcript 与课程侧栏、视频播放且播放器控件隐藏后，按完整媒体边界截取并统一输出为 1364×770；逐张复核了右侧、底部和左侧边界。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Direct Connect 路由策略与 BGP 社区
时间范围：00:00–01:27
总结 / Summary
中文
本讲介绍 Direct Connect（DX）的路由策略（Routing Policies）与边界网关协议社区（BGP Communities），重点说明 VPC 出站路由优先级、多个 DX 路径的选择，以及不同虚拟接口（VIF）适用的控制手段。
English
This lecture introduces Direct Connect routing policies and BGP communities, focusing on VPC egress route priority, path selection across multiple DX links, and the controls available for different VIF types.
Transcript
00:00 Hi.
00:01 Now we are getting into the section where we are going to
00:04 discuss at length how the Routing selection happens at different levels.
00:10 When the traffic goes out from AWS to
00:13 on-premises
00:13 network,
00:14 you know that traffic starts from the VPC
00:17 and then VPC itself has a route table. So it has to make the Routing decision there
00:23 and then the traffic lands into the virtual private Gateway or a
00:27 Transit Gateway depending on how you connect it over the DX connection.
00:31 And then from there traffic goes to
00:34 on-premises
00:34 network.
00:35 Now this DirectConnect Routing policies and BGP communities comes into the play.
00:41 Typically,
00:41 whenever you have multiple DX connections to reach out to different destinations.
00:47 In fact, for highly
00:49 available DX setup, there will be multiple DX links
00:54 between the VPCs and
00:56 on-premises network.
00:57 And at that time, there has to be a route selection whether you want to
01:01 go on a link one or link two.
01:04 Do you want to have it active-active or active-passive?
01:07 And for influencing that Routing decision,
01:11 you need to understand the DirectConnect Routing
01:14 policies and the BGP communities.
01:17 So for your exam again, this is very, very important topic.
01:20 So make sure that you understand every part of this.
01:24 OK. So let's first start with the VPC.
2. VPC 可连接的多种网关
时间范围：01:27–01:59
总结 / Summary
中文
一个虚拟私有云（Virtual Private Cloud, VPC）可同时连接互联网网关（Internet Gateway, IGW）、VPC 对等连接（VPC Peering）、Direct Connect、传输网关（Transit Gateway, TGW）和虚拟专用网络（Virtual Private Network, VPN）；路由表必须在这些候选路径之间做选择。
English
A VPC may connect simultaneously to an IGW, VPC peering, Direct Connect, a Transit Gateway, and VPN, so its route table must choose among several candidate paths.
Transcript
01:27 Now, you know that VPC can be connected to different gateways or the devices,
01:33 it can be connected to IGW
01:35 or to other VPCS using a VPC Peering connection
01:39 or to a DirectConnect or to a VPN through the
01:43 virtual private Gateway or to the Transit gateways.
01:46 Now, when VPC has to make a decision where the traffic will go, then there are certain
01:53 route priorities that AWS has defined.
01:56 And based on that, it will take that decision.
3. 规则一：最长前缀匹配
时间范围：01:59–02:17
总结 / Summary
中文
路由选择的第一原则是最长前缀匹配（Longest Prefix Match）：目标地址匹配位数最多、最具体的路由优先，先于网关类型或路由来源。
English
The first routing rule is longest prefix match: the most specific matching destination route wins before gateway type or route origin is considered.
Transcript
01:59 The very first rule is that longest prefix match first.
02:02 So it always takes the precedence if the target IP address matches
02:08 with the most specific route in the route table.
02:12 So for example, if there is a route for a particular IP address
4. 最长前缀匹配示例
时间范围：02:17–02:40
总结 / Summary
中文
示例中，主机路由 10.10.2.15/32 比 10.10.2.0/24 更具体，因此即使两条路由指向不同连接，/32 路由仍优先。
English
In the example, 10.10.2.15/32 is more specific than 10.10.2.0/24, so the /32 route wins even if the routes use different connections.
Transcript
02:17 and it goes through, for example, internet Gateway,
02:21 then even if there is another route for 10.10.2.0/24
02:28 and you have defined target for that as a VPC Peering connection,
02:32 then the route through the internet Gateway will take precedence because you
02:35 have defined it as the longest prefix which it matches with,
5. 规则二：静态路由优先于传播路由
时间范围：02:40–03:24
总结 / Summary
中文
当前缀长度相同，静态路由（Static Route）优先于传播路由（Propagated Route）。这使显式配置的路径能够覆盖从动态连接自动学习的路径。
English
When prefix lengths are equal, a static route is preferred over a propagated route, allowing explicitly configured paths to override dynamically learned ones.
Transcript
02:40 then comes the static routes as compared to the propagated routes.
02:45 Now, static routes are the one which you go and modify your route table with.
02:49 So you add a route for internet Gateway or a VPC Peering connection
02:53 or for Transit Gateway attachment, all these are static routes.
02:57 Now, with respect to the VPN, you get an option,
03:00 whether you can add a static route or in your route table
03:04 you can have a propagated route.
03:06 In that case,
03:07 your route table is automatically populated with the
03:10 routes which VPN sends towards the VPC.
03:14 And in case of DirectConnect, again,
03:16 it's a propagated route because it only supports the Dynamic Routing.
03:21 OK. So you can see here that the
6. 静态路由来源标记
时间范围：03:24–03:31
总结 / Summary
中文
课程将互联网网关（IGW）、VPC 对等连接（VPC Peering）和传输网关（TGW）相关候选路径标为静态类别，用于说明它们在同前缀比较中的优先级位置。
English
The lecture labels IGW, VPC peering, and TGW candidate paths as static for the purpose of explaining their precedence at equal prefix length.
Transcript
03:24 IGW and VPC Peering and TGW
03:28 and VPN provides the static Routing option.
7. DX 与 VPN 的动态传播路由
时间范围：03:31–03:46
总结 / Summary
中文
Direct Connect（DX）和 VPN 可通过边界网关协议（Border Gateway Protocol, BGP）传播动态路由；这些路由属于传播路由（Propagated Routes），在静态路由之后比较。
English
Direct Connect and VPN can propagate dynamic routes through BGP. These are propagated routes and are evaluated after static routes of the same prefix length.
Transcript
03:31 And for DirectConnect and VPN again, you can have the propagated routes.
03:36 So static routes take precedence over the propagated routes.
03:40 Now, if you have only the propagated routes, then also there is the preference.
8. 传播路由中的 DX 优先级
时间范围：03:46–04:06
总结 / Summary
中文
在相同前缀长度的传播路由中，Direct Connect 的 BGP 路由（DX BGP Route）优先于 VPN 路径。这是 VPC 路由优先级中的下一层判断。
English
Among propagated routes with equal prefix length, a Direct Connect BGP route is preferred over a VPN path.
Transcript
03:46 So DirectConnect route takes precedence.
03:49 Now what that means is if you are connecting to the
03:52 other network over a DX connection as well as over the VPN,
03:56 and you understand the same routes from both these connections,
04:00 then the traffic will go through the DirectConnect,
04:03 not through the VPN because it takes precedence over the
9. VPN 静态路由与 BGP 路由
时间范围：04:06–04:10
总结 / Summary
中文
VPN 路由还可细分为 VPN 静态路由（VPN Static Route）与 VPN BGP 路由（VPN BGP Route）；课程将其放在 DX BGP 路由之后继续比较。
English
VPN routes may be static or learned through BGP; the lecture places these VPN choices after DX BGP routes in the preference sequence.
Transcript
04:06 VPN static routes or a VPN BGP routes.
10. VPC 路由优先级总表
时间范围：04:10–04:24
总结 / Summary
中文
完整决策顺序是：先做最长前缀匹配（Longest Prefix Match），再比较静态与传播属性，最后在传播路由内部按 Direct Connect BGP、VPN 静态和 VPN BGP 等类别选择。
English
The complete decision order is longest prefix match, then static versus propagated origin, followed by the relative preference among propagated DX and VPN route types.
Transcript
04:10 So this is how typically the route preference happens.
04:14 And VPC will evaluate all these rules before making the decision.
04:19 Now let's look at this in a little more detail with some example.
04:23 So
11. VPC 路由选择拓扑
时间范围：04:24–05:49
总结 / Summary
中文
示例 VPC 通过本地路由、VPC 对等连接（VPC Peering）、虚拟专用网关（Virtual Private Gateway, VGW）和互联网网关（IGW）访问多个目标。右侧路由表展示目标前缀、下一跳和是否传播，为后续路径选择演示提供依据。
English
The example VPC reaches several targets through local routing, VPC peering, a VGW, and an IGW. The route table lists destination, target, and propagation state for the path-selection walkthrough.
Transcript
04:24 this is your VPC on the left side which has subnets and a CIDR block.
04:30 And now to add the complexity what I have done is,
04:34 I have shown multiple networks here on the right side
04:37 and all the networks have the same CIDR range that is 192.168.0.0/16
04:47 And they are connected to this VPC.
04:50 Now, if you look at the VPC route table,
04:52 it would have the local route for the VPC CIDR
04:55 itself and then multiple routes to reach to this CIDR block
05:01 as shown in this route table.
05:04 Now let's take an example,
05:05 suppose this EC2 machine here wants to communicate with another EC2 machine.
05:10 Now, this address falls in the VPC
05:13 local CIDR range.
05:15 So the traffic will always be routed through this VPC local router,
05:19 it won't go out.
05:21 But if from this EC2
05:23 machine, if the traffic is going to
05:26 this IP address, which is 192.168.8.8
05:30 Now this IP is available
05:33 on all these three networks. So which path VPC will take?
05:37 Now in this case, because the VPC Peering route has been added as a static route,
05:43 that means it's not a propagated one.
05:45 So this path is chosen to reach out to that machine.
12. 静态 VPC Peering 路径获选
时间范围：05:49–05:52
总结 / Summary
中文
当 VPC 对等连接路由（VPC Peering Route）作为静态路由存在时，它在同前缀竞争中胜过传播路径，因此流量选择对等连接。
English
When the VPC peering route exists as a static route, it beats propagated alternatives for the same prefix and is selected.
Transcript
05:49 So
05:49 this is how the route selection happens.
13. 移除静态路径后的竞争
时间范围：05:52–06:13
总结 / Summary
中文
移除 VPC 对等连接及其静态路由后，同一目标只剩 Direct Connect 和 VPN 两条传播路径，需要继续应用传播路由内部的优先级规则。
English
After removing the VPC peering connection and its static route, Direct Connect and VPN remain as competing propagated paths.
Transcript
05:52 Now, let's further complicate this and remove the static Routing and remove the
05:59 VPC Peering connection.
06:01 Now, in this case, there are now two routes to go to this IP address one is over the DX
06:07 and the other is over the VPN connection.
06:10 So can you guess now which path it will take?
14. 选择 Direct Connect 路径
时间范围：06:13–06:20
总结 / Summary
中文
在 DX 与 VPN 都能到达目标且前缀相同时，VPC 选择 Direct Connect（DX）路径，因为 DX BGP 路由的优先级更高。
English
When DX and VPN advertise the same prefix, the VPC selects Direct Connect because the DX BGP route has higher preference.
Transcript
06:13 Obviously,
06:14 it will take the DX path because we learned that in case of propagated routes,
15. DX BGP 胜过 VPN
时间范围：06:20–06:30
总结 / Summary
中文
该画面确认 Direct Connect BGP 路由（DX BGP Route）在同前缀传播路由中胜过 VPN 路由；这是理解多连接路径选择的基础。
English
This stage confirms that a DX BGP route outranks a VPN route among equal-prefix propagated routes.
Transcript
06:20 the DX BGP routes take precedence over the VPN connection.
06:25 Ok. So this is how the VPC Routing works. And
16. 从 VPC 路由转向 DX 路由
时间范围：06:30–06:43
总结 / Summary
中文
掌握 VPC 的基础路由优先级后，课程转向多个 Direct Connect 链路同时可用时的路径选择问题。
English
After establishing VPC route precedence, the lecture turns to path selection when multiple Direct Connect links are available.
Transcript
06:30 now let's understand more about the DX Routing.
06:34 Now let's further add the multiple DX connections and that's where
06:39 the DX Routing and BGP communities come into the play.
17. 相同前缀经多个 DX 链路到达 VGW
时间范围：06:43–07:09
总结 / Summary
中文
两个 Direct Connect 连接终止在同一虚拟专用网关（Virtual Private Gateway, VGW）并通告相同 CIDR 前缀时，VGW 必须判断使用哪条链路。此时需要通过路由策略（Routing Policies）影响选择。
English
When two DX connections terminate on the same VGW and advertise the same CIDR prefix, the VGW needs policy signals to choose one link.
Transcript
06:43 So now you have multiple DX connections,
06:45 both terminating on the same virtual private Gateway
06:49 and both are advertising the
06:51 same CIDR prefix over these DX links. Now, the question is
06:56 how does VGW makes a decision
06:59 which path to take?
07:01 Right
07:02 and exactly for that,
07:03 you use DX Routing policies to influence one path over the other.
18. BGP 标签影响路由决策
时间范围：07:09–07:13
总结 / Summary
中文
路由策略（Routing Policies）和 BGP 社区标签（BGP Community Tags）用于对候选 DX 路径施加偏好，改变默认路由决策。
English
Routing policies and BGP community tags attach preferences to candidate DX paths and influence the routing decision.
Transcript
07:09 So let's look at that. Now,
19. DX 路由策略概览
时间范围：07:13–07:15
总结 / Summary
中文
这一页开始归纳 DX 路由策略（DX Routing Policies）与 BGP 社区（BGP Communities）的作用范围。
English
This slide begins the high-level summary of DX routing policies and BGP communities.
Transcript
07:13 now DX Routing policies and BGP
20. 策略影响 Direct Connect 流量
时间范围：07:15–07:22
总结 / Summary
中文
当流量经过 Direct Connect 连接时，路由策略（Routing Policies）用于影响路径决策，而不是改变最长前缀匹配等基础规则。
English
Routing policies influence path decisions for traffic traversing Direct Connect connections without replacing basic rules such as longest prefix match.
Transcript
07:15 communities are used to influence the Routing decision
07:18 when
07:19 the traffic flows through the direct connect connections.
21. 入站路由策略
时间范围：07:22–07:40
总结 / Summary
中文
入站路由策略（Inbound Routing Policies）控制从本地部署环境（On-Premises）进入 AWS 的流量。路径选择主要由客户侧路由器及其接收的 BGP 属性决定。
English
Inbound routing policies govern traffic from on premises to AWS, with path selection primarily controlled by the customer router and received BGP attributes.
Transcript
07:22 So there are two kinds of the Routing policies,
07:25 inbound Routing policies that means traffic coming to AWS from your router.
07:30 and all these decisions are taken at your end. AWS doesn't govern that.
07:35 But what you can do is you can influence the outbound Routing policies.
22. 出站路由策略
时间范围：07:40–07:54
总结 / Summary
中文
出站路由策略（Outbound Routing Policies）影响 AWS 端的 VGW 在多条路径之间如何把流量发送到本地网络。
English
Outbound routing policies influence how the AWS-side VGW chooses among multiple paths toward the on-premises network.
Transcript
07:40 That means how VGW sends traffic to your network.
07:43 If there are multiple paths, then which path VGW should select.
07:48 Now, that you can influence with these Routing policies and BGP communities
23. Public VIF 与 Private/Transit VIF 的策略不同
时间范围：07:54–08:30
总结 / Summary
中文
路由策略和 BGP 社区在公有虚拟接口（Public VIF）与私有/传输虚拟接口（Private/Transit VIF）上的用途不同；后续课程会分别深入。
English
Routing policies and BGP communities serve different purposes on Public VIFs versus Private and Transit VIFs, which later lectures examine separately.
Transcript
07:54 and these Routing policies and BGP communities work differently
07:58 for a public VIF
08:00 and private or Transit VIF. So for private and Transit VIF these are the same
08:05 policies which applies to both the VIFs, but for public VIF they are different.
08:10 So first, let's look at very high level
08:13 how this affects the public VIF and the private or Transit VIFs.
08:18 And in the following lecture, we will go into much detail for every VIF type.
08:25 OK. So very first thing we are talking about the
24. 比较两类 VIF 的出站路径选择
时间范围：08:30–08:37
总结 / Summary
中文
比较从 AWS 到本地部署环境的出站路径选择时，应分别分析 Public VIF 与 Private/Transit VIF，因为两类接口可用的控制信号并不完全相同。
English
For AWS-to-on-premises path selection, Public VIFs must be analyzed separately from Private and Transit VIFs because their control signals differ.
Transcript
08:30 path selection for outbound traffic, that means from AWS to
08:34 on-premises site.
08:35 And in that case,
25. Public 与 Private/Transit VIF 分栏
时间范围：08:37–08:45
总结 / Summary
中文
该画面明确把公有虚拟接口（Public VIF）与私有或传输虚拟接口（Private or Transit VIF）分栏，为逐项比较路径选择与路由传播范围作准备。
English
The slide separates Public VIF from Private or Transit VIF to compare path selection and route-propagation scope.
Transcript
08:37 the policies differ for public VIF and private or Transit VIF.
08:41 So first let's look at the public VIF policies.
26. Public VIF 使用 BGP 属性选路
时间范围：08:45–08:55
总结 / Summary
中文
Public VIF 的路径选择（Path Selection）依赖标准 BGP 属性（BGP Attributes）；这些属性决定多条可达路径之间的优先级。
English
Public VIF path selection uses standard BGP attributes to rank multiple reachable paths.
Transcript
08:45 So for path selection that is choosing one path or the other,
08:49 you can use BGP attributes which are longest prefix match and then the AS_PATH.
27. 最长前缀与 AS_PATH
时间范围：08:55–09:53
总结 / Summary
中文
Public VIF 可使用最长前缀（Longest Prefix）和自治系统路径（AS_PATH）影响选路；BGP 社区标签在 Public VIF 中主要不用于选路，而用于约束路由传播范围。
English
Public VIF path selection can use longest prefix and AS_PATH. Its BGP community tags mainly scope route propagation rather than select a path.
Transcript
08:55 Now you already understand about this.
08:57 So for public VIF,
08:59 you can use these two attributes to influence the path selection.
09:04 Now there is something called BGP community tags.
09:07 And with respect to the public VIF, you can't use to influence the path selection,
09:12 but you can use it to influence how far
09:15 your route should be propagated in the other network.
09:19 So when you advertise your routes from
09:22 on-premises to AWS side,
09:23 you can restrict that your routes should be advertised to only
09:28 base AWS Region or to that continent or they should be
09:33 propagated globally in all AWS public network.
09:37 And at the same time, AWS also sends you community tag which tells you
09:41 from which
09:43 AWS side of the network these routes are coming from, are they from the local Region,
09:47 Are they from the continent or they are
09:50 Global AWS public IPs
28. Public VIF 的路由传播范围
时间范围：09:53–09:57
总结 / Summary
中文
BGP 社区标签（BGP Community Tags）可把 Public VIF 路由限制在本地区域、洲级范围或全球 AWS 公网；AWS 返回的标签也可帮助客户识别路由来源范围并过滤。
English
BGP community tags can scope Public VIF routes to a local Region, a continent, or the global AWS public network, and returned tags help customers identify and filter route origin.
Transcript
09:53 and accordingly, you can filter your traffic at your end.
29. Public VIF 社区标签数值
时间范围：09:57–10:03
总结 / Summary
中文
Public VIF 的入站社区标签示例包括 7224:9100、7224:9200、7224:9300；出站标签包括 7224:8100、7224:8200 或无标签（No Tag），并可使用 NO_EXPORT 控制传播。
English
Example Public VIF inbound communities are 7224:9100, 7224:9200, and 7224:9300; outbound markings include 7224:8100, 7224:8200, no tag, and NO_EXPORT behavior.
Transcript
09:57 So BGP community tags
09:58 are used to scope the routes in case of public VIF.
30. Public VIF 控制项汇总
时间范围：10:03–10:07
总结 / Summary
中文
Public VIF 一侧的控制形成两层：最长前缀和 AS_PATH 负责选路，BGP 社区（BGP Communities）负责传播范围。两类机制应分开理解。
English
Public VIF controls have two layers: longest prefix and AS_PATH select a path, while BGP communities scope propagation.
Transcript
10:03 And we will dive deep into
10:05 everything that you see here.
31. Private/Transit VIF 的选路属性
时间范围：10:07–10:30
总结 / Summary
中文
Private VIF 与 Transit VIF 同样使用最长前缀（Longest Prefix）和 AS_PATH 做基础路径选择；此外还可用本地优先级社区（Local Preference BGP Communities）影响 AWS 端的链路偏好。
English
Private and Transit VIFs also use longest prefix and AS_PATH, and can additionally use local-preference BGP communities to influence AWS-side link preference.
Transcript
10:07 Now, with respect to the private or a Transit VIF. Again, for path selection,
10:13 you can use the longest prefix match, you can use AS_PATH.
10:17 And additionally,
10:18 you can also use local BGP community tags to influence
10:23 the traffic when there are multiple paths to reach to the target
10:28 network on your side.
32. Private/Transit VIF 的本地优先级社区
时间范围：10:30–10:57
总结 / Summary
中文
Private/Transit VIF 提供三个本地优先级（Local Preference）社区标签：7224:7100（低，Low）、7224:7200（中，Medium）和 7224:7300（高，High）。当多条路径到达同一目标时，更高的本地优先级可使 AWS 选择对应路径。
English
Private and Transit VIFs provide three local-preference communities: 7224:7100 (low), 7224:7200 (medium), and 7224:7300 (high). Higher local preference makes AWS favor the tagged path when multiple paths reach the same destination.
Transcript
10:30 So there are three local
10:32 preference BGP community tags as you can see
10:35 and depending on which community tag you use, path selection happens.
10:40 And again, as I said, we will dive deep into this in the next
10:44 four lectures.
10:45 So overall that is what the BGP communities and Routing policies looks like for DX.
10:53 And now let's get into more detail. Thanks for watching.
整讲总结 / Overall Summary
中文
VPC 的基础路由决策先遵循最长前缀匹配（Longest Prefix Match），再比较静态路由（Static Route）与传播路由（Propagated Route）；同前缀传播路由中，Direct Connect BGP 路由通常优先于 VPN。多个 DX 链路通告相同前缀时，入站路由策略（Inbound Routing Policies）主要由客户侧 BGP 属性控制，出站路由策略（Outbound Routing Policies）则影响 AWS 端 VGW 的选择。Public VIF 使用最长前缀和 AS_PATH 选路，用 BGP 社区（BGP Communities）限制路由传播范围；Private/Transit VIF 还可使用 7224:7100、7224:7200、7224:7300 三档本地优先级（Local Preference）社区标签影响路径偏好。
English
VPC routing first applies longest prefix match, then static-versus-propagated precedence; among equal-prefix propagated routes, Direct Connect BGP routes generally outrank VPN. When multiple DX links advertise the same prefix, inbound policy is mainly controlled by customer-side BGP attributes, while outbound policy influences the AWS-side VGW. Public VIFs use longest prefix and AS_PATH for path selection and BGP communities for propagation scope. Private and Transit VIFs can also use 7224:7100, 7224:7200, and 7224:7300 local-preference communities to bias path choice.
返回顶部 ↑