网络课程笔记

00:00 Okay, so now let's look at

00:02 the public wifi routing policies first,

00:04 and let's see how it influences the traffic,

00:07 which flows from AWS to on premise

00:09 as well as from on-premise network to AWS.

00:13 So, there are two type of the policies,

00:15 inbound policies and outbound policies.

00:18 As I said, inbound policies means

00:20 the policies which are applicable to the traffic or routes

00:23 flowing from customer router to AWS.

00:25 So in this case,

00:27 of course, when you create a public wifi,

00:28 you remember you have to provide the IPv4 prefixes

00:32 or IPv6 prefixes, right?

00:34 To advertise over the BGP.

00:36 So what that AWS learns,

00:37 which are the IP addresses on the customer insight.

00:40 So you must specify those IP addresses

00:43 and you must also own those IP addresses.

00:45 So AWS verifies that you own those IP prefixes.

00:50 And this is important because, you know,

00:51 if you advertise the IP prefixes not owned by you

00:55 and maybe some other customers own it,

00:58 then AWS would wrongly send this traffic to you

01:03 instead of sending it to the other customers.

01:05 And that's where this is very important

01:06 that you own these public prefixes.

01:09 Now traffic must be destined to AWS public prefixes.

01:13 That means all the traffic that you are sending

01:15 from customer router to AWS should also have the destination

01:19 as one of the public IP addresses on AWS site.

01:23 The transitory routing

01:24 between the connection is not supported

01:26 and I'll talk more about that shortly,

01:28 but essentially what it means is

01:30 once AWS learns about your side of the prefixes,

01:34 AWS does not further share these prefixes with,

01:37 you know, other customers

01:39 because AWS would be having direct connect connection

01:42 with multiple customers.

01:43 So AWS does not advertise it further to the other customers.

01:47 AWS also performs the inbound packet filtering now

01:50 because AWS knows your side of the IP prefixes.

01:53 It makes sure that AWS is receiving traffic

01:56 only from those prefixes.

01:58 So if you send the packet from a new IP prefixes,

02:02 which is not advertised over BGP,

02:04 AWS will reject that traffic.

02:07 So let's look at through this architecture.

02:09 On the right side, of course you have corporate data center

02:11 and on left side, you have all AWS regions.

02:14 Now, because we are talking about the public wifi,

02:17 then you can access all AWS region as you know.

02:20 So on your corporate data center side,

02:22 you might be having some network ranges.

02:24 One of the range is this, 192.168,

02:27 and there could be additional network ranges as well.

02:30 Now you want to advertise these routes to AWS

02:33 over a BGP session.

02:34 So first thing you must own these networks

02:37 and AWS will verify that

02:38 before setting up this BGP connection.

02:41 And once that is done,

02:42 you advertise these routes and these routes get advertised

02:46 to all AWS regions

02:47 because public wifi allows you to

02:50 connect to all AWS regions.

02:52 Now once AWS learns about these prefixes from your end,

02:57 AWS could also propagate these routes to the other customer,

03:01 but as transitive routing is not supported,

03:04 and this is not something that you want, right?

03:06 You don't want your routes to be published

03:08 to some other customers, right?

03:10 So that's where this is not supported.

03:12 That means transitive routing is not valid.

03:16 So that's one thing that you need to understand

03:18 with respect to the inbound routing policies.

03:21 Now let's talk about the public wifi

03:23 outbound outing policies.

03:25 Outbound means the traffic,

03:27 which is flowing from AWS to the customer router.

03:30 Now in this case, how AWS takes that decision,

03:33 like I want to take one path over the other,

03:37 and this is essentially applicable

03:38 when there are multiple direct connect connections

03:41 between AWS and your on-premise networks, right?

03:44 So the longest prefix match takes the precedence.

03:47 That, that is obvious

03:48 and we have been seeing this in the various section,

03:52 like a VPN as well, right?

03:54 So what essentially this means is that

03:57 if on AWS side, you have multiple routes in the route table

04:03 and say, one route is with a slash 16 prefix,

04:06 another route is with slash 28 prefix.

04:09 And if there are two connection to reach to the destination,

04:12 which route it will take?

04:14 So if your IP address falls in slash 28 range,

04:18 then it would take that prefix,

04:19 even though the IP address also falls into a slash 16 range,

04:23 but slash 28 is more, you know,

04:26 longest prefix, I would say.

04:27 More specific, right?

04:29 In that case, that route will be,

04:31 or that path will be selected

04:32 for sending the traffic to customer router site.

04:36 And the other thing is ASPATH.

04:38 We learned about ASPATH in BGP session as well.

04:41 Essentially, this means how many hubs are there

04:44 to reach to the destination.

04:46 Longest ASPATH, less paper path it would be, right?

04:50 So these are the outbound policies,

04:51 which also influence the routing decision

04:53 for outbound connection.

04:56 Now, AWS also advertises all local

04:58 and remote AWS region prefixes to your network.

05:02 And this is important because otherwise,

05:04 if your network does not know about

05:06 those public IP prefixes,

05:09 then it does not really help you

05:11 to route the traffic to AWS.

05:17 with something called NO Export BGP communities.

05:19 AWS will also advertise all the public prefixes

05:20 Now what that means is

05:21 once you learn the routes from the AWS,

05:24 you should not further export these routes

05:27 to the other networks outside of your network.

05:30 Not similar to what AWS does as a non transitory routing

05:34 in case of inbound, right?

05:36 We said that AWS does not share those routes

05:38 with the other customers.

05:40 Same thing applies to you as well.

05:41 You should not further export these routes

05:44 to the other networks.

05:47 Now, additionally,

05:48 AWS also advertises some BGB community tags.

05:52 Now, what does BGB community tags mean?

05:55 We will see shortly,

05:57 but what the purpose of this community tag

06:00 is to filter the traffic at your end.

06:02 And in the start of this section, I told you that,

06:04 you know, you can filter whether you want to talk to

06:06 only one AWS region or you want to the multiple AWS region,

06:11 that can be done using this BGP community tags.

06:14 And we'll see example of that shortly.

06:19 Now, the prefixes advertised by AWS Direct Connect

06:21 must not be advertised beyond the network boundaries

06:23 of your connection.

06:24 We just talked about that when we say

06:26 there is a No Export BGP community tag,

06:29 which AWS sends along with the routes.

06:33 And finally,

06:35 with the combination of this ASPATH and BGP communities,

06:39 you can actually design

06:41 different type of the network architecture.

06:44 That means if you're multiple direct connect connection

06:46 to reach to the target,

06:48 you can decide if I want to do a load sharing of the traffic

06:50 between these two connection,

06:52 or maybe sometimes you want to have one connection

06:54 as an active and one connection as a passive.

06:56 Now this can be done using the combination of,

06:59 you know, routing policies as well as BGP communities.

07:03 So now with basic understanding of how the routing

07:06 and BGP communities work,

07:08 let's try to build some architecture

07:10 when it comes to the traffic flowing

07:13 between the AWS and on-premise network

07:15 and when there are multiple direct connect connections.

07:17 So how do you make a choice

07:19 for one connection over the other?

07:21 So let's get into that.

07:22 Thanks for watching.