Lecture 132: Public VIF routing scenarios
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：11:08
- 来源：Udemy Lecture 27898604
- Slide 数量：25
- 画面切换：00:19、00:59、01:32、01:55、02:35、02:41、03:00、03:13、03:27、03:58、04:08、05:51、06:20、06:30、06:35、06:47、06:55、07:09、07:32、08:27、08:36、08:41、09:00、09:20
扫描说明
逐条检查了 Udemy 页面中的 265 条 Transcript cue，并扫描了全长约 11:08 的视频。依据多 DX 场景标题、Active-Active 规则渐显与路径动画、Active-Passive 的 Public ASN/Private ASN 规则渐显及路径动画，共划分为 25 个小节。扫描后段播放器曾弹出 Video error，但正式截图前刷新页面并重新定位每个已确认切换点；25 张正式截图均在视频播放、播放器控件隐藏、Transcript 与课程侧栏关闭后按完整媒体边界截取，逐张确认无错误提示、无覆盖层、无中央播放按钮，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 多条 DX 连接的 Public VIF 路由场景
时间范围：00:00–00:19
总结 / Summary
中文
本讲把公有虚拟接口（Public VIF）的路由策略应用到多条 Direct Connect（DX）连接，分别设计双活（Active-Active）与主备（Active-Passive）流量路径。
English
This lecture applies Public VIF routing policies to multiple Direct Connect links, covering active-active and active-passive designs.
Transcript
00:00 Okay, so now that you understood
00:02 the basics of routing policies
00:05 and BGP communities for public VIF,
00:07 let's understand and go through a few architectures,
00:10 and how you can influence the routing decision
00:13 while using the multiple direct connect connections.
00:15 So let's look at some of the architectures here.
2. Active-Active Public VIF 概览
时间范围：00:19–00:59
总结 / Summary
中文
双活（Active-Active）意味着两条 Public VIF 同时承载流量。目标是让 AWS 与本地部署环境（On-Premises）在两个方向都把两条链路视为等价路径。
English
Active-active means both Public VIF links carry traffic, with AWS and on premises treating the two paths as equivalent in both directions.
Transcript
00:19 Now, first let's look at how to achieve
00:22 the active-active connection using the public VIF.
00:24 Now, one thing to remember is that,
00:27 while we saw the public VIF,
00:29 you have to provide the ASN for that VIF, right?
00:33 And we understood that this ASN
00:35 can be a public ASN or a private ASN.
00:38 And in case of public ASN you have to own that.
00:42 And it has to be registered in a regional registry,
00:46 Y-R-I-N-E.
00:48 So the routing would also depend whether
00:52 you are using the public ASN or a private ASN.
00:54 So considering the case,
00:55 when you're using a public ASN for public VIF,
3. Public ASN 的等价通告要求
时间范围：00:59–01:32
总结 / Summary
中文
使用公网自治系统号（Public Autonomous System Number, Public ASN）时，客户网关必须在两条 Public VIF 上通告相同前缀和相同 BGP 属性（BGP Attributes）。这样 AWS 才能在两条链路间负载均衡。
English
With a public ASN, the customer gateway advertises the same prefix with identical BGP attributes on both Public VIFs so AWS can load-balance across them.
Transcript
00:59 then how the routing happens is that,
01:01 on the customer gateway site,
01:02 you have to advertise the same prefix
01:05 with the same border gateway protocol.
01:07 So you have two public VIFs created on AWS site,
01:11 and you have to direct connect connections.
01:14 And if you want to have the active-active connection,
01:15 that means it should be a load balanced traffic
01:19 from AWS to on-premise network.
01:20 In that case,
01:22 on both the connections or both the VIFs,
01:23 you would have to advertise the same BGP attributes.
01:28 And if you do that,
01:29 then the traffic from AWS would be load balanced
4. Private ASN 不支持此 Active-Active 方式
时间范围：01:32–01:55
总结 / Summary
中文
课程强调，Public VIF 使用私有自治系统号（Private ASN）时，无法通过上述等价 BGP 通告实现这种 Active-Active 负载均衡；此场景要求 Public ASN。
English
The lecture notes that this equal-path active-active design is not supported when the Public VIF uses a private ASN; it requires a public ASN.
Transcript
01:32 across both the connections.
01:34 Now, this is applicable if you are using the public ASN.
01:37 However, if you are using the private ASN,
01:40 then the load balancing is not possible.
01:42 That means you can only use the private ASN
01:46 for use cases like active-passive connection.
01:48 And we'll see that shortly as well.
01:50 So now let's try to understand
01:52 how the architecture should look like.
5. Active-Active Public VIF 拓扑
时间范围：01:55–02:35
总结 / Summary
中文
拓扑包含两条 Public VIF、两个客户路由器（Customer Routers）与企业数据中心（Corporate Data Center），AWS 侧多个 VPC/服务区域通过两条 DX 链路到达同一客户网络。
English
The topology contains two Public VIFs and two customer routers connecting AWS public resources to one corporate data center through two DX links.
Transcript
01:55 Now, this is pretty much what we have been working
01:59 upon this architecture, right?
02:00 So you have corporate data center on AWS site.
02:05 Now we have public VIFs.
02:07 So there are two public VIFs here,
02:09 because there are two direct connect connections.
02:12 Now, if this is the architecture,
02:14 then there are two parts to reach to AWS,
02:16 as well as from AWS to optimize.
02:19 Either using public VIF-1 or public VIF-2,
02:22 Now idea here is that you want to load balance this traffic,
02:25 whatever originating from AWS,
02:27 then how will you achieve that?
02:29 Now, remember that we are using the public ASN here
02:33 for the public VIFs, right?
6. 客户必须拥有 Public ASN
时间范围：02:35–02:41
总结 / Summary
中文
客户侧路由器使用并拥有 Public ASN。Public ASN 是 AWS 能保留客户真实自治系统身份并把两条 BGP 路径视为可比较路径的前提。
English
The customer router owns and uses a public ASN, preserving the customer's autonomous-system identity on both BGP paths.
Transcript
02:35 So in this case it should be public ASN,
02:38 and that means you own that ASN.
7. 两条 VIF 通告相同前缀与属性
时间范围：02:41–03:00
总结 / Summary
中文
两条 BGP 会话必须通告相同前缀，并让 AS_PATH、多出口鉴别器（Multi-Exit Discriminator, MED）等相关 BGP 属性保持一致。
English
Both BGP sessions advertise the same prefix and keep relevant attributes, such as AS_PATH and MED, identical.
Transcript
02:41 Second, you have to advertise
02:43 the same BGP prefix and BGP attributes.
02:46 Now when we say same BGP prefix as in,
02:48 when you advertise your prefix information,
02:50 then it should be same.
02:52 As well as if you are using other BGP parameters
02:55 like MED or local preferences,
02:57 those should also be the same.
8. AWS 接收两条等价路径
时间范围：03:00–03:13
总结 / Summary
中文
相同的路由与属性通过两条 Public VIF 到达 AWS 后，AWS 看到两条等价候选路径，不会因某条链路具有更短 AS_PATH 或其他属性而偏向它。
English
When identical advertisements arrive over both Public VIFs, AWS sees two equal candidate paths without a policy reason to prefer one.
Transcript
03:00 If you do that,
03:01 of course the routes are sent over the BGP section,
03:05 or both the connections,
03:07 to the both the public VIFs,
03:08 and then this is the issued at AWS end.
03:12 And now what AWS would understand,
9. 双向等价路径形成
时间范围：03:13–03:27
总结 / Summary
中文
两条链路在 AWS 到客户和客户到 AWS 两个方向都保持等价，前提是客户内部路由策略也没有人为设置不同偏好。
English
The two links remain equivalent in both directions as long as the customer's internal routing policy does not introduce different preferences.
Transcript
03:13 is that both the parts are the same.
03:16 The BGP attributes are same.
03:18 Then it would start sending the traffic
03:20 in a load balance mode, right?
03:22 So some traffic will be sent to the VIF-1
03:25 and some traffic through VIF-2,
10. ECMP 实现 Active-Active 负载均衡
时间范围：03:27–03:58
总结 / Summary
中文
AWS 使用等价多路径（Equal-Cost Multi-Path, ECMP）在两条等价 Public VIF 之间分担流量。该方式要求 Public ASN，且流量按流而非逐包分配。
English
AWS uses ECMP to distribute traffic across the two equal Public VIF paths. The design requires a public ASN and balances flows rather than individual packets.
Transcript
03:27 Now this is called load balancing of the traffic.
03:30 Now for this AWS uses a protocol called ECMP,
03:33 that is equal cost multi-path.
03:36 And as I said,
03:37 this kind of load balancing is not possible
03:39 if you are using private ASN here for your router.
03:43 So this is what the active-active
03:45 connection architecture looks like.
03:48 And now let's look at the other scenarios
03:51 that is active-passive connection.
03:53 That means at any moment,
03:54 you want one connection to be primary
03:56 and one connection to be the secondary.
11. Active-Passive Public VIF 概览
时间范围：03:58–04:08
总结 / Summary
中文
主备（Active-Passive）设计让一条连接平时作为主路径（Primary），另一条作为备用路径（Secondary），只在主路径失效时接管。
English
An active-passive design uses one connection as the primary path and the other as a secondary path that takes over after failure.
Transcript
03:58 So in this case,
04:00 if you are using a public ASN,
04:02 now in this case you can use both public ASN for a VIF
04:05 or a private ASN for the VIF connection.
12. Public ASN 的 Active-Passive 规则
时间范围：04:08–05:51
总结 / Summary
中文
使用 Public ASN 时，两条 BGP 会话仍通告相同前缀；面向 AWS 的方向在备用链路上追加 AS_PATH（AS Path Prepending），使主链路路径更短。面向 AWS 的本地出口方向则在主路径设置更高的本地优先级（Local Preference）。
English
With a public ASN, both sessions advertise the same prefix, but the secondary path is AS-path prepended so AWS prefers the shorter primary path. The customer sets higher local preference on its primary egress.
Transcript
04:08 Right, so if you are using a public ASN ,
04:10 then on the customer gateway site
04:13 you have to advertise the same prefix
04:14 on both the BGP sessions again.
04:17 That means from customer end
04:19 you will advertise the same prefix.
04:20 Now, this is similar to your active-active
04:22 connections as well.
04:24 However, for influencing the routing decision at AWS end,
04:29 you would have the longer
04:31 AS_Path for the secondary connection.
04:34 Now, while learning about the BGP,
04:37 we talked about this, right?
04:38 AS_Path has the hops,
04:40 like how many hops it takes to
04:41 reach to the destination.
04:43 Now, if you add more hops,
04:45 then it considers that network
04:47 as inefficient network or a longer part.
04:50 So it won't take that part.
04:52 So what you do is on the primary,
04:53 you advertise the short area spot
04:56 and on the secondary connection,
04:57 you advertise the longer area spot.
04:59 Now, when AWS learns about this BGP parameters,
05:03 it will take always the primary connection as,
05:06 you know,
05:06 the first choice,
05:07 if the primary connection is done,
05:09 then it will look for other paths.
05:12 And so this is the case where AWS parts are influenced.
05:16 Now, you also have to tell on your site,
05:20 like you know, out of this connection,
05:21 which of the connection I should use
05:23 as a primary or secondary.
05:24 Now this is something within your network,
05:27 within your AS, right?
05:29 And that's where the local preference
05:31 comes into the picture.
05:32 If you said, say a higher local preference,
05:35 that part will be preferred over the other part.
05:38 And we'll see that shortly,
05:41 why the architecture again.
05:42 But this is all you set the active-passive connection
05:45 using the public VIF.
05:47 Now things change a little while you use the private ASN.
13. Private ASN 使用更具体前缀建立主备
时间范围：05:51–06:20
总结 / Summary
中文
Public VIF 使用 Private ASN 时，不能依赖 AS_PATH 保留客户 ASN 偏好，因此主连接通告更具体的前缀（Longer Prefix），备用连接通告汇总的通用前缀（Generic Prefix）；最长前缀匹配决定主路径。
English
With a private ASN, the primary advertises more-specific prefixes and the secondary advertises a generic aggregate; longest prefix match establishes the preferred path.
Transcript
05:51 If you're using private ASN then longer prefix,
05:54 you have to send on the primary connection,
05:57 and then generic prefix has to be sent
06:00 on the secondary connection.
06:02 That is what we know, right?
06:04 If the prefix is longer that means it has a closer match
06:08 to the destination IP addresses,
06:09 that part is preferred or the other.
06:11 Now this is applicable to the private ASN
06:14 for your public VIF.
06:16 So let's now look at how the architecture should look like.
14. Active-Passive Public ASN 拓扑
时间范围：06:20–06:30
总结 / Summary
中文
图中上方 Public VIF 为主连接（Primary），下方 Public VIF 为备用连接（Secondary）。两条链路都保持 BGP 可达，以便故障时快速切换。
English
The upper Public VIF is primary and the lower Public VIF is secondary. Both remain BGP-reachable for rapid failover.
Transcript
06:20 Now here again we want to achieve
06:22 the active-passive connection.
06:24 And we are using public VIF with public ASN at your end.
06:29 So this is a public ASN.
15. 标记 Public ASN 与主备链路
时间范围：06:30–06:35
总结 / Summary
中文
客户侧使用 Public ASN，并明确标记主、备路由器和链路；这为分别设置 AS_PATH 与本地优先级（Local Preference）提供对象。
English
The customer uses a public ASN and identifies the primary and secondary routers and links for separate AS_PATH and local-preference policies.
Transcript
06:30 As I said, if you want to have active-passive connection
06:33 while using the public ASN,
16. 主连接通告较短 AS_PATH
时间范围：06:35–06:47
总结 / Summary
中文
主连接通告正常、较短的 AS_PATH，使 AWS 在比较同一前缀的 BGP 路由时优先选择该链路。
English
The primary connection advertises the normal shorter AS_PATH, causing AWS to prefer it for an identical prefix.
Transcript
06:35 first you need to advertise the shorter AS_Path
06:38 for the primary connection.
06:39 So if you want to use this as a primary
06:41 and this as a secondary connection.
06:43 And for secondary connection you will just add more hops.
17. 备用连接执行 AS_PATH Prepending
时间范围：06:47–06:55
总结 / Summary
中文
备用连接重复客户 ASN，执行 AS_PATH 前置（AS Path Prepending），人为增加路径长度，从而降低该链路在 AWS 端的偏好。
English
The secondary connection repeats the customer ASN through AS-path prepending, lengthening the path and lowering its preference at AWS.
Transcript
06:47 So you just repeat the same
06:50 AS_Path attribute again and again.
06:52 Now as this reaches to the AWS side,
18. AWS 正常选择主路径
时间范围：06:55–07:09
总结 / Summary
中文
主、备链路都健康时，AWS 根据更短的 AS_PATH 把发往客户的数据流量放到主连接。
English
While both links are healthy, AWS sends customer-bound traffic over the primary connection because its AS_PATH is shorter.
Transcript
06:55 it understands that it has to take
06:58 the primary part via this connection.
07:01 Now, what if the primary link fails for some reason?
07:04 Of course there is another part that AWS knows
07:07 how to reach to your router,
19. 主路径故障时切换备用
时间范围：07:09–07:32
总结 / Summary
中文
当主链路失效或其路由撤销后，AWS 仍保留备用链路的可达路径，并自动把流量切换到次优但可用的备用连接。
English
If the primary fails or withdraws its route, AWS retains the secondary route and shifts traffic to the remaining available connection.
Transcript
07:09 so it will take the other part.
07:11 Now, this is a case when AWS wants to send
07:15 the traffic to your router, right?
07:17 But how do you influence the decision in your router?
07:21 Like it has to take the part via primary most of the time,
07:24 and if primary is done it has to take the secondary part.
07:27 And that's where the local preference
07:30 comes into the picture, right?
20. 客户侧用 Local Preference 控制出站
时间范围：07:32–08:27
总结 / Summary
中文
从客户到 AWS 的方向由客户路由器控制：主路径设置较高本地优先级（Higher Local Preference，例如 200），备用路径设置较低值（例如 100）。主路径故障后才选择备用。
English
For customer-to-AWS traffic, the customer sets higher local preference on the primary path (for example 200) and lower preference on the secondary (for example 100).
Transcript
07:32 So you will set up the higher local preference
07:34 on the primary part,
07:35 and lower local preference on the secondary part.
07:39 Now again, if your primary fails, right?
07:43 In that case the secondary part will be taken
07:46 for the outbound traffic from your customer router.
07:50 So this is how you can see that, you know,
07:52 you can have the active-passive connection
07:55 using the public VIF.
07:57 So there are two things, right?
07:58 How to influence the traffic from AWS to your site,
08:01 and how to influence the traffic from your site to AWS.
08:04 For influencing traffic from AWS,
08:07 you will use the shorter AS spot,
08:09 and from your AWS you will use local preferences.
08:14 So I hope that is clear.
08:15 And now let's get into what if I have a private ASN, right?
08:20 This is all when you are using
08:22 the public ASN for your router.
08:24 Now if there is a private ASN then things change.
21. Private ASN 的 Active-Passive 拓扑
时间范围：08:27–08:36
总结 / Summary
中文
Private ASN 场景保留相同的主、备物理拓扑，但选路信号从 AS_PATH 前置改为更具体前缀与汇总前缀的组合。
English
The private-ASN scenario uses the same physical primary/secondary topology but replaces AS-path prepending with more-specific and aggregate prefixes.
Transcript
08:27 As I said for primary connection,
08:29 you have to send more specific prefixes,
08:32 and for secondary connection,
08:33 you have to send more generic prefixes.
22. 标记 Private ASN
时间范围：08:36–08:41
总结 / Summary
中文
客户路由器使用 Private ASN；AWS 侧的主备决策因此依赖前缀长度，而不是通过客户 Public ASN 构造不同 AS_PATH。
English
The customer router uses a private ASN, so AWS-side preference relies on prefix length instead of public-ASN-based AS_PATH differences.
Transcript
08:36 So for example,
08:37 you will send something like a base address/25 here.
23. 主连接通告两个 /25 前缀
时间范围：08:41–09:00
总结 / Summary
中文
主连接把原 /24 地址范围拆成两个更具体的 /25 前缀并通告。最长前缀匹配（Longest Prefix Match）使这些 /25 路由优先于备用连接上的 /24。
English
The primary advertises two more-specific /25 prefixes covering the original /24. Longest prefix match makes these /25 routes preferred over the secondary /24.
Transcript
08:41 Right?
08:42 And you can see multiple blocks of 25.
08:45 So ultimately you are using the same range as
08:48 X-X-X-X-zero slash 24,
08:50 but you divided that into two ranges to be more precise,
08:55 or more closer to the IP addresses.
08:58 And in case of secondary connection,
24. 备用连接通告通用 /24
时间范围：09:00–09:20
总结 / Summary
中文
备用连接只通告通用 /24 汇总前缀。正常情况下 /25 主路径胜出；/25 被撤销后，/24 仍能覆盖目标地址并承接流量。
English
The secondary advertises only the generic /24 aggregate. The /25 primary routes win normally, while the /24 provides coverage after those routes are withdrawn.
Transcript
09:00 you will advertise the generic prefix that is slash 24.
09:04 Now in this case,
09:06 AWS learns that this is more specific prefix,
09:08 even though the ultimate-
09:10 The range is same,
09:11 but this is more specific.
09:14 Then that part will be taken over the secondary connection.
09:18 So if the primary connection fails for some reason,
25. Private ASN 主备切换与整讲总结
时间范围：09:20–11:08
总结 / Summary
中文
主连接故障时，更具体的 /25 路由消失，AWS 回退到备用连接的 /24。整讲结论是：Active-Active Public VIF 要求 Public ASN、相同前缀与属性并使用 ECMP；Active-Passive 在 Public ASN 下结合 AS_PATH 与 Local Preference，在 Private ASN 下结合更具体与通用前缀。
English
When the primary fails, its /25 routes disappear and AWS falls back to the secondary /24. Active-active requires a public ASN, identical advertisements, and ECMP; active-passive uses AS_PATH plus local preference with a public ASN, or specific-versus-generic prefixes with a private ASN.
Transcript
09:20 then the secondary connection will be taken.
09:23 So this is how you can have, you know,
09:26 active-active and active-passive connections
09:29 using the public VIF.
09:30 So just to quickly,
09:32 and realize again,
09:33 for active-active connection,
09:36 you need to have a public ASN for your public VIF.
09:40 With private ASN and you cannot achieve that.
09:43 And in that case,
09:44 you have to just advertise the same VGP attributes
09:47 from your on-premise router,
09:49 and AWS will automatically use ECP to do the load balancing
09:53 for active-active connection.
09:55 Now for active-passive connection,
09:57 things change a little when you use
09:59 a public ASN or a private ASN.
10:01 If you are using the public ASN...
10:04 Again, you can use the AS_Path
10:06 for influencing the routing decision at AWSN,
10:09 and local preference for choosing-
10:12 Again from on-premise to AWS,
10:14 you can influence that decision using local preferences.
10:17 Now instead if you are using the private ASN,
10:20 then you have to send the more specific prefixes
10:24 for the primary connection,
10:26 and generic prefixes for the secondary connection.
10:30 Okay, so hope what we just discussed is clear.
10:33 And I know that this could be overwhelming
10:36 to understand all these concepts at once,
10:39 but maybe this is not asked in exam
10:41 with that detail that we saw.
10:43 But then this is always good to know
10:46 when you actually work on direct connect,
10:48 and when you actually get a chance
10:49 to set up those routes, right?
10:52 So with that,
10:53 now we will get into the BGP community side of it,
10:56 and let's see how BGP communities
10:58 influence the routing decision,
11:00 as well as scope for your routes while using the public VIF.
11:04 So stay tuned and thanks for watching.
整讲总结 / Overall Summary
中文
多条 Public VIF 的双活（Active-Active）设计要求客户使用公网自治系统号（Public ASN），在两条 BGP 会话上通告相同前缀和相同 BGP 属性，AWS 使用等价多路径（Equal-Cost Multi-Path, ECMP）分担流量；Private ASN 不能实现课程所示的这种双活。主备（Active-Passive）设计在 Public ASN 下通过备用链路的 AS_PATH 前置（AS Path Prepending）影响 AWS 到客户的方向，并通过本地优先级（Local Preference）控制客户到 AWS 的方向。在 Private ASN 下，主链路通告更具体的 /25 前缀，备用链路通告通用 /24，利用最长前缀匹配（Longest Prefix Match）实现主用与故障回退。
English
For multiple Public VIFs, active-active requires a public ASN and identical prefixes and BGP attributes on both sessions, allowing AWS to use ECMP; the lecture's design is not available with a private ASN. Active-passive with a public ASN uses AS-path prepending for AWS-to-customer preference and local preference for customer-to-AWS egress. With a private ASN, the primary advertises more-specific /25s and the secondary advertises a generic /24, using longest prefix match for preference and failover.
返回顶部 ↑