网络课程笔记

00:00 Hello, and welcome to this lecture.

00:01 Now that you understood the routing scenarios

00:05 in case of using public VIF,

00:07 now let's understand how BGP communities influence

00:11 the route advertisement for the public VIFs.

00:15 So in this lecture will also learn about BGP communities

00:19 and then how BGP communities can be used in a public VIF.

00:22 Now understand that BGP communities play different role

00:26 while using the public VIF and a private VIF.

00:29 So this discussion is for public VIF only.

00:33 So as you know, the BGP communities

00:36 are used to control the scope of your routes.

00:40 Now let's understand what do I mean by controlling

00:42 the scope of the route.

00:44 So typically when you receive the on-premises prefixes

00:49 or routes or a BGP session on AWS site,

00:53 you have a choice or you have a control

00:57 where those routes can be propagated to all AWS regions

01:01 or you know particular AWS region, for example,

01:05 and the requirement could be,

01:07 you only want to have the connection with one AWS region

01:12 because your company do not operate

01:14 or do not use other AWS regions

01:16 so there is no point in opening the routes

01:19 for the other regions to communicate

01:22 with your on-premise network.

01:24 Now in that case you can control that advertisement

01:27 that I am sending these routes from my customer gateway,

01:31 but these route should be advertised to only

01:33 the primary AWS region where the direct connection

01:37 is established and do not advertise it to other AWS regions.

01:41 So this is a kind of example,

01:43 and you can completely control that route advertisement.

01:47 So as with the public VIF,

01:50 there are different community that support it

01:55 for inbound connection, there are three BGP community tags

01:59 which are supported 722491001900 and 9300.

02:05 That means this will be applicable

02:07 for the routes which are received

02:09 from customer network to AWS

02:13 and similarly, AWS also attaches the BGB community

02:17 while AWS sends those route prefixes

02:19 to your end or the customer end.

02:22 And now we'll understand the effect of

02:25 using different community tags.

02:27 Apart from this community tag,

02:30 AWS also supports the NO_EXPORT BGP community tag.

02:34 And again, we talked about this briefly

02:37 in the last lectures,

02:38 but we will explicitly now understand what that means.

02:43 So if I just want to show here,

02:45 whenever routes are advertised from customer router

02:48 to AWS customer route can set any of this BGP communities

02:54 and when AWS sends the route of AWS public IPS

02:58 and prefixes to the customer network,

03:00 it can also set this BGP community tags.

03:04 And now let's understand what that means.

03:06 So first look at the inbound communities.

03:10 Now, the prefixes received from the customer

03:13 on public VIFs are advertised within the AWS

03:16 as per the BGP community tags.

03:18 As I said, you can set the BGP community tag

03:21 then you advertise the route

03:23 from the customer network to AWS, right?

03:25 So if you set the community tag 72249100,

03:30 then those prefixes or routes are advertised

03:34 only local AWS region where their direct connection

03:38 is located, right?

03:41 That means those routes are not advertised

03:43 to other AWS region.

03:45 Now, if you're send the BGP community tag with 9200 instead,

03:50 then get outside propagated to corresponding AWS continent,

03:54 or there is a continent and multiple regions

03:57 that included those in those continents. So for example,

04:00 there is North America as a continent.

04:03 So most of the AWS regions in North America

04:06 will be a part of that continent.

04:08 So your routes will be advertised

04:10 to Northern America continent.

04:12 As similarly, there is Asia Pacific,

04:14 as well as there is a Europe, middle east and Africa.

04:17 So these are the three continent currently supported.

04:20 So now this again,

04:21 depends on how far do you want your routes

04:24 to be advertised within the AWS regions?

04:27 If you think that you operate

04:28 or use only North America based US regions,

04:32 then you will set the BGP community tag is 9200.

04:36 And similarly, there is one more BGP community tag,

04:40 which is 7224:9300

04:43 and this means that everything that AWS city sees

04:48 as the routes in a BGP session,

04:51 it will advertise it to all AWS regions.

04:54 And this is the default option as well

04:57 for your BGP communities.

04:58 That means if you do not attach any BGP community

05:02 while advertising the route,

05:03 then 72249303 it's considered

05:07 and routes are propagated to all AWS regions.

05:10 So this is what the inbound BGP communities looks like.

05:15 Now, if you are using the community tag as 92249100,

05:20 then all the routes received are only published

05:25 or advertised to the local AWS region

05:27 in which the Direct Connect connection is located.

05:30 So in this case, my Direct Connect location is a Frankfurt.

05:33 So only this particular region would receive that route.

05:37 And which means that you can't really access

05:40 the public AWS services from other AWS regions,

05:44 because they don't know how to route traffic back

05:47 to on-premises. They do not have your route prefixes.

05:53 Now, if you change it to 9200,

05:55 then as I said, it goes to per continent.

05:58 So Ireland and Frankfurt are part of a same continent.

06:01 So route will be advertised to both of these regions

06:06 and any additional regions if they fall

06:08 into that particular continent.

06:10 And you can look at the AWS documentation around

06:12 which region falls into which continent

06:15 and this list will ever grow, right?

06:16 Because number of regions are increasing.

06:19 So that's not the point. The point is that

06:20 with 72249200 BGP community tag,

06:25 routes will be advertised to a particular continent.

06:30 Similarly, if you send 7224:9300 as a BGP community tags,

06:35 then anyways, it will be advertised to all AWS region.

06:39 And this is also the default BGP community tag.

06:42 So if you don't send anything,

06:43 then also the same thing will be done.

06:46 So this is how the inbound community tags works.

06:49 Now let's look at the outbound community tags.

06:53 Outbound means, for the routes

06:55 which are sent by AWS to on-premise router.

06:59 Now, in this case, AWS applies different BGP community tags,

07:04 and let's understand what those are and what that means.

07:07 So AWS can send you know 72248100.

07:12 And this means that the routes are being sent

07:15 from the same AWS region in which the AWS Direct Connect

07:19 point of presence is associated.

07:21 Now, this is something like,

07:24 when you receive the routes at your end,

07:26 you can understand that

07:28 these routes am receiving from a local AWS region

07:32 in which I have Direct Connect connection.

07:34 So AWS will always associate

07:36 this particular BGP community tag.

07:39 And if the routes are being sent

07:42 from that continent on the AWS site,

07:45 then AWS will also attach this additional BGP community tag

07:50 that is 72248200.

07:52 So now at your end,

07:53 you understand that if you see on the routes,

07:56 you see this BGP community tag, you understand that,

07:58 these routes are getting published by the continent.

08:04 So it can be a local reason

08:06 or it could be another region from the same continent.

08:10 And that's where on your site,

08:12 you can then put a filter, right?

08:15 If the outside from local region

08:17 or outside from continent.

08:19 Accordingly, you can take decision

08:20 whether you want to accept that route or not. Right?

08:23 Similarly, if the routes are being advertised

08:26 from region outside of the continent,

08:29 then AWS does not put any tag,

08:30 that means there is no tag and then at your end,

08:34 you understand that this route is coming

08:36 from the global AWS region,

08:38 which is not part of a continent

08:40 in which you have the Direct Connect connection.

08:42 So ultimately looking at this BGP community tags,

08:46 you can understand that whether I'm receiving these routes

08:49 from the local region or the continent,

08:52 or from the global AWS region.

08:54 And now it's up to you now,

08:56 whether you want to accept those routes,

08:59 or you want to drop those routes so that you can control

09:03 that your customer network can talk to a local region

09:08 or multiple regions in the continent

09:10 or all the regions, which AWS has.

09:14 So that decision is with you

09:16 by using this BGP community tags.

09:18 So hope that is clear.

09:21 And now, apart from this tags,

09:23 AWS also advertises another tag

09:26 which is no export community tag,

09:29 and I just talked about that briefly earlier

09:32 that NO_EXPORT means,

09:33 you should not further advertise these routes,

09:36 which you receive from the AWS to other networks

09:39 out of your network, right?

09:40 Because this is a private connection between AWS

09:43 and your network. So there is no need

09:46 that you advertise these route,

09:48 which you receive from the AWS to

09:51 the other network, which you are connected to,

09:53 but AWS is not connected to.

09:55 So that's where that NO_EXPORT Community tag is put

09:58 on all the routes with AWS sends.

10:01 Then the customer router can choose which prefixes to accept

10:04 by filtering the routes based

10:05 on the BGP community associated with this routes.

10:08 And I just explained that based on

10:10 whether you want to have a connection

10:12 or the communication between local region

10:14 or whole continent or to all public AWS regions.

10:19 So now let's try to understand the same thing here.

10:22 Okay. Now let's try to visualize what we just said, right?

10:25 So maybe you have your Direct Connect connection

10:27 in the Frankfurt region.

10:29 And then there is a AWS Frankfurt region

10:32 and there are public services,

10:34 and this is a European continent

10:36 as for the distinction that AWS has done.

10:38 And there could be other regions in this continent, right?

10:42 Now, in this case for the outbound traffic

10:45 or the outbound routes from AWS to your network,

10:50 you can see that AWS publishes the routes

10:53 as well as the BGP community tag.

10:56 Now, this is a local region because the connection

10:59 is in the same region.

11:00 AWS will advertise the prefixes.

11:02 Now this prefixes means the public IP address,

11:05 prefixes of all AWS services in the Frankfurt region, right?

11:10 And along with those routes,

11:11 AWS will also associate this particular BGP community tag

11:15 that is 72248100,

11:18 which means that the routes are coming from a local region.

11:22 So you're connected to local region

11:23 as in Frankfurt via Direct Connect.

11:25 So routes are being sent by the Frankfurt region.

11:30 Now, if you have another region like Ireland,

11:33 it falls into the same continent.

11:35 Then also you will receive those routes,

11:37 but then there will be a different BGP community there.

11:40 That's what we just learned.

11:42 And there could be also routes sent

11:45 by the public region like North Virginia,

11:48 which is not part of the same content,

11:50 in that case from Ireland, when the routes are received,

11:54 it has the community tag as 72248200.

11:58 And if they're outside from North Virginia,

12:00 then there will be no tag.

12:02 Now, along with all these different tags,

12:05 it would also have the NO_EXPORT tag.

12:08 So whenever routes are received

12:09 along with whatever BGP community tag it has,

12:12 along with that, additionally,

12:13 there will be no export tags.

12:14 So they, they have like multiple tags on the same route.

12:18 Now, what you can do is you will receive this routes

12:22 as well as BGP communities at your end

12:25 and with the NO_EXPORT,

12:27 you can't really have this advertised

12:30 to other route table or a public route table

12:33 which are all over the internet, right?

12:34 You should keep those routes within your network.

12:37 That means that's what this NO_EXPORT means.

12:40 Now, additionally you can filter the traffic

12:42 as we are saying, right?

12:45 So you want to only have the communication

12:47 with local AWS region in that case, what you'll see,

12:50 you'll see the routes coming in, say for example,

12:53 routes from the Ireland region,

12:54 and you will see that there is

12:56 a BGP community tag 8200

12:58 but I don't want to have my communication

13:01 with the Ireland region. So you drop those routes.

13:04 You don't accept those routes.

13:06 You don't publish or further advertise those routes

13:08 to your route table, right?

13:10 So all this kind of filtering you can do

13:13 while you receive those routes from the AWS end.

13:16 So this is how the BGP communities work

13:18 for our public interface,

13:21 and I hope that is a little more clear

13:24 what is the purpose of BGP communities

13:26 and how the scope the route advertise meant

13:30 for inbound as well as outbound route advertisement

13:34 or BGP session.

13:36 So with that now,

13:37 I think we covered everything about the public VIF,

13:40 the first talk about the routing policies for public VIF,

13:44 these are various architectures like active, active,

13:46 and active passive connections.

13:48 And then we saw the BGP communities,

13:51 how you can have the different scope of the routes

13:54 while using the inbound as well as outbound BGP communities.

13:59 So I think that's it for the public VIF routing policies

14:03 and BGP communities

14:04 and now let's look at the private VIFs routing policies

14:08 and the BGP communities.

14:10 So thanks for paying attention.

14:12 And now let's get into the next lecture.

14:15 Thanks for watching.