Lecture 140: DX Security - Private IP VPN over DX connection (Layer 3)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:05
- 来源：Udemy Lecture 56353839
- Slide 数量：10
- 画面切换：00:18、00:38、00:48、01:16、01:52、02:08、02:13、02:31、02:47
扫描说明
逐条检查了 Udemy 页面中的 55 条 Transcript cue，并扫描了全长约 4:05 的视频。依据 Private IP VPN 特性逐条渐显、Transit Gateway 架构、VPN 创建表单、TGW CIDR/Outside IP、路由表与带宽说明，共划分为 10 个小节。最终截图采用暂停在精确 Transcript cue 后将指针移出播放器的方式，避免画面推进到转场，同时隐藏播放器控件；10 张截图均无黑边、无顶部课程栏、无底部或中心控件，也无右侧或下方裁切，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Private IP VPN over DX 概览
时间范围：00:00–00:18
总结 / Summary
中文
Private IP VPN over Direct Connect（DX）使用中转虚拟接口（Transit VIF），在不暴露公网端点的情况下为 DX 流量叠加 IPsec 加密。
English
Private IP VPN over Direct Connect uses a Transit VIF to add IPsec encryption to DX traffic without exposing public tunnel endpoints.
Transcript
00:00 Alright, now let's talk about another type of VPN that you can use with the Direct Connect
00:05 connection and that is Private IP VPN.
00:08 And so far, we haven't talked about this.
00:11 So, now let's see how it works.
00:13 So, Private IP VPN, of course, uses the private IPs instead of public IPs.
2. VPN 两端都使用私有 IP
时间范围：00:18–00:38
总结 / Summary
中文
Private IP VPN 的 AWS 侧与本地侧隧道外部端点都使用私有 IP 地址（Private IP Addresses），因此无需 Public VIF 或公网 IP。
English
Private IP VPN uses private addresses for the outside tunnel endpoints on both AWS and on-premises sides, eliminating the need for a Public VIF or public IPs.
Transcript
00:18 So, VPN tunnels that you are going to establish will have the private IPs on both the side,
00:24 AWS side, as well as on the customer side.
00:28 And the underlying transport for the traffic will be your Direct Connect connection.
00:33 And of course, this is designed for the organization where security policies prohibits the use
3. 适合禁止公网 IP 的安全策略
时间范围：00:38–00:48
总结 / Summary
中文
该方案适合安全或合规策略禁止公网 IP（Public IP Addresses）的组织，可减少公共攻击面并满足端点私有化要求。
English
The design suits organizations whose security or compliance policies prohibit public IPs, reducing public exposure and keeping tunnel endpoints private.
Transcript
00:38 of public IP addresses, and we already talked about that.
00:42 And this Private IP VPN is only supported to be terminated on the transit gateway.
4. 仅支持 Transit Gateway
时间范围：00:48–01:16
总结 / Summary
中文
Private IP VPN over DX 只能终止在中转网关（Transit Gateway，TGW），不支持虚拟私有网关（Virtual Private Gateway，VGW）。
English
Private IP VPN over DX can terminate only on a Transit Gateway; a Virtual Private Gateway is not supported.
Transcript
00:48 So, the VPN gateway or the virtual private gateway is not supported.
00:54 And further, as you know, in order to connect your Direct Connect connection to the transit
00:58 gateway, you should have the Direct Connect gateway.
01:02 And in order to connect Direct Connect gateway, you need to first create the transit wave
01:02 on the Direct Connect connection.
01:08 Okay, so I hope it is clear and with that, now let's quickly look at the architecture
01:12 for this Private IP VPN over the Direct Connect connection.
5. Private IP VPN + TGW 基础拓扑
时间范围：01:16–01:52
总结 / Summary
中文
多个 VPC 连接到 Transit Gateway（TGW），TGW 再通过 Direct Connect Gateway 和 Transit VIF 到达本地客户网关，IPsec 隧道沿这条私有路径建立。
English
Multiple VPCs attach to a Transit Gateway, which reaches the on-premises customer gateway through a Direct Connect Gateway and Transit VIF; the IPsec tunnels follow this private path.
Transcript
01:16 So, as you can see here, there is this transit gateway which is connected to multiple VPCs.
01:22 And now, on top of this Direct Connect connection, you will first create the transit wave.
01:28 Then you will create the Direct Connect gateway on top of this transit wave.
01:32 And then you will associate your transit gateway with this Direct Connect gateway.
01:37 Now once that is done, then in the transit gateway, you can create the VPN connection,
01:43 but it will be with the Private IPs.
01:46 And just to show you the UI for that, so when you create the VPN connection, if you just
6. 创建 VPN 时选择 Private IPv4 Outside IP
时间范围：01:52–02:08
总结 / Summary
中文
创建 Site-to-Site VPN 时，应把目标网关类型设为 Transit Gateway，并把隧道外部 IP 地址类型（Outside IP Address Type）选择为 Private IPv4。
English
When creating the Site-to-Site VPN, select Transit Gateway as the target gateway and Private IPv4 as the outside IP address type.
Transcript
01:52 go down here, you see outside IP address type, that should be private IP for addresses.
01:58 Not sure if you can still see it because it's in a small text, but here the transit gateway
02:03 allows you to create this VPN connection using the private IPs.
7. 返回 Private IP VPN 架构
时间范围：02:08–02:13
总结 / Summary
中文
完成 VPN 参数选择后，架构仍以 Transit VIF 和 Direct Connect Gateway 连接 TGW 与本地网络，Public VIF 不参与。
English
After the VPN parameters are selected, the architecture still connects TGW to the on-premises network through a Transit VIF and Direct Connect Gateway, with no Public VIF involved.
Transcript
02:08 And as you create the transit gateway, you can also define the CIDR block for the transit
8. TGW CIDR 提供私有隧道外部地址
时间范围：02:13–02:31
总结 / Summary
中文
Transit Gateway CIDR（TGW CIDR）为 VPN 分配私有外部端点地址；示例使用 10.10.0.0/24，并从中选择 10.10.0.1 和 10.10.0.2。
English
The Transit Gateway CIDR supplies private outside endpoint addresses for the VPN; the example uses 10.10.0.0/24 and selects 10.10.0.1 and 10.10.0.2.
Transcript
02:13 gateway, for example, 10.10.0.0.24.
02:17 And out of this CIDR range, transit gateway will choose the outside IP addresses for setting
02:23 up this VPN tunnels.
02:26 And once that is done, then you can configure the route table for the transit gateway, which
9. TGW 路由表连接多个 VPC
时间范围：02:31–02:47
总结 / Summary
中文
TGW 路由表（Transit Gateway Route Table）把各 VPC 前缀指向对应 VPC 附件，并包含通往本地网络的 VPN 路由，从而实现端到端转发。
English
The Transit Gateway route table maps VPC prefixes to their VPC attachments and includes the VPN route toward the on-premises network, enabling end-to-end forwarding.
Transcript
02:31 has this route to take the traffic to your on-premise network through this VPN connection.
02:37 So this is the overall architecture for this private IP VPN.
02:41 And with respect to the bandwidth and all, so of course, single connection can have maximum
10. 创建 DX Gateway 附件与提升汇总带宽
时间范围：02:47–04:05
总结 / Summary
中文
需通过 Transit VIF 创建 Direct Connect Gateway（DX Gateway）并附加到 TGW。单条 VPN 连接约为 1.25 Gbps，但可在 TGW 上使用基于 BGP 的等价多路径（ECMP）跨多条连接提高汇总带宽。
English
Create a Direct Connect Gateway over the Transit VIF and attach it to the TGW. Each VPN connection is about 1.25 Gbps, but BGP-based ECMP across multiple connections can increase aggregate throughput.
Transcript
02:47 bandwidth of 1.25 Gbps.
02:50 But because we are using the transit gateway, we can also use multiple VPN connections there
02:55 and we can use BGP routing so that it supports the equal cost multipath and thereby provides
03:02 a higher aggregated bandwidth, right.
03:06 So I hope it is clear.
03:08 Okay, so with that, we have seen both options for layer 3 encryption for setting up the
03:14 side-to-side VPN.
03:14 And just to recap, you can either have the standard VPN, which goes over the public IP
03:21 and then over the AWS side, it could be virtual private gateway or say VPN gateway or the
03:27 transit gateway.
03:28 And there you would have to use public WIF on the direct connect connection.
03:32 Otherwise, if there is a problem using the public IPs, then better option is to use private
03:38 IP VPN and there you have to use the transit gateway on the AWS side and on the direct
03:44 connect, you have to use the transit WIF and then you would have to also create the direct
03:49 connect gateway, right.
03:51 So I hope it is clear.
03:53 And with that, now in the next lecture, let's talk about the layer 2 encryption using something
03:58 called MACsec security protocol.
04:01 So thanks for watching and let's go to the next lecture.
整讲总结 / Overall Summary
中文
Private IP VPN over Direct Connect（DX）在 Transit VIF 上建立 IPsec 隧道，AWS 与本地端点都使用私有 IP，适合禁止公网地址的安全和合规环境。该功能只支持 Transit Gateway（TGW），不支持 VGW；TGW CIDR 为隧道分配 Outside IP，TGW 路由表负责 VPC 与本地前缀的转发。连接还需要 Direct Connect Gateway 附件；单条 VPN 约 1.25 Gbps，可通过多连接 BGP ECMP 提升汇总带宽。
English
Private IP VPN over Direct Connect builds IPsec tunnels across a Transit VIF using private endpoint addresses on both AWS and on-premises sides, making it suitable where public IPs are prohibited. It supports only Transit Gateway, not VGW; the TGW CIDR supplies tunnel outside IPs and the TGW route table forwards VPC and on-premises prefixes. A Direct Connect Gateway attachment is also required. Each VPN connection provides about 1.25 Gbps, and multiple connections can use BGP ECMP for higher aggregate throughput.
返回顶部 ↑