网络课程笔记

00:00 Okay, so in this lecture

00:01 now let's look at some of the troubleshooting tips

00:04 with respect to the DirectConnect issues.

00:06 Now, this would be again helpful for your exam

00:08 because, given a scenario, you should be able to know

00:12 where exactly to look

00:14 for solving that particular problem,

00:16 or an issue.

00:17 So with respect to the DirectConnect,

00:19 there could be issues at different layers.

00:23 I mean, you can categorize these issues

00:25 in the VSL layer model.

00:27 For example, there could be a issue at the physical layer

00:30 or there could be issue at the routing layer.

00:33 So depending on at which layer the issue is,

00:36 we can definitely put some troubleshooting steps.

00:39 So let's get started.

00:40 First thing, when there is no physical connectivity,

00:44 that means you are not able to really receive any signals

00:49 from the DirectConnect connection.

00:50 So primarily these issues could be at Layer 1.

00:54 Now, in this case, what you need to check is,

00:55 of course, the Cross Connect is complete

00:58 by the DirectConnect location provider.

01:00 When you go for a dedicated connection

01:03 or a hosted connection,

01:05 you have to make sure

01:06 that the DirectConnect location provider

01:08 has completed the Cross Connect.

01:10 Now, in case of dedicated connection, if you remember

01:13 for this you are to hand over the LOA/CFA

01:16 to the DirectConnect provider,

01:18 and then he will do the Cross Connect for you.

01:21 In case of hosted connection,

01:22 it is...

01:23 A DirectConnect partner

01:24 from whom you are taking the hosted connection

01:26 will do this activity for you.

01:28 Then you are to make sure ports are correct,

01:31 the routers are powered on,

01:32 the Tx and Rx signals are being received.

01:36 Now we know that using CloudWatch we can see that.

01:39 And then if there are no Tx/Rx signal,

01:42 then you can contact the colocation provider

01:45 and they can give you the report of the Tx and Rx signals.

01:50 Now, looking at that report,

01:51 you can see that where is the problem

01:53 with respect to the signals.

01:55 Also, you know, in the CloudWatch,

01:56 it also provides the physical error count

01:59 on the AWS devices.

02:00 So that will also give you some indication of the problem

02:03 at the physical layer.

02:05 And nothing out of this works,

02:07 then obviously you can contact AWS support.

02:10 So this is how you will troubleshoot the Layer 1 issues.

02:13 Now, if the connection is up, but still your VIFs are down,

02:18 so you might've created a public VIF or a private VIF

02:21 and those VIFs are not working,

02:23 then you are to make sure the IP addresses

02:25 that you provide while creating the VIFs, right,

02:28 those are correct.

02:29 Now, if you remember, while creating the public VIF

02:32 you provide the public IP ranges

02:33 on the customer router end as well as AWS end

02:37 for BGP session,

02:38 as well as you also advertise the prefixes

02:41 on the customer end.

02:42 Now those IPs must be owned by the customer, you know that,

02:45 so you are to make sure it is correct,

02:47 VLAN IDs are correct. So what are tags you are using now?

02:50 You know that if it's the same connection

02:52 VLAN tags should be unique

02:53 across all VIFs on the same connection.

02:55 So you have to make sure VLAN IDs are correct.

02:59 The router MAC address in the ARP table, that means...

03:02 You know, ultimately at Layer 2,

03:04 the IP addresses are mapped to the MAC addresses

03:07 for the routers, right?

03:09 So in that case,

03:10 you are to make sure MAC addresses are correct.

03:12 If not, then you can also try cleaning your ARP tables

03:17 and also you are to make sure

03:19 if it's a issue with the VLAN,

03:21 then VLAN truncing is enabled at the intermediate devices.

03:24 Now this is more on your side of the network

03:27 because the connection from DirectConnect location to AWS

03:31 is, again, managed by AWS,

03:33 but from DirectConnect location

03:35 to the on-premise data center, whatever network is there,

03:39 if there are multiple hubs and routers in between

03:41 you are to make sure VLAN truncing is enabled there as well.

03:44 And of course, if nothing out of this works,

03:46 then contact AWS support.

03:49 So now assuming that your connection is up, the VIFs are up,

03:53 but still the traffic is not going,

03:55 and you see that the BGP session is down.

03:59 So for that, you are to make sure

04:00 when you give the parameters for the BGP session,

04:04 you give the correct ASN numbers.

04:07 Now, you know that if you are using the public VIF

04:10 and you are doing a public ASN,

04:11 that ASN has to be owned by the customer

04:14 and AWS verifies that.

04:16 Then you also provide the peer IPs for the BGP session.

04:20 Those needs to be correct as well.

04:22 Now, in case of public VIF

04:24 you know that these IP addresses

04:25 should also be owned by the customer.

04:28 Then comes the MD5 Authentication key.

04:31 Make sure that there are no additional spaces

04:34 and you provide your own MD5 Auth key

04:37 or you use the one generated by AWS.

04:40 But when you expose these configurations

04:43 and apply the same key on your side of the router,

04:46 that means customer side of the router,

04:47 you don't make mistake while putting those keys.

04:50 Then you know that in case of private VIF

04:54 you can't advertise, or you shouldn't advertise

04:56 more than 100 prefixes.

04:58 Otherwise the BGP session goes down

05:01 and for public VIF this limit is 1000 prefixes.

05:05 So no more than 1000 prefixes should be advertised

05:08 from customer into AWS side.

05:10 You also know that for BGP session,

05:13 it uses TCP 179 port number.

05:16 So you are make sure that the firewalls at customer end

05:18 are not blocking this port.

05:20 Otherwise you can always look at the BGP logs

05:23 and again, if nothing works,

05:25 your BGP session is still down,

05:27 you can contact AWS support.

05:30 Now let's take the final approach where everything is okay,

05:34 connection is okay,

05:35 VIFs are up,

05:36 BGP session is also up,

05:38 but still the traffic is not reaching to the destination.

05:42 So in that case,

05:43 it could be a problem with your maybe routing tables,

05:46 but we can see that if you are advertising the right routes

05:52 for the on-premises prefixes.

05:53 Because on AWS end those routes will be propagated,

05:57 and if your IP address is not part of the prefixes

06:00 that you advertise,

06:01 then AWS won't route that traffic to your network

06:05 using the DirectConnect connection.

06:07 Now for public VIF it should be publicly routable prefixes.

06:10 We already talked about that.

06:12 Now on AWS side, you are to make sure your security group,

06:15 which is attached to EC2 machines or ENIs,

06:18 are not blocking the traffic

06:20 or at subnet level

06:22 network access control lists are not blocking the traffic

06:25 from the source IP addresses of your on-premise network.

06:29 And you should also check your VPC Route table

06:31 that there is route exist to take that traffic

06:35 from AWS to on-premise network.

06:37 Now these routes could be static

06:39 or these routes could be dynamic propagated one.

06:42 So make sure those routes are available,

06:44 without that traffic cannot flow in either direction.

06:48 Now, if you want to further understand

06:49 these troubleshooting steps,

06:51 then I would recommend that you visit the AWS documentation

06:55 where the troubleshooting steps have been explained

06:57 in further details.

06:59 But as of now, that's it

07:00 for troubleshooting AWS DirectConnect connection issues.

07:04 So I think we covered pretty much about AWS DirectConnect

07:08 and it's time now to just recap what we saw

07:10 for the DirectConnect.

07:12 And in the future if there are more topics,

07:14 I would be happy to add it in the same section.

07:17 So thanks for watching.