网络课程笔记

00:00 Okay.

00:00 So based on what we learned in the direct connect section and based on my understanding of networking

00:07 and reading a lot of white papers and looking at various architecture, I have tried putting together

00:14 the architecture, which probably should work for most of the large enterprises.

00:19 Now there could be a different variants of the architecture, but then I have tried covering all the

00:25 aspects which you probably think while designing the direct connect architecture for large enterprises.

00:31 So let's dive deep into this architecture.

00:36 So imagine you are a large enterprise.

00:39 That means you have operations into multiple geographies.

00:43 So you must be using the multiple AWS region as well as you would have multiple data centers as you

00:51 are operating your networks from.

00:53 And in all likelihood, you would want to connect all these data centers to AWS regions and applications

01:01 running inside those regions as well.

01:04 So this is a sample architecture where there are multiple regions and then you have two data centers

01:09 just for simplicity, one in us and one in Singapore.

01:13 And of course being a large enterprise, you would have multiple AWS accounts and these accounts will

01:18 be across multiple regions.

01:21 Let's assume that one of the applications sits only in one account and in one particular region, right?

01:26 So likewise you would have multiple accounts and in that accounts you will have multiple vpcs and likewise

01:34 you would have public services.

01:36 So for example, you are storing data in S3, which is accessible over the Internet, and you want to

01:42 make sure that all these services are accessible from your on prem data center as well as VPC should

01:48 also be able to access your applications running in your on premise data center.

01:53 Now out of this, I have categorized these vpcs as application vpcs.

01:58 That means they have the applications which are kind of business applications.

02:03 They don't do much of the data transfer, but in certain cases you might have applications which are

02:08 very data heavy.

02:10 That means from on premises to AWS, there will be a lot of data exchange.

02:15 Now examples could be if you are running high performance cloud that is HPC compute or you are working

02:22 on some media kind of application like Netflix for example, you are uploading or downloading a lot

02:28 of data or you are running some AV.

02:31 Or autonomous driving simulations there.

02:34 Also, you upload a lot of data to AWS and also download that data back to your data center.

02:39 Now in that case, it's a separate VPC.

02:42 We are considering it as a separate case because I would suggest to go with different kind of connectivity

02:48 in that case.

02:49 Okay, so this is a setup and we want to make sure that all these vpcs can also communicate with each

02:56 other and also with the data center.

02:58 So in enterprise world, typically you won't do it account by account, but you would have a centralized

03:04 networking hub account.

03:05 Now that also aligns with AWS landing zone concept where a centralized team takes care of the networking

03:14 and then they enable the connectivity between multiple AWS accounts and multiple vpcs so that nobody

03:21 can really change those network.

03:23 Only the network administrator of the account can make those changes.

03:27 Now this is all about AWS landing zone and the best practices, but this is how typically it will be

03:33 done.

03:34 Okay, now for connecting multiple vpcs together, you know that you should use transit gateway because

03:40 it scales as well to hundreds and thousands of vpcs and transit gateways are the regional routers.

03:46 So in every region you would have a transit gateway.

03:49 And then if you want to have inter region VPC connectivity, you would pair this transit gateways together.

03:56 So which means now region one, VPC can talk to region two through this transit gateways.

04:04 And of course, you connect these vpcs to corresponding transit gateways.

04:08 So this enables a mesh kind of connectivity between the vpcs.

04:13 Moving on.

04:14 You also want to connect your data centers to the transit gateways, and you already know that you can

04:20 do that using the Transit Gateway and Direct Connect Gateway.

04:24 Now for US Data Center, you will choose the nearest direct connect location in the US.

04:31 Similarly for Singapore, you will choose the location in Singapore and then you will have a physical

04:36 network connectivity between your data center and this direct connect locations.

04:40 You will provision a direct connect gateway.

04:43 You will create a transit VIF on both these connections and then you will connect to the same direct

04:49 connect gateway.

04:50 Now this will allow the complete mesh connectivity between all your vpcs and your data centers.

04:59 Right.

04:59 Okay.

05:00 So this is a good option.

05:02 And we also learned recently that if you want to have the connectivity directly between your data centers,

05:09 you don't need to really route this traffic back to the transit gateway.

05:13 You can simply enable the sitelink on those transit VIF and then Sitelink can enable the routing of

05:21 the traffic over the AWS backbone network between these sites.

05:26 So this really simplifies your networking though.

05:29 This is looking complex, but this is really, really simple architecture in that sense.

05:33 So now you have the full kind of connectivity with most optimized route, and this works well.

05:41 Okay.

05:41 And finally, as you know, recommends having high availability of the network.

05:45 Ideally, there should be multiple links, but just for simplifying the diagram, I'm not showing it.

05:51 And optionally, you could also have the VPN connectivity as a backup.

05:56 So from your on premise data center, you could directly have the VPN connectivity to the transit gateways

06:02 like this, and that can very well act as a backup network connectivity.

06:08 Okay, so far so good.

06:09 What we haven't talked about so far is this a VPC, which does the high data transfer between your on

06:16 premise data center and why we are not connecting this to the transit gateway?

06:21 We could have, but we are not, because Transit Gateway has a lot of charge when it comes to per GB

06:29 data processing.

06:30 Typically this is $0.02 per GB.

06:33 This looks small, but if this VPC is doing, you know, terabytes and petabytes of data transfer or

06:40 this transit gateway, then this is a huge cost and it would make sense to avoid using transit gateway

06:48 in such scenarios.

06:49 So the choice for us is why don't we directly use a private Vif you can have your private Vif over this

06:57 direct connect location and then you can connect it to the gateway or you can directly connect private

07:03 Vif to the virtual private gateway.

07:05 But there is no cost for the gateway.

07:08 So I would recommend that you use the gateway instead, because in the future, if there are many such

07:13 vpcs to be connected, then you can connect through the same gateway over the same private wave.

07:19 So it would make sense that you directly connect that to this another gateway.

07:24 That way you avoid the cost of this transit gateway.

07:30 Okay.

07:30 And finally, if you want to connect to the public services, like, for example, S3, again, you

07:37 don't want to send that data through Transit Gateway or through your VPC because there would be additional

07:43 cost.

07:44 Because if you want to send the data to S3 through VPC, you would want to have the VPC interface endpoint

07:51 provisioned inside the VPC.

07:53 And that interface endpoint also has PER-GB data processing cost.

07:57 So it's better you directly use a public VIF there on the same direct connect connection.

08:04 And in that case you avoid all those charges.

08:07 Now you know that for public Vif you need additional settings in the sense that you need public IP at

08:14 both the ends and you have to make sure that you are using the firewalls at your router.

08:19 Because once you connect your network over a public wave, any AWS customer can send the data through

08:26 your public wave to your public IPS.

08:29 So you need to be just a little more careful and put the right firewall while using the public wave.

08:35 But definitely it saves you a lot of cost instead of using the transit wave or a private wave.

08:43 So this is how your architecture should look like if you are having your operation across multiple regions

08:50 and data centers.

08:51 As I said, there could be multiple variants of this architecture, but I hope this gives you an overall

08:56 picture of connectivity.

08:59 So that's it about this lecture.

09:01 I hope you enjoyed it and let's get going.

09:04 Thank you.