网络课程笔记

00:00 Hello and welcome to this new topic.

00:02 AWS cloud Wan.

00:04 Wan is wide area network.

00:06 Now this is very interesting topic and it solves lot of problems which probably are complex to solve

00:15 with just using AWS networking components that you have seen so far.

00:20 Now, we have already talked about connecting different networking components in AWS.

00:24 For example, how do you connect multiple VPCs?

00:27 How do you use transit gateways?

00:29 Then?

00:30 How do you set up your hybrid network using the VPN or Direct Connect?

00:35 But if you really look at the large enterprises, they have their legacy network spread across the globe,

00:41 right?

00:42 And also then they operate in AWS.

00:45 So often it is required that you have one single pane of network management.

00:52 And as you might have guessed, that's what is AWS cloud Wan.

00:57 So AWS launched AWS cloud Wan service, which allows you to build, manage and monitor the global network

01:05 across AWS and on premises network.

01:08 And we are going to dive deep into further what cloud Wan is and what are the components of the cloud

01:13 Wan.

01:14 The best part of cloud Wan is that it's a policy driven.

01:17 That means you define the network policy like you do with any software defined networks, and just apply

01:24 that policy and it will take into the effect.

01:28 And further, you get a single pane of dashboard through which you can monitor your entire global network.

01:35 And this is done through AWS Network Manager.

01:38 So we will also see how that network looks like and what kind of different views you can have, and

01:44 how you can monitor the performance and all the network links into your network architecture.

01:50 So essentially cloud Wan is something like this.

01:54 You connect your VPCs, your direct connect your site to site VPN or even your SD-Wan networks through

02:01 the network attachment to AWS cloud Wan.

02:04 And then you have centralized dashboard through AWS Network Manager.

02:08 And as I said, you can change the network configurations through network policy.

02:13 You apply that policy and it will be deployed across the globe.

02:17 So if there are new AWS region in which you want to deploy your network, you just make that change

02:23 in that network policy and then it will take into the effect.

02:27 So I hope that is clear.

02:28 Now let's go back to the basics and see why AWS might have launched AWS cloud Wan, what problems it

02:35 actually solves and what are the complexities otherwise using, you know, other networking components

02:40 for your global network.

02:42 So let's take an example.

02:43 For example, there are two different AWS region in which you have your VPCs deployed.

02:48 Now if you go with very basic construct, probably you will say there are just three VPCs.

02:52 I will just go with VPC peering connection.

02:55 If I need to have this VPC communicate to each other so it will look something like this.

03:01 You connect this to VPCs in North Virginia region.

03:04 And also you connect this VPCs to the other VPC in Mumbai region.

03:12 And as you know VPC peering is non-transitive.

03:12 So you have to also set up this link between these two VPCs.

03:16 So this works well I would say for small number of VPCs.

03:20 And you already know that if there are more VPCs, of course we move to the transit gateway.

03:26 So there are now more VPCs.

03:28 So logically what you will do is you will rather launch transit gateways.

03:32 And transit gateways are regional components.

03:35 And then you will connect these VPCs to the transit gateway in that region.

03:39 And now because you want to have communication between VPCs across the region, you will pair this transit

03:45 gateways.

03:46 So I hope this architecture is pretty familiar to you.

03:50 Now let's add some more complexity and add our third region here.

03:55 Now again you can do the same thing.

03:57 You can have Transit gateway, but again the same challenge that was with the VPC peering scaling.

04:03 Right.

04:03 That means now you have to have the peering between these two transit gateways and these two transit

04:09 gateways, and also between the North Virginia and Mumbai Transit Gateway.

04:14 So you can see that complexity is increasing.

04:17 So as many region you will onboard those many peering connection will be required.

04:22 And on top of this, if you want to connect your direct connect connections, that means you are going

04:27 now hybrid.

04:28 Then of course you would have to have your DCS connection going to the Direct Connect gateway over a

04:34 transit VIF, and then you connect Direct Connect Gateway to the transit gateways in different AWS regions.

04:41 We have already seen this architecture, and on top of which, for high availability, you might want

04:47 to have the VPN connection and SD-Wan connections as well.

04:53 Now just a quick refresher.

04:55 If you go back to the Transit Gateway section, we talked about the SD-Wan.

04:59 In which case you have the SD-Wan appliance sitting on premises.

05:04 Or you can also deploy that inside a VPC, and then you connect to Transit Gateway over the connect

05:10 attachment.

05:11 Then you create a GRE tunnel.

05:13 And that's where your network can be extended to AWS.

05:17 So if you want to add the SD-Wan to this network, again, you can connect it to the Transit gateway

05:23 over a connect attachment.

05:25 And further, if you are using SD-Wan, that means you might also have different routing domain.

05:33 That means you might have different network segments.

05:36 So for example, a different network layer for development or production or shared services.

05:42 Now as you connect your connect attachment to the transit gateway, typically all the routes and routing

05:48 policies are propagated to the transit gateways.

05:51 So it will be automatically propagated through dynamic routing.

05:56 But you know that transit gateway peering doesn't support the dynamic routes, and you have to have

06:03 the static routes written into your route tables.

06:06 And in that case, this becomes a manual task to also update your transit gateway peering.

06:14 So overall, this is really a complex solution for managing this kind of the network.

06:20 And as you might have now guessed, this problem is solved using AWS cloud Wan.

06:27 So you just forget about everything that you see here and just replace all these layers with AWS cloud

06:34 Wan.

06:36 Okay, so Cloud Wan is that one single global network that provides you the centralized connectivity

06:44 for everything that you see in this diagram.

06:47 So before we dive deep into the individual cloud Wan components, let's first understand at a high level

06:53 what those components are.

06:55 Which means what is this cloud Wan is made up of.

06:58 And then we will also try to do a walkthrough where you will create a global network with cloud Wan.

07:06 Okay.

07:06 So what are the components of the cloud Wan.

07:08 So if you double click into the cloud Wan there is something called Global network.

07:14 Now this network consists of core network which we are going to talk about.

07:18 And then Transit Gateway Network.

07:20 Now transit Gateway network is a traditional transit gateways.

07:23 So basically if you are already using the transit gateway you can still manage and see this transit

07:29 gateway in the network Manager console.

07:32 So global network has two components core network and transit Gateway network.

07:36 But we are focusing only on the core network because that's what real cloud Wan is.

07:42 And through this core network, basically you connect all these attachments that we just saw.

07:47 Okay.

07:48 So first thing is to create a global network.

07:51 And then you have to create the core network.

07:53 And as you create this core network it has core network edge which are the regional routers, which

08:00 sits into every AWS region that's called CDN or core Network Edge.

08:06 And then in order to deploy this network you create core network policy.

08:12 And we will see how this policy looks like.

08:14 Now, once you have this core network, you connect all these regions together.

08:20 And then you can divide your network into the routing domains.

08:24 Now those are called network segments.

08:26 And again we will talk about that shortly.

08:29 So you can have development network production network shared services network the way you want your

08:29 network segmentation.

08:35 You can do that.

08:42 And for that network segment of course, you can define the actions as in which network segment can

08:42 share routes with each other, which are isolated network segments.

08:46 All that is possible now after you create the segments, of course, you need to attach your VPCs and

08:53 your VPN to these segments so that they can communicate with each other.

08:58 So next component is attachments.

09:00 And with this attachment you can do some kind of automations as well.

09:04 For example, if you create a new attachment for the VPC, you can tag that attachment.

09:09 And then that VPC will be automatically linked to your development network.

09:16 And we will see how that actually works.

09:19 And finally, you can also pair your existing transit gateway to the core network.

09:25 So this is not necessary.

09:27 But if you have already your network setup in AWS using the transit gateways, and now you want to move

09:34 to the cloud Wan, then it is possible that you bring in your existing transit gateway and pair it with

09:41 the AWS cloud Wan.

09:43 And one thing to understand is that the cloud Wan is a global service.

09:47 But all this configuration data about your network policies and your dashboards, all this data is stored

09:55 in your home region.

09:57 And for cloud Wan, that home region is Oregon.

10:00 Irrespective of in which region you actually deploy your networks, which means it is not necessary

10:06 that you also deploy your core network edge in the Oregon region.

10:11 But it is just used to store all the metadata about your networks in the Oregon region.

10:19 Right.

10:19 So I hope that is clear.

10:21 So now let's try to put everything together.

10:23 What we just talked about.

10:25 So you have this kind of architecture.

10:27 Of course you replace everything with AWS cloud Wan.

10:32 So when you create a cloud Wan you first create a AWS cloud Wan global network, which is combination

10:38 of core network and transit gateways network.

10:41 We are not talking about Transit Gateway network as of yet.

10:44 We are just focusing on the core network.

10:47 So first thing you do is create a core network and you define in which all AWS region you want to have

10:53 your core network, and then it will create the core network edges into those regions.

10:59 And all this can be done using the core network policy, which is basically a Json document.

11:05 But AWS also provides you a console and the UI to change your policy.

11:11 Now, once you deploy your network, of course, you can then create the attachment to the core network,

11:18 whether you have VPCs, you have SD-Wan, you have VPN, or you want to connect your existing transit

11:25 gateway.

11:25 In that case, there will be peering attachment.

11:29 And now let's assume that some of the VPCs are for development.

11:33 Some of the VPCs are for production.

11:35 And then all these hybrid connectivity is your shared network.

11:39 Right.

11:40 So we are just naming the VPCs accordingly.

11:42 And now you want to make sure that all these development VPCs are connected to a separate network.

11:48 And they cannot communicate with the production network.

11:51 And for that as I said, you can create different routing domains, also called as segments.

11:58 And then you can create the attachment which are specific to that segment.

12:03 So you connect all development VPCs to the development segment.

12:07 Similarly, prod VPC to the prod segment and all your hybrid networks to the shared services segment.

12:15 Now, please understand that the segmentation that I have shown here is just an example.

12:20 And typically for your organization, you would have different requirement with respect to how you manage

12:27 your network segments.

12:28 And of course accordingly you will have different routing policies as well.

12:33 So this is just one example here.

12:36 And all these attachments can be automatically added to the segments using some rules.

12:41 And that's called attachment policies.

12:44 And one of the way to do that is using the tags.

12:47 And we will talk about that.

12:49 And finally you could also have the segment routing in the sense that you can define my development

12:56 segment can communicate with the shared services segments, because maybe you want that your event development

13:02 VPCs to be communicating with your on premises network, but you don't want your development and production

13:08 networks to communicate with each other.

13:12 So again, this is just one kind of example where you can set up, you know, interoperability between

13:18 different segments.

13:20 So depending on your network requirement you will definitely decide whether two segment needs to communicate

13:27 with each other.

13:28 Now there are other features as well.

13:30 For example isolated segments.

13:32 In that case, no other segment can communicate with a given segment which is marked as isolated.

13:39 And we will also talk about that.

13:41 So I hope that is clear.

13:42 So that's the cloud Wan in nutshell.

13:45 And going forward let's try to deep dive into the network policies for the cloud Wan.

13:50 And also I will have a quick walkthrough about how to create the cloud Wan network.

13:55 So thanks for watching and stay tuned.