Lecture 150: Hands-On: Set up AWS Cloud WAN network, Segments & VPC attachments
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：26:44
- 来源：Udemy Lecture 42504266
- Slide 数量：59
- 画面切换：00:37、01:00、01:10、01:20、01:38、02:10、02:40、03:00、03:38、04:03、04:39、05:18、05:35、05:41、06:42、06:52、07:08、07:26、07:43、08:09、09:15、09:38、09:58、10:14、10:27、10:50、10:56、11:40、12:06、12:40、12:57、13:16、14:09、14:41、14:47、14:58、15:33、15:46、16:40、17:02、17:31、18:04、18:12、18:35、19:11、20:08、20:58、21:11、21:50、22:07、23:30、24:08、24:23、24:53、25:20、25:27、25:52、26:01
扫描说明
逐条检查了 Udemy 页面中的 408 条 Transcript cue，并扫描了全长约 26:44 的视频。该讲从目标拓扑逐步揭示开始，随后完整演示 Global Network、Core Network、Segment、Segment Sharing、Attachment Policy、VPC Attachment、Core Network Route、VPC Route Table 与 EC2 ping 验证。每个新幻灯片、控制台配置阶段或有意义的状态变化均单独作为小节；剔除 6 个无新增内容、加载态或播放器错误候选帧并重截异常画面后，共保留 59 个画面阶段。最终图片均关闭 Transcript 侧栏与播放器控件，完整保留视频右侧和底部，无黑边，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Cloud WAN 实操目标
时间范围：00:00–00:37
总结 / Summary
中文
本讲将从零搭建 AWS Cloud WAN，并通过控制台完成策略、附加和路由验证。
English
The lecture builds an AWS Cloud WAN from scratch and validates its policies, attachments, and routing through the console.
Transcript
00:00 Hi.
00:05 So in this lecture we are going to actually set up the AWS cloud Wan network.
00:11 And more importantly we will see how to create the cloud Wan segments, how to create attachments and
00:14 how to configure the routing between the segments.
00:18 So what we are going to do here is set up something like this.
00:18 So we want to create a core network which is enabled for three AWS regions that is Mumbai, London and
00:26 North Virginia.
00:27 And let's assume that in Mumbai and North Virginia region, there are development VPCs and production
00:33 VPCs.
00:34 And in London there is a shared services VPC.
2. 三区域与三个 Segment
时间范围：00:37–01:00
总结 / Summary
中文
目标核心网络（Core Network）覆盖 Mumbai、North Virginia 与 London，并划分开发、生产和共享服务三个分段（Segment）。
English
The target Core Network spans Mumbai, North Virginia, and London and separates Development, Production, and Shared Services segments.
Transcript
00:37 So of course we need to have three network segments like development production and shared segment.
00:44 And we want to connect our development VPCs to the development segment and likewise for production and
00:51 shared services.
00:53 And then our aim is to, you know, launch EC2 instances just for testing the connectivity in every
00:59 VPC.
3. Development 跨区域互通
时间范围：01:00–01:10
总结 / Summary
中文
Mumbai 与 North Virginia 的开发 VPC 连接到开发分段（Development Segment），应能跨区域互通。
English
The Mumbai and North Virginia development VPCs attach to the Development Segment and should communicate across Regions.
Transcript
01:00 And then we want to test that from development instance.
01:03 In North Virginia, we are able to communicate with the development instance in Mumbai and similarly
01:09 for production.
4. Development 与 Production 隔离
时间范围：01:10–01:20
总结 / Summary
中文
开发分段（Development Segment）与生产分段（Production Segment）默认隔离，不应直接交换流量。
English
The Development and Production segments remain isolated and must not exchange traffic directly.
Transcript
01:10 And of course, what we don't want is that development instance can communicate with the production
01:17 instance.
01:17 So this connectivity should not work.
5. Development 访问 Shared Services
时间范围：01:20–01:38
总结 / Summary
中文
通过分段共享（Segment Sharing），开发工作负载可以访问 London 的共享服务 VPC。
English
Segment Sharing allows development workloads to reach the Shared Services VPC in London.
Transcript
01:20 And additionally what we want is that development instances can communicate with the shared services
01:27 instances.
01:28 So for that we have to share the segment.
01:31 So we'll share development with the shared services segment.
01:35 And we will then have this connectivity.
6. Production 访问 Shared Services
时间范围：01:38–02:10
总结 / Summary
中文
生产分段（Production Segment）同样共享到共享服务分段（Shared Services Segment），但仍与开发环境隔离。
English
The Production Segment also shares routes with Shared Services while staying isolated from Development.
Transcript
01:38 Similarly we also want production instances to also access the shared services segment.
01:44 Now this is typically required if shared services segment has kind of, you know, centralized egress
01:51 kind of routing configured or it connects your hybrid network, then typically you will see this kind
01:56 of architecture, right?
01:58 So which means now we will also share our production segment with the shared services segment.
02:04 And then this connectivity will also be there.
02:07 Right.
02:08 So this is our target.
02:10 And now if just I want to show you how exactly it will look like.
02:10 So it will look something like this.
7. 目标网络完整拓扑
时间范围：02:10–02:40
总结 / Summary
中文
完整拓扑明确允许 Dev-to-Dev、Prod-to-Prod、Dev-to-Shared 和 Prod-to-Shared，并阻止 Dev-to-Prod。
English
The final topology permits Dev-to-Dev, Prod-to-Prod, Dev-to-Shared, and Prod-to-Shared traffic while blocking Dev-to-Prod.
Transcript
02:13 And the process to set this up will be like creating all these five VPCs, creating instances inside
02:23 that.
02:24 And then first we will create AWS cloud, Wan Global Network.
02:28 Inside that we will create a core network.
02:31 We will enable this core network in this three regions.
02:35 And that's where you see this three core network edges provisioned by AWS.
8. Segment 与 Attachment 规划
时间范围：02:40–03:00
总结 / Summary
中文
三个分段（Segment）承载五个 VPC 附加（VPC Attachment）；附加策略将根据环境标签（Environment Tag）自动关联分段。
English
Three segments host five VPC attachments, and attachment policies use Environment tags to associate each attachment automatically.
Transcript
02:40 Once that is done, we will create three segments as you can see.
02:44 And then on that segment we will create five attachments for this five VPCs.
02:51 Additionally, we will share the development segment with the shared services segment.
02:56 And similarly production segment will be shared with the shared Services segment.
9. VPC 路由表规划
时间范围：03:00–03:38
总结 / Summary
中文
每个 VPC 路由表（Route Table）必须为远端 CIDR 添加指向核心网络 ARN（Core Network ARN）的路由。
English
Each VPC route table needs routes for remote CIDRs with the Core Network ARN as the target.
Transcript
03:00 Now after doing all this, the last thing that we want to do is to update the VPC route tables.
03:08 So we have to tell this VPC how to go to the other region VPCs.
03:13 Right.
03:13 For example, for this North Virginia development VPC, we would have to configure the route which says
03:20 how to go to the development VPC in Mumbai or Shared Services VPC in London.
03:25 So we will update the route table for all these five VPC subnets and we will add corresponding routes.
03:32 Now in this case the target of the route will be core network Arn.
03:37 Right.
10. EC2 连通性验证
时间范围：03:38–04:03
总结 / Summary
中文
在各 VPC 中使用 EC2 实例，通过私有 IP 的 ping 验证允许路径和隔离策略。
English
EC2 instances in each VPC use private-IP pings to validate permitted paths and isolation policies.
Transcript
03:38 And for testing the connectivity as I said there will be EC2 instances.
03:43 So we will log in to this EC2 instances over SSH.
03:47 And then for testing the connectivity we will ping to this target EC2 instances using their private
03:53 IPS.
03:54 Note that we will be using private IPS because otherwise if this EC2 instances has public IP, then
04:01 traffic can also go over the internet.
11. 实施步骤与成本控制
时间范围：04:03–04:39
总结 / Summary
中文
为节省 Cloud WAN 按小时费用，演示预先准备 VPC 与实例，并把时间集中在核心网络策略（Core Network Policy）和路由配置。
English
To reduce hourly Cloud WAN cost, the demo pre-creates VPCs and instances and focuses on Core Network Policy and routing configuration.
Transcript
04:03 So that is what we will be doing now in order to save some time.
04:08 What I have already done is I have already launched all these five VPCs, and then I have created public
04:14 subnets into each VPC, and I just launch one EC2 instance in each VPC, right.
04:21 So that, you know, we can just start from there.
04:24 And all these steps that I am just describing are also part of the next slides.
04:30 So you can also refer to that if you want to.
04:34 But otherwise if you just look at this architecture you should be able to implement the same.
12. 进入 AWS 控制台
时间范围：04:39–05:18
总结 / Summary
中文
实操从 AWS 控制台开始，并在多个区域和服务标签页之间切换完成配置。
English
The hands-on work begins in the AWS console and uses multiple Region and service tabs for the configuration.
Transcript
04:39 Now with that let's go to AWS console where I will first show you what setup I have already done.
04:44 And then let's start creating this core network.
04:47 Now if you are also doing this exercise, then just word of caution is that there is a cost for creating
04:54 the core network in different regions.
04:56 So there is a cost per hour for this core network edge.
05:00 So as soon as you are done with the exercise, make sure that you delete all attachments.
05:05 You delete your core network and you also delete your global network.
05:09 And no need to say you need to also terminate your EC2 instances and I will be doing the same after
05:15 this exercise.
05:18 Okay.
13. Mumbai VPC 清单
时间范围：05:18–05:35
总结 / Summary
中文
Mumbai 区域包含开发 VPC（Development VPC）与生产 VPC（Production VPC），CIDR 分别用于后续路由和测试。
English
The Mumbai Region contains Development and Production VPCs whose CIDRs are used in later routing and tests.
Transcript
05:18 So if I go to my VPC.
05:20 So I'm into Mumbai and you can see I have two VPCs.
05:24 And more important is their Cidr ranges.
05:27 If the Ssid starts with the ten then they are development VPCs.
05:31 And if it is 172 then they are production VPCs.
14. North Virginia VPC 清单
时间范围：05:35–05:41
总结 / Summary
中文
North Virginia 同样准备开发和生产 VPC，形成跨区域同分段连接。
English
North Virginia also contains Development and Production VPCs, creating cross-Region connectivity within each segment.
Transcript
05:35 Similarly, I have these VPCs in North Virginia region again one development and one production.
15. London Shared Services VPC
时间范围：05:41–06:42
总结 / Summary
中文
London 只部署共享服务 VPC（Shared Services VPC），作为开发和生产环境共同访问的中心服务。
English
London hosts the Shared Services VPC that both Development and Production are allowed to access.
Transcript
05:41 And then in London I have shared services VPC with 192 range, and I have launched two machines in Mumbai,
05:51 one in each VPC.
05:53 And then similarly in North Virginia.
05:55 You can see here.
05:58 Let me refresh.
05:59 Yeah.
06:00 Two instances and then one in London as well.
06:05 So what I have also done is I have just logged in to this Mumbai EC2 instance over its public IP, and
06:12 from there we will test the connectivity to the development instance in the North Virginia region using
06:18 its private IP.
06:19 So to this instance, using its private IP, that's our target.
06:23 But before that of course we need to create the core network and everything that we talked about.
06:28 So for that let's go to the network manager.
06:31 That's the service of AWS where you need to go to.
06:35 And it's a global service.
06:38 And let's go to the global networks.
06:40 And as of now there is none.
16. 创建 Global Network
时间范围：06:42–06:52
总结 / Summary
中文
在 AWS Network Manager 中创建全局网络（Global Network），作为 Cloud WAN 资源的管理容器。
English
A Global Network is created in AWS Network Manager as the management container for Cloud WAN resources.
Transcript
06:42 So let's create a global network.
06:44 Let's call it demo global network.
06:50 And just say next.
17. 创建 Core Network
时间范围：06:52–07:08
总结 / Summary
中文
在全局网络（Global Network）中启动核心网络（Core Network）向导，并设置名称和通用参数。
English
The Core Network wizard is launched from the Global Network and configured with its name and general settings.
Transcript
06:52 Now here you need to create the core network.
06:54 Now you can also create the core network a little later.
06:57 But this is just, you know, you can do at the same time you are creating the global network.
07:02 So let's create the core network with say demo core network.
18. 配置 ASN Range
时间范围：07:08–07:26
总结 / Summary
中文
自治系统号范围（ASN Range）为各核心网络边缘（Core Network Edge）分配 BGP ASN。
English
The ASN range supplies BGP Autonomous System Numbers for the Core Network Edges.
Transcript
07:08 And here you need to provide the ASN range that we had talked about.
07:13 So let's go with the default that is 64512265534.
07:20 And this ASN ranges are used to assign it to the core network edges.
19. 选择 Edge Locations
时间范围：07:26–07:43
总结 / Summary
中文
选择 Mumbai、London 和 North Virginia 作为核心网络边缘位置（Core Network Edge Location）。
English
Mumbai, London, and North Virginia are selected as Core Network Edge locations.
Transcript
07:26 Now is the edge locations, which tells that in which all AWS regions you want this core network in.
07:33 So let's choose North Virginia, then Mumbai and London.
07:40 So which is here right.
20. 创建默认 Shared Segment
时间范围：07:43–08:09
总结 / Summary
中文
向导先创建默认共享分段（Shared Segment）；开发和生产分段稍后在策略编辑器中补充。
English
The wizard initially creates the Shared Segment; Development and Production are added later in the policy editor.
Transcript
07:43 And now the default segment.
07:45 So for us it's a shared segment.
07:47 So let's create the shared segment as we create the core network.
07:53 That's it.
07:54 And now let's create this.
07:58 Right now.
07:59 At this time, it will take maybe 5 to 10 minutes.
08:02 So I'm pausing this video and I'll come back here.
08:07 Okay, so it took more than ten minutes for me.
21. Core Network 创建完成
时间范围：08:09–09:15
总结 / Summary
中文
全局网络（Global Network）和核心网络（Core Network）创建后，可在 Network Manager 中查看其状态和可视化入口。
English
After the Global Network and Core Network are created, Network Manager exposes their status and visualization views.
Transcript
08:09 And you can see that the global network and the core network have been created.
08:14 So global network is created immediately.
08:17 But the core network actually takes long time.
08:20 Okay.
08:20 So if you now go to the global network then you will see core network under it.
08:26 And there are cool visualization where you can exactly see where your core network edges are.
08:31 So it shows these three regions.
08:33 But this kind of visualization will get better as you create segments and then attach VPCs to those
08:40 segments.
08:40 So we will revisit all these visualization parts uh, little later.
08:45 But as of now let's focus on what's there in the core network.
08:49 So let's go to the core network.
08:52 So this tells us that there are three edge locations.
08:52 And there is one segment that is a shared segment that we had created in this core network.
08:55 Now it also shows the topology graph and topology trees.
09:05 As I said, this will be more interesting to see when we set up our entire network.
09:10 So we will come back here again.
09:12 Okay, going back to the core network.
22. 编辑 Core Network Policy
时间范围：09:15–09:38
总结 / Summary
中文
从策略版本（Policy Version）页面进入核心网络策略（Core Network Policy）编辑流程。
English
The Core Network Policy editing workflow starts from the Policy Versions page.
Transcript
09:15 Now, the next thing we want to actually do is to edit the core network policy.
09:20 Okay.
09:21 As you can see that there is this, uh, first version of the policy and under which it has deployed
09:27 the core network edges in the three regions.
09:29 And it also created a default shared services segment.
09:34 Now let's edit this policy and add additional components.
23. Visual Editor 与 JSON
时间范围：09:38–09:58
总结 / Summary
中文
策略既可使用可视化编辑器（Visual Editor），也可直接编辑 JSON；本实操选择可视化模式。
English
The policy can be edited with the Visual Editor or directly as JSON; this walkthrough uses the visual mode.
Transcript
09:38 Now you can also do this through this visual editor.
09:41 Or you can also do that through the Json document.
09:44 So if you see this you will already see that there are these Json ranges and three edge locations.
09:51 Of course you can create additional edge locations if you want.
09:54 Right now what we want to do is to create some additional segments.
24. 创建 Shared Segment 配置
时间范围：09:58–10:14
总结 / Summary
中文
确认共享分段（Shared Segment）的区域、隔离和允许列表等属性。
English
The Shared Segment is reviewed for Region scope, isolation, and allow-list behavior.
Transcript
09:58 So there is already this shared segment.
10:00 And now let's create the development segment.
10:06 And I'm just leaving everything as default as of now.
10:10 But I'll revisit this again after we create the segment.
25. 创建 Production Segment
时间范围：10:14–10:27
总结 / Summary
中文
新增生产分段（Production Segment），用于承载两个生产 VPC 附加（VPC Attachment）。
English
A Production Segment is added to host the two production VPC attachments.
Transcript
10:14 So let's create this and let's also create the production segment.
10:21 So we created this three segments.
10:24 And as of now that's fine.
26. 生成新 Policy Version
时间范围：10:27–10:50
总结 / Summary
中文
完成三个分段（Segment）后创建新的策略版本（Policy Version），触发验证和变更生成。
English
After defining all three segments, a new Policy Version is created to trigger validation and change generation.
Transcript
10:27 Let's create the policy.
10:32 And you can see that the new policy version will be created.
10:36 So let's wait for this policy to be ready for execution again.
10:41 It takes hardly few seconds.
10:44 Typically you should refresh this page.
10:46 So let me try that.
27. Ready to Execute
时间范围：10:50–10:56
总结 / Summary
中文
策略通过验证后进入可执行（Ready to Execute）状态，等待审查变更集（Change Set）。
English
After validation, the policy reaches Ready to Execute and awaits Change Set review.
Transcript
10:50 And it's ready to execute.
10:53 So let's use this policy.
28. 审查 Change Set
时间范围：10:56–11:40
总结 / Summary
中文
变更集（Change Set）列出新增分段和边缘配置，确认影响后再执行策略。
English
The Change Set lists the new segments and edge configuration so the impact can be reviewed before execution.
Transcript
10:56 And at this moment you have to view the policy changes and apply the change set.
11:02 So let's apply the change set.
11:05 What it's going to do is it's going to create this two additional segments that is development and production.
11:12 And also if you want you can, you know verify the status of this policy.
11:16 So it tells you like at which step it is currently.
11:19 So you know it is creating those segments like that.
11:25 So you can see here that it's creating those segments in all the regions.
11:29 So again let me pause this video here and I'll come back soon.
11:34 Okay.
11:34 So again it took around five minutes for this step to be completed.
11:37 So let's go back to the policy versions.
29. Policy Version 2 执行成功
时间范围：11:40–12:06
总结 / Summary
中文
应用变更集后，策略版本 2（Policy Version 2）显示执行成功（Execution Succeeded）。
English
After the Change Set is applied, Policy Version 2 reaches Execution Succeeded.
Transcript
11:40 And you can see all steps are completed.
11:43 Now what we want to do is again we want to set up the routing for the segments.
11:48 Right.
11:48 So let's just wait for this to be execution succeeded status.
11:53 So again I'll just pause for a few seconds maybe and come back.
11:57 Okay.
11:57 So again it took maybe a minute or so.
12:00 And that's where I said that the UI is not that fluid as of today, but hopefully it improves over the
12:06 time.
30. 配置 Segment Sharing
时间范围：12:06–12:40
总结 / Summary
中文
返回策略编辑器配置分段共享（Segment Sharing），控制哪些分段可以相互传播路由。
English
The policy editor is reopened to configure Segment Sharing and control inter-segment route propagation.
Transcript
12:06 Okay, so we have got second version of the policy and we want to now configure the routing for the
12:13 segments.
12:13 And essentially we want to share these segments.
12:16 So as of now we have these three segments.
12:19 And what we really want is that, you know, we should be able to control which segments can share routes
12:26 with each other.
12:27 As of now there is no such restriction, which means if development and production segments are shared,
12:33 then the routes will also be shared.
12:35 But we want to be more specific where what we want is.
31. Development Allow List
时间范围：12:40–12:57
总结 / Summary
中文
开发分段（Development Segment）的允许列表（Allow List）只包含共享分段（Shared Segment）。
English
The Development Segment allow list contains only the Shared Segment.
Transcript
12:40 So let's use this and we want that.
12:44 The development segment should be able to be shared only with the shared services segment.
12:50 So that's what we are doing using this allow selected.
12:54 And let's edit this.
32. Production Allow List
时间范围：12:57–13:16
总结 / Summary
中文
生产分段（Production Segment）的允许列表（Allow List）也只允许共享分段（Shared Segment）。
English
The Production Segment allow list likewise permits only the Shared Segment.
Transcript
12:57 Similarly what we want to do is for production as well.
13:00 We want that the production segment can only be shared with the shared services segment.
13:06 So it automatically populates that.
13:08 I don't know why, but I would have expected that I should select this setting.
13:13 Okay.
13:14 And again let's do that.
33. Shared Allow List
时间范围：13:16–14:09
总结 / Summary
中文
共享分段（Shared Segment）允许开发和生产两个分段，从而建立双向可达性。
English
The Shared Segment allows both Development and Production, establishing bidirectional reachability.
Transcript
13:16 And in the shared services segment we want to make sure that this is only shared with the development
13:24 and production.
13:26 So let's choose this two.
13:30 And we are good right?
13:31 Now additionally what you can also do is you know, you can have the deny list instead.
13:36 So in the production you can say deny the access to the development segment.
13:40 But when at the same we are saying that production can only be shared with the shared services segment.
13:46 And I don't also want this require acceptance so that we can do this quickly and optionally, you know
13:54 that you can restrict that.
13:56 This segment is available only in few regions.
13:59 So if you want to do that, then you can select only couple of you know edge locations.
14:04 But I'm not doing that okay.
14:06 So this is done now.
34. Segment Action
时间范围：14:09–14:41
总结 / Summary
中文
分段操作（Segment Action）显式共享 Shared 分段的路由给 Development 与 Production。
English
A Segment Action explicitly shares the Shared Segment routes with Development and Production.
Transcript
14:09 Next and most important thing is the segment actions which tells us which segments we want to share
14:15 with each other.
14:16 So let's create the segment that is shared segment.
14:21 And we want to share this segment with the development and with the production.
14:26 And while we do that, the routing between the both shared and development will be exchanged and shared
14:32 and production will be exchanged.
14:34 But development and production cannot communicate with each other.
14:37 And we already talked about this point in the previous lecture.
14:41 Right.
35. 创建 Sharing Action
时间范围：14:41–14:47
总结 / Summary
中文
创建共享操作（Sharing Action）并选择源分段与目标分段，落实策略中的共享关系。
English
A Sharing Action selects the source and destination segments to implement the policy relationship.
Transcript
14:41 So let's create this sharing.
14:44 And yeah we are good with the segment sharing.
36. Attachment Policies
时间范围：14:47–14:58
总结 / Summary
中文
附加策略（Attachment Policy）根据资源标签自动把 VPC 附加分配到相应分段。
English
Attachment Policies use resource tags to place VPC attachments into the correct segments automatically.
Transcript
14:47 And the next is attachment policies.
14:50 Now this will define how you connect your attachment to the segments.
14:54 So we want to typically create you know rules here.
37. Development Attachment Policy
时间范围：14:58–15:33
总结 / Summary
中文
开发附加策略匹配 Environment=Development 标签，并关联开发分段（Development Segment）。
English
The Development attachment policy matches the Environment=Development tag and associates the Development Segment.
Transcript
14:58 So let's create our first rule which says say rule number one.
15:02 And this is for my development segment.
15:05 And it says that if the VPC is attached to this segment.
15:13 So it should be with the tag value with say environment.
15:22 Equal to development on the attachment.
15:25 Then it will be automatically attached to the development segment.
15:29 So that's the first policy or a first rule.
38. Production Attachment Policy
时间范围：15:33–15:46
总结 / Summary
中文
生产附加策略匹配 Environment=Production，并将资源关联到生产分段（Production Segment）。
English
The Production attachment policy matches Environment=Production and associates the Production Segment.
Transcript
15:33 Similarly let's create the another rule.
15:36 And this time let's say this is for the production.
15:40 And here the environment should be production.
39. Shared Catch-all Policy
时间范围：15:46–16:40
总结 / Summary
中文
最后的共享附加策略（Shared Attachment Policy）作为兜底规则（Catch-all Rule），把其他匹配项放入共享分段。
English
The final Shared attachment policy acts as a catch-all rule that places remaining matches into the Shared Segment.
Transcript
15:46 Now let's also create one default policy which says if any condition is there, that means attachment
15:52 doesn't have right tags or value.
15:55 It is attached to the shared services segment.
15:58 So typically you should have this kind of, you know, rules if it doesn't matches any of the previous
16:04 rules.
16:04 So let's do that.
16:05 Let's call it say rule number 100.
16:08 And here let's say shared.
16:11 And here we'll say any that means any condition.
16:16 And one more thing.
16:17 If you remember we talked about attachment as a tag value.
16:20 So you can also create a generic rule which says you know, if the particular tag value is there on
16:27 the attachment, then it will be attached to the respective segment.
16:32 Right.
16:32 So this is our default rule.
16:34 So also let's create that.
16:38 So I think we are good with the attachment policies as well.
40. 创建更新后的 Policy Version
时间范围：16:40–17:02
总结 / Summary
中文
完成共享和三条附加策略后，再次创建策略版本（Policy Version）并验证配置。
English
After configuring sharing and three attachment policies, another Policy Version is created and validated.
Transcript
16:40 So now let's create another version of the policy.
16:44 And this time we are adding the segment sharing and this attachment policies.
16:49 So again let's wait for this policy to be ready to be executed.
16:55 And.
16:57 Once that is done, we will apply the policy changes.
17:02 Okay.
41. 应用新 Change Set
时间范围：17:02–17:31
总结 / Summary
中文
审查并应用新的变更集（Change Set），让分段共享和自动关联规则正式生效。
English
The new Change Set is reviewed and applied, activating segment sharing and automated association rules.
Transcript
17:02 So let's go to the policy and let's view and apply the chain set.
17:10 So this will be quick.
17:11 I think maybe in a minute or so this will be completed.
17:15 Okay, so it took less than a minute.
17:17 Now we have everything that we wanted.
17:20 And the next important thing is to create the attachments.
17:23 So now we want to create five attachments for five VPCs.
17:28 So let's do that one by one.
42. 创建 Mumbai Development Attachment
时间范围：17:31–18:04
总结 / Summary
中文
创建 Mumbai 开发 VPC 附加（VPC Attachment），选择边缘位置、VPC 和子网，并添加环境标签。
English
The Mumbai Development VPC attachment selects its edge location, VPC, subnets, and Environment tag.
Transcript
17:31 So let's create our first attachment say Mumbai development.
17:35 And this will be in the AP South one that is Mumbai.
17:40 And the VPC id is this.
17:43 And the most important part is you need to put right tag so that this attachment can be connected to
17:50 the development segment.
17:52 So let's call it development.
17:57 And now I'll be repeating this for all the rest of the four VPCs.
18:01 So I'm just pausing this video and I'll come back.
43. 四个 Regional Attachments
时间范围：18:04–18:12
总结 / Summary
中文
Mumbai 与 North Virginia 的四个开发/生产 VPC 附加创建后，策略按标签自动关联相应分段。
English
After the four Mumbai and North Virginia Development/Production attachments are created, tags associate them with their segments.
Transcript
18:04 Okay, so so far I have created four attachments for, you know, both production and development environments
18:10 in Mumbai and North Virginia region.
44. 创建 London Shared Attachment
时间范围：18:12–18:35
总结 / Summary
中文
为 London 共享服务 VPC 创建第五个 VPC 附加（VPC Attachment），由兜底策略关联共享分段。
English
A fifth VPC attachment connects the London Shared Services VPC and is associated with Shared through the catch-all policy.
Transcript
18:12 Now I want to create the last one for the shared services attachment.
18:16 So let's call it London Shared and the location as London.
18:21 Now here I'll be selecting this VPC.
18:24 And I don't need to put any tags because it will be then evaluated with the default rule that we created.
18:31 And let's create this attachment.
45. 五个 Attachments 状态
时间范围：18:35–19:11
总结 / Summary
中文
附件列表展示五个 VPC 附加及其边缘位置、资源和创建状态。
English
The attachments list shows all five VPC attachments with their edge locations, resources, and creation states.
Transcript
18:35 So now we have all the five attachments.
18:39 So all are getting created now if you see it automatically been attached to the segment.
18:46 So this to the production segment and development segment.
18:50 And it also tells you which rule match because of which it was attached to that respective segment.
18:55 So rule number one two and for shared it was rule number 100.
18:59 So which means that the rules that we had written worked on these attachments okay.
19:05 So again it will take few minutes.
19:07 So I'm pausing this video till this attachments get created okay.
46. Core Network 拓扑完成
时间范围：19:11–20:08
总结 / Summary
中文
所有附件可用后，核心网络拓扑（Core Network Topology）显示三个区域边缘和五个 VPC 连接。
English
Once all attachments are available, the Core Network topology displays three Regional edges and five connected VPCs.
Transcript
19:11 So everything is done.
19:13 Now let's go to our core network.
19:15 And now let's look at the visualization.
19:18 So it should tell us how the entire setup looks like.
19:22 So there are three edge locations three segments.
19:25 And it will show you in the topology graph here.
19:30 So as you can see, there are now these edge locations.
19:35 There are VPCs.
19:37 And if you enable the segments it will also show you the segment.
19:41 I think the better view is the topology tree.
19:44 So it really gives you a nice tree kind of view.
19:49 Right now you can definitely see everything that we just did.
19:54 So core network three regions.
19:57 And then in Mumbai there are two segments and then there are two VPCs.
20:01 And in London there is just one segment and shared services VPC.
20:05 So this is a very nice view.
47. 检查 Core Network Routes
时间范围：20:08–20:58
总结 / Summary
中文
在 Routes 视图按分段和边缘位置检查核心网络路由（Core Network Route），确认传播结果符合策略。
English
The Routes view is checked by segment and edge location to confirm Core Network route propagation matches the policy.
Transcript
20:08 Now another important thing to see is these routes.
20:12 So it exactly tells you which attachments can communicate with each other.
20:17 So if you just now look at the development and AP South one that is Mumbai.
20:23 So it will tell you from the Mumbai region you can reach to another development VPC in another region,
20:31 which is this IP address, and then also to the shared services segment.
20:36 And these routes are propagated routes, right.
20:40 Similarly, if you look at the production you will see the routes for the other production VPC in different
20:46 region and also for the shared services VPC route.
20:50 So if you want to troubleshoot networking issues, probably you can come to these routes and verify
20:54 these routes here.
20:56 Right.
48. 剩余 VPC Route Table 任务
时间范围：20:58–21:11
总结 / Summary
中文
核心网络侧配置完成后，最后需要在每个 VPC 路由表（Route Table）加入远端 CIDR 路由。
English
With the Core Network complete, the remaining task is to add remote-CIDR routes to every VPC route table.
Transcript
20:58 So if you go back to this diagram, everything is done.
21:01 And what is not done is this route tables for every VPC.
21:05 Without that, you cannot communicate with each other.
21:08 And let's also just verify that.
49. 验证 Core Routes 后开始 Ping
时间范围：21:11–21:50
总结 / Summary
中文
先确认核心网络路由（Core Network Route）存在，再进行 ping；此时 VPC 路由表尚未完整，预期首次测试失败。
English
Core Network routes are verified before pinging; because VPC route tables are not yet complete, the initial test is expected to fail.
Transcript
21:11 So at this point let's test the connectivity from Mumbai to North Virginia development VPC.
21:16 So for that let's go to the North Virginia and just pick this IP address.
21:22 And I have already switched into the Mumbai development EC2 instance which is this.
21:28 So let's try to ping to North Virginia, which doesn't work of course because we don't have the route
21:37 in the subnet route table of every VPC.
21:40 So let's do that for the Mumbai development VPC.
21:44 I will show you that.
21:45 And then I will be repeating the same for the rest of the VPCs.
21:49 Right.
50. 定位 Mumbai VPC Route Table
时间范围：21:50–22:07
总结 / Summary
中文
在 Mumbai VPC 控制台找到目标 VPC 的主路由表（Main Route Table），准备添加 Cloud WAN 路由。
English
The Mumbai VPC console is used to identify the target VPC's Main Route Table before adding Cloud WAN routes.
Transcript
21:50 So let's go back to the VPC console for Mumbai.
21:52 And let's pick this VPC.
21:55 And rather we want to do the updates in the route table.
21:59 So this is Mumbai Dev public route table which has just two routes.
22:04 One is the local and another is for Internet gateway.
51. 编辑 Mumbai Routes
时间范围：22:07–23:30
总结 / Summary
中文
为远端开发、生产和共享 CIDR 添加指向核心网络（Core Network）的路由，并保存变更。
English
Routes for remote Development, Production, and Shared CIDRs are added with the Core Network as the target and then saved.
Transcript
22:07 Now let's edit these routes and say if the traffic is going to any of this ten .0.0/8, then it has
22:19 to go through the core network.
22:21 And it will automatically populate this aahn.
22:25 Now you must be wondering that there is already this 16 route, but as you know, the longest prefix
22:31 match takes the precedence.
22:32 So if this EC2 instance initiates the traffic within the VPC, then this route will be taken.
22:39 But otherwise, if anything falls into this range, the core network route will be taken.
22:45 Now similarly we want to do that for shared services.
22:48 VPC that is 192.168.0.0 slash 16 because we don't have any other range in the second place.
22:58 So I think that's fine.
23:00 And let's use core network and again use the same Arn.
23:04 Note that we are using the Arn here and not the gateway IDs.
23:09 That's one difference when you add this target for the core network.
23:14 I think that's sufficient.
23:15 And we are not going to add the production routes here because we don't want that connectivity.
23:20 And even if we would have added it wouldn't work because we are not sharing the development and the
23:27 production segments.
23:28 So let's save the changes.
52. 更新对端 Region Routes
时间范围：23:30–24:08
总结 / Summary
中文
在 North Virginia 对端 VPC 路由表（Route Table）添加返回路径，确保双向转发。
English
Return routes are added to the North Virginia peer VPC route table to ensure bidirectional forwarding.
Transcript
23:30 Now I will do the same on the other side of the network that is the North Virginia development VPC.
23:36 So let's go to the North Virginia.
23:38 Let's go to the route table and let's go to the North Virginia development route table.
23:46 And here let's again add a route which says ten 000/8.
23:53 It has to go through the core network.
23:57 And let's also add a route for shared services.
24:03 And it will also go through the core network.
24:08 Right?
53. Development Ping 成功
时间范围：24:08–24:23
总结 / Summary
中文
两端路由完成后，跨区域开发实例之间的私网 ping 成功，证明开发分段（Development Segment）可达。
English
After both route tables are updated, private pings between cross-Region development instances succeed.
Transcript
24:08 So if everything is done as expected, we should be able to connect from Mumbai Dev to the North Virginia
24:15 Dev instance.
24:16 So let's test that.
24:18 So you can see that traffic already started flowing, which is great.
54. Shared Ping 初次失败
时间范围：24:23–24:53
总结 / Summary
中文
访问共享服务的首次 ping 因 London VPC 缺少返回路由而失败，说明端到端路径必须双向配置。
English
The first ping to Shared Services fails because the London VPC lacks a return route, demonstrating that end-to-end routing must be bidirectional.
Transcript
24:23 Now let's also test the connectivity to the shared services VPC EC2 instance.
24:28 So for that, let's go to the London EC2 instance and let's pick its private IP which is this.
24:36 And let's go back to our terminal.
24:38 Let me clear the screen and let's try to ping to this IP.
24:43 And this doesn't work.
24:44 Can you guess why?
24:45 Of course.
24:46 Because we don't have the VPC routes in the shared services VPC route table.
24:51 So I'm going to now add that.
55. 更新 London Shared Routes
时间范围：24:53–25:20
总结 / Summary
中文
在 London 共享服务 VPC 路由表（Route Table）加入返回 Mumbai 与 North Virginia 的核心网络路由。
English
The London Shared Services VPC route table receives Core Network return routes for Mumbai and North Virginia.
Transcript
24:53 So again back to the VPC console for London region.
24:56 And in here we need to again add the routes.
24:59 And we are saying if the traffic is going to the development sides then it should be through the core
25:06 network.
25:06 And similarly if it is going to the production side again we can use the generic range so that it covers
25:14 both Mumbai and North Virginia.
25:17 Then it should be through the core network and save the changes.
56. Shared Services 可达
时间范围：25:20–25:27
总结 / Summary
中文
更新 London 路由后，开发和生产实例都能访问共享服务分段（Shared Services Segment）。
English
After the London routes are updated, both Development and Production instances can reach the Shared Services Segment.
Transcript
25:20 Let's go back to our terminal and you can see that the traffic started flowing.
25:25 That's great.
57. Dev-to-Prod 按策略失败
时间范围：25:27–25:52
总结 / Summary
中文
开发到生产的 ping 仍失败，证明分段隔离（Segment Isolation）和允许列表按预期工作。
English
Development-to-Production pings still fail, confirming that segment isolation and allow lists work as intended.
Transcript
25:27 Let's also make the final check whether can we ping to the production instance from here.
25:33 So for that let's grab the IP address of the say North Virginia production instance.
25:41 And of course it shouldn't work because segments are not shared.
25:46 And we also did not add the routes in the VPC subnet route table that's expected.
58. 端到端验证完成
时间范围：25:52–26:01
总结 / Summary
中文
所有应成功与应失败的路径均符合设计，完成 Cloud WAN 端到端验证。
English
Every expected-success and expected-failure path matches the design, completing end-to-end Cloud WAN validation.
Transcript
25:52 Okay, so that's it for this exercise, I think we are able to successfully set this up and test the
25:59 end to end connectivity.
59. Cloud WAN 搭建流程总结
时间范围：26:01–26:44
总结 / Summary
中文
完整流程是编辑核心网络策略（Core Network Policy）、创建分段与共享、定义附加策略、应用策略版本、创建 VPC 附加、更新 VPC 路由表、检查核心网络路由并用 EC2 私网地址验证连通性和隔离。
English
The complete workflow is to edit the Core Network Policy, create segments and sharing, define attachment policies, apply the policy version, create VPC attachments, update VPC route tables, inspect Core Network routes, and validate connectivity and isolation with EC2 private addresses.
Transcript
26:01 Again, as I said, I have provided all these steps here and you can watch these steps and implement
26:06 on your own.
26:08 But at the end of the lab, make sure that you delete everything, because otherwise you will be charged
26:14 for all these segments, attachments and, you know, core network edges.
26:19 And I'm going to do that now.
26:21 So I'm going to terminate all EC2 instances, delete all the attachments, delete core network, and
26:26 finally delete the global network.
26:29 So I hope now everything is very clear to you how exactly the cloud Wan network works and how to set
26:36 up the routing and configuration.
26:38 So that's it for this lab.
26:40 Let's stop here.
26:41 Thank you.
26:42 And stay tuned.
整讲总结 / Overall Summary
中文
本讲通过一次完整实操搭建 AWS Cloud WAN：在 Mumbai、North Virginia 和 London 三个区域创建核心网络（Core Network），定义开发、生产和共享服务三个分段（Segment），配置分段共享（Segment Sharing）与附加策略（Attachment Policy），再把五个 VPC 作为 VPC 附加（VPC Attachment）接入。随后更新各 VPC 路由表（Route Table），验证核心网络路由（Core Network Route）和跨区域 EC2 私网连通性，并确认开发与生产分段保持隔离、二者都能访问共享服务分段。
English
This hands-on lecture builds an AWS Cloud WAN across Mumbai, North Virginia, and London. It creates a Core Network, defines Development, Production, and Shared Services segments, configures segment sharing and attachment policies, and connects five VPCs through VPC attachments. It then updates VPC route tables, verifies Core Network routes and cross-Region EC2 private connectivity, and confirms that Development and Production remain isolated while both can reach Shared Services.
返回顶部 ↑