Lecture 152: Traffic Inspection in AWS Cloud WAN - Inspection VPC attachment
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:18
- 来源：Udemy Lecture 56342001
- Slide 数量：15
- 画面切换：00:24、00:50、01:59、02:10、02:39、02:49、03:07、03:49、04:06、04:17、04:25、04:30、04:35、04:46
扫描说明
逐条检查了 Udemy 页面中的 66 条 Transcript cue，并扫描了全长约 05:18 的视频。该讲先回顾 Transit Gateway 集中检查，再逐步展开 Traffic inspection using Inspection VPC 和双区域 Architecture 两组课件；每个新增拓扑组件、配置步骤、缺点或静态路由揭示均单独作为小节。去除 18 个标题停留或无新增内容的重复候选帧后，共保留 15 个画面阶段。最终截图均关闭 Transcript 侧栏和播放器控件，完整保留右侧和底部，无黑边，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Cloud WAN Traffic Inspection
时间范围：00:00–00:24
总结 / Summary
中文
本讲讨论如何在 AWS Cloud WAN 中集中检查 VPC 出站流量和跨 VPC 流量。
English
The lecture explains how to centralize inspection for VPC egress and inter-VPC traffic in AWS Cloud WAN.
Transcript
00:00 Alright, now that you know AWS CloudWAN, let's see how the traffic inspection can be achieved in the CloudWAN network.
00:09 Now, if you remember, if you go back to the transit gateway section, there I had shown you a couple of architectures
00:16 for centralized traffic inspection using the transit gateway.
00:19 And there, I had shown you that you can use gateway load balancer with third-party firewalls,
2. Transit Gateway 检查架构回顾
时间范围：00:24–00:50
总结 / Summary
中文
Transit Gateway 集中检查可使用 Gateway Load Balancer 加第三方防火墙，或原生 AWS Network Firewall。
English
Transit Gateway centralized inspection can use third-party firewalls behind Gateway Load Balancer or the native AWS Network Firewall.
Transcript
00:24 or you can also use AWS network firewall, which is a native firewall by AWS.
00:30 So, in this lecture, let's talk about a similar thing, but in the context of AWS CloudWAN.
00:37 So, in general, in order to inspect the traffic which is coming out of your VPC or the inter-VPC communication,
00:45 that is east-west traffic, you need to have some network appliances.
3. Inspection VPC 中的 Network Appliances
时间范围：00:50–01:59
总结 / Summary
中文
检查设备部署在专用检查 VPC（Inspection VPC）内，可以是 Gateway Load Balancer 后的第三方网络设备，也可以是 AWS Network Firewall。
English
Inspection appliances live in a dedicated Inspection VPC and can be third-party devices behind Gateway Load Balancer or AWS Network Firewall.
Transcript
00:50 And in AWS, either you can use any third-party network appliances and you can host them behind the
00:56 gateway load balancer,
00:57 you already know that, or otherwise, you can use AWS network firewall, which is a native AWS service.
01:04 And in the network security section, we are going to dive deep into this AWS network firewall.
01:10 But at this point, just think of it as a fully managed network firewall in AWS.
01:17 Alright, now, whether you use the gateway load balancer or this AWS network firewall,
01:22 you need to host these services inside a VPC.
01:25 And this VPC is called inspection VPC.
01:29 Now, if you want to inspect all the traffic, which is a part of your CloudWAN network,
01:34 then you need to associate this inspection VPC with your network traffic.
01:40 So, how do you do that?
01:42 So, there are two approaches, and the first approach that we are discussing is kind of older approach,
01:48 but still relevant for your exam.
01:50 So, first, let's talk about this approach, and then we will talk about the new approach,
01:55 which is using the network function group in the CloudWAN.
4. 部署 Dedicated Inspection VPC
时间范围：01:59–02:10
总结 / Summary
中文
旧方案首先在专用检查 VPC（Inspection VPC）中部署 AWS Network Firewall 或其他网络设备（Network Appliance）。
English
The legacy approach first deploys AWS Network Firewall or another network appliance in a dedicated Inspection VPC.
Transcript
01:59 Alright, so you have the inspection VPC, and now you have to deploy your network appliances inside
02:06 this inspection VPC.
02:07 So, it will be your dedicated VPC.
5. 作为 Regular VPC Attachment 接入
时间范围：02:10–02:39
总结 / Summary
中文
检查 VPC 通过普通 VPC 附加（Regular VPC Attachment）连接 Cloud WAN，并放入独立检查分段（Inspection Segment）。
English
The Inspection VPC connects to Cloud WAN as a regular VPC attachment and belongs to a dedicated Inspection Segment.
Transcript
02:10 Now, once you have this VPC, you can simply attach it to your CloudWAN network,
02:15 and it will be a separate segment, you can say, which could be inspection segment.
02:21 Now, once you have this segment, you would have to configure all the routing,
02:24 as in whenever the traffic goes from one segment to another,
02:27 the traffic should first be forwarded to this inspection VPC segment.
02:33 So, you can very well inspect the traffic using this inspection VPC as a separate VPC attachment,
6. 使用 Static Routes 引流
时间范围：02:39–02:49
总结 / Summary
中文
各业务分段需要手动配置静态路由（Static Route），把跨分段流量先送往检查 VPC。
English
Business segments require manually configured static routes that steer inter-segment traffic through the Inspection VPC first.
Transcript
02:39 but the problem here is that in this case, you would have to manually create all the routes
02:45 across all the different segments and the attachments,
7. 旧方案的三项缺点
时间范围：02:49–03:07
总结 / Summary
中文
该方案需要手工管理路由，不能原生保证流对称（Flow Symmetry），并且跨多个 AWS 区域扩展复杂。
English
The approach requires manual route management, provides no native flow-symmetry guarantee, and is complex to scale across Regions.
Transcript
02:49 and it doesn't guarantee the network flow symmetry,
02:53 as well as it is really complex to manage as you scale your CloudWAN network to multiple AWS region.
03:00 And in order to understand this complexity, let's look at the architecture using this inspection VPC.
8. 双区域 Dev/Prod 拓扑
时间范围：03:07–03:49
总结 / Summary
中文
示例在 North Virginia 与 Mumbai 各有 Dev 和 Prod VPC，并通过开发、生产分段（Segment）连接核心网络。
English
The example has Dev and Prod VPCs in North Virginia and Mumbai connected through Development and Production segments.
Transcript
03:07 So, this is kind of simplified CloudWAN network, where there are just two regions,
03:11 and let's say there is a Dev VPC, there is a Prod VPC in both the regions,
03:16 and then there are corresponding segments.
03:18 Now, our goal is to inspect all the traffic, which is going from, say, Dev segment to Prod segment,
03:25 or Dev segment to Dev segment, likewise.
03:28 So, here we want to monitor the east-west traffic.
03:31 However, you can also monitor the north-south traffic,
03:34 which means the traffic which goes out to the internet and comes back from the internet.
03:39 So, as we discussed for this, the first thing that you will need,
03:42 in every region, you will need this inspection VPC,
03:46 and inside that, you will deploy your network appliances,
9. 每个 Region 部署 Inspection VPC
时间范围：03:49–04:06
总结 / Summary
中文
每个区域都要部署独立检查 VPC（Inspection VPC）及 Gateway Load Balancer/第三方防火墙或 AWS Network Firewall。
English
Each Region requires its own Inspection VPC with Gateway Load Balancer and third-party firewalls or AWS Network Firewall.
Transcript
03:49 which could be Gateway Load Balancer with third-party firewalls or AWS Network Firewall.
03:55 So, you will deploy that in both the regions,
03:57 and then you will create separate segments in every region for this inspection VPC attachments.
04:04 And then you will attach this VPC,
10. 创建 Regional Inspection Segments
时间范围：04:06–04:17
总结 / Summary
中文
各检查 VPC 连接到对应区域的独立检查分段（Inspection Segment），形成两个额外的路由域。
English
Each Inspection VPC attaches to a Region-specific Inspection Segment, creating two additional routing domains.
Transcript
04:06 and finally, you need to now modify the routes for all these segments.
04:12 For example, for the production segment, you need to add this static route,
11. Production Static Routes
时间范围：04:17–04:25
总结 / Summary
中文
生产分段（Production Segment）添加静态路由，把目标流量送往源区域的检查 VPC。
English
The Production Segment adds static routes that steer target traffic through the source Region's Inspection VPC.
Transcript
04:17 which says that all the traffic should go through this inspection VPC in region 1 or region 2.
12. Development Static Routes
时间范围：04:25–04:30
总结 / Summary
中文
开发分段（Development Segment）也要为两区域分别维护经过检查 VPC 的静态路由。
English
The Development Segment likewise maintains Region-specific static routes through the Inspection VPCs.
Transcript
04:25 And similarly, for the development segment as well, you will have this static route.
13. Inspection Segment Return Routes
时间范围：04:30–04:35
总结 / Summary
中文
检查分段（Inspection Segment）必须再配置返回业务分段的路由，才能把检查后的流量送到最终目的地。
English
Inspection Segments need return routes toward the business segments so inspected traffic can reach its final destination.
Transcript
04:30 Now, apart from that, for this inspection segments as well, you will have additional routes,
14. 完整双向 Route Matrix
时间范围：04:35–04:46
总结 / Summary
中文
跨区域、跨分段与返回路径共同形成大量静态路由（Static Route），任何新附件或 CIDR 都可能要求修改矩阵。
English
Cross-Region, inter-segment, and return paths create a large static-route matrix that may need updates for every new attachment or CIDR.
Transcript
04:35 and these routes will basically forward all the traffic to the destination,
04:40 which could be any of these segments.
04:43 So, which means that you can very well have the traffic inspection,
15. 转向 Service Insertion
时间范围：04:46–05:18
总结 / Summary
中文
由于手动路由随网络增长而快速复杂化，AWS 提供网络功能组（Network Function Group）的服务插入（Service Insertion）作为新方案。
English
Because manual routing becomes increasingly complex as the network grows, AWS provides Network Function Group service insertion as the newer approach.
Transcript
04:46 but here you have to add these static routes manually,
04:50 and as your network grows, you would have to keep modifying your routes for your segments.
04:56 And that's where it is a complex setup.
04:59 And hence, recently, AWS has launched another way to achieve the same thing,
05:04 and that is using the network function group in the form of service insertion.
05:10 So, in the next lecture, now let's talk about another way to inspect the traffic in cloud WAN network.
整讲总结 / Overall Summary
中文
本讲介绍 AWS Cloud WAN 中旧式的检查 VPC 附加（Inspection VPC Attachment）流量检查方案。网络设备可以是 Gateway Load Balancer 后的第三方防火墙，或 AWS Network Firewall，并部署在专用检查 VPC（Inspection VPC）中。该 VPC 作为普通 VPC 附加连接到独立检查分段（Inspection Segment），再通过各业务分段和检查分段中的静态路由（Static Route）强制 East–West 或 North–South 流量经过检查。此方法能够工作，但需要每个区域各建检查 VPC、手动维护大量路由，不能原生保证流对称（Flow Symmetry），并且难以跨区域扩展，因此后续推荐网络功能组（Network Function Group）的服务插入（Service Insertion）。
English
This lecture covers the legacy Inspection VPC attachment approach for traffic inspection in AWS Cloud WAN. Network appliances can be third-party firewalls behind a Gateway Load Balancer or AWS Network Firewall, deployed in a dedicated Inspection VPC. The VPC attaches as a regular VPC attachment to a dedicated Inspection Segment, and static routes in business and inspection segments steer East-West or North-South traffic through it. The design works, but it requires an Inspection VPC per Region, extensive manual route management, lacks native flow-symmetry guarantees, and becomes difficult to scale, motivating Network Function Group service insertion.
返回顶部 ↑