Lecture 153: Traffic Inspection in AWS Cloud WAN - Network Function group (Service Insertion)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:40
- 来源：Udemy Lecture 56342013
- Slide 数量：15
- 画面切换：00:14、00:33、00:43、01:28、01:37、01:47、02:12、02:33、02:45、02:54、03:21、03:33、03:50、04:08
扫描说明
逐条检查了 Udemy 页面中的 61 条 Transcript cue，并扫描了全长约 04:40 的视频。该讲由 Network Function Group 定义与优点、NFG Architecture、Egress send-to 和 East–West send-via 四组逐步展开的课件组成；每个新增 bullet、策略块或检查模式均单独作为小节。去除 10 个无新增内容的重复候选帧后，共保留 15 个画面阶段。最终截图均关闭 Transcript 侧栏与播放器控件，完整保留右侧和底部，无黑边，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Network Function Group 新方案
时间范围：00:00–00:14
总结 / Summary
中文
AWS Cloud WAN 使用网络功能组（Network Function Group）作为更简单、策略驱动的流量检查方案。
English
AWS Cloud WAN uses Network Function Groups as a simpler, policy-driven traffic-inspection approach.
Transcript
00:00 All right. So, the better way to inspect the traffic in cloud1 is now using the network
00:06 function group with the CloudWire.
00:08 And now, let's talk about what is this network function group and how it exactly works.
2. NFG 是 Inspection Appliance 的逻辑组
时间范围：00:14–00:33
总结 / Summary
中文
网络功能组（NFG）是检查设备（Inspection Appliance）的逻辑分组，设备仍可来自 Gateway Load Balancer/第三方防火墙或 AWS Network Firewall。
English
An NFG is a logical grouping of inspection appliances, which can still be Gateway Load Balancer/third-party firewalls or AWS Network Firewall.
Transcript
00:14 So, here, network function group is basically a logical grouping of all inspection appliances.
00:20 So which means, you still need all those appliances, whether using the gateway load balancer and
00:25 third party firewall, or using the AWS network firewall.
00:29 But they will be grouped as a network function group.
3. Inspection VPC 关联 NFG
时间范围：00:33–00:43
总结 / Summary
中文
Inspection VPC Attachment 不再关联普通分段（Segment），而是直接关联网络功能组（NFG）。
English
The Inspection VPC attachment is associated with the NFG instead of a regular segment.
Transcript
00:33 And once you have that, then instead of creating the VPC attachment, you will associate these
00:39 network appliances with the network function group.
4. Policy-driven Traffic Steering
时间范围：00:43–01:28
总结 / Summary
中文
核心网络策略（Core Network Policy）可用 send-via 或 send-to 动作，把跨分段或出口流量自动送入 NFG，无需业务分段静态路由。
English
Core Network Policy uses send-via or send-to actions to steer inter-segment or egress traffic through the NFG without business-segment static routes.
Transcript
00:43 Now once you have this network function group, then you can simply define the cloud1 policy.
00:49 And there, you can say that if the traffic is going from one segment to another, then
00:53 send it via this network function group.
00:57 Or if it is about the egress traffic, then you can configure the rule saying that send
01:01 this traffic to network function group and further it will forward the traffic to the internet.
01:08 So this means that if you are using the network function group for the traffic inspection,
01:13 you don't need to manually add those static routes for the development and the production segments.
01:20 So this basically simplifies your traffic inspection architecture to the great extent.
01:26 And further, it provides a lot of benefits.
5. Flow Symmetry
时间范围：01:28–01:37
总结 / Summary
中文
NFG 自动保证流对称（Flow Symmetry），让请求和返回流量经过同一设备实例，这对有状态防火墙（Stateful Firewall）至关重要。
English
The NFG automatically preserves flow symmetry so forward and return traffic traverse the same appliance instance, which is critical for stateful firewalls.
Transcript
01:28 For example, this network function group manages the flow symmetry, which you know is required
01:34 for the stateful firewalls.
6. 完全 Policy-driven
时间范围：01:37–01:47
总结 / Summary
中文
服务插入完全由策略文档（Policy Document）控制，不需要在 Cloud WAN 中创建额外的路由组件。
English
Service insertion is controlled entirely by the policy document and does not require another routing component in Cloud WAN.
Transcript
01:37 And the best part, as I said, it is fully policy driven.
01:40 That means you don't need to create another component in the cloud1 network.
01:44 It is just about the policy document.
7. NFG Benefits
时间范围：01:47–02:12
总结 / Summary
中文
NFG 的主要优点是策略驱动、可扩展、无需手动静态路由，并能跨分段和区域工作。
English
NFG benefits include policy-driven control, scalability, no manual static routes, and operation across segments and Regions.
Transcript
01:47 So the benefits of using the network function group is that they are policy driven, they
01:52 are scalable, there is no manual static route required, and they work across the segments and the region.
01:58 So as you scale your cloud1 network, you don't need to change anything.
02:02 Okay, so I hope it is clear.
02:04 And with that, let me quickly show you the architecture for using this network function
02:09 group for traffic inspection.
8. NFG Architecture
时间范围：02:12–02:33
总结 / Summary
中文
两个区域的 Inspection VPC 统一关联网络功能组（NFG），Development 与 Production Segment 不再保留旧式静态路由矩阵。
English
Inspection VPCs in both Regions associate with one NFG, and Development and Production segments no longer maintain the legacy static-route matrix.
Transcript
02:12 So this was the earlier architecture, as you remember, and there we had these two static
02:17 routes in the production segment and the development segment.
02:21 But with the network function group, you don't need that.
02:25 Instead, you can configure this network function group for egress traffic inspection, or the
02:30 east-west traffic inspection.
9. Egress send-to Policy
时间范围：02:33–02:45
总结 / Summary
中文
出口检查使用 send-to 动作，将 Development Segment 的 Internet 流量重定向到 NFG。
English
Egress inspection uses the send-to action to redirect Development Segment Internet traffic to the NFG.
Transcript
02:33 Now if it is about the egress traffic inspection, then you just need to add this policy document,
02:39 which says that for development segment, the same two traffic should go through this network function group.
10. Production send-to Policy
时间范围：02:45–02:54
总结 / Summary
中文
Production Segment 使用同样的 send-to 规则；把两条声明加入现有核心网络策略即可启用出口检查。
English
The Production Segment uses the same send-to rule; adding both statements to the existing Core Network Policy enables egress inspection.
Transcript
02:45 And same for the production segment as well.
02:48 So if you just add this statement to your existing cloud1 policy, it should work.
11. 先创建并关联 NFG
时间范围：02:54–03:21
总结 / Summary
中文
在策略生效前，需要先创建网络功能组（NFG）并把 Inspection VPC 与之关联。
English
Before the policy can work, the NFG must be created and the Inspection VPC associated with it.
Transcript
02:54 Now before that, of course, you need to create a network function group and associate this
02:57 inspection VPC with that network function group.
03:00 But I hope you got the point.
03:03 Alright, so this was about the egress traffic and there you use this send to action.
03:09 However, if you want to inspect the traffic, which is between the VPCs, that is east-west
03:14 traffic, or between the VPCs and on-premises network, then you can rather use send via
12. East–West send-via Policy
时间范围：03:21–03:33
总结 / Summary
中文
VPC 间、Segment 间或混合网络流量使用 send-via，例如规定 Development 到 Production 必须经过 NFG。
English
VPC-to-VPC, inter-segment, or hybrid traffic uses send-via, for example requiring Development-to-Production traffic to traverse the NFG.
Transcript
03:21 action, which looks something like this.
03:24 So here the action is send via and you are saying that if the traffic is going from development
03:28 to the production, then it should go via this network function group.
13. Single-hop Mode
时间范围：03:33–03:50
总结 / Summary
中文
Single-hop 模式只在源区域检查一次流量，跨区域目的端不会再次经过检查设备。
English
Single-hop mode inspects traffic only in the source Region and does not inspect it again in the destination Region.
Transcript
03:33 And here AWS also offers options like using a single mode hop, that means the traffic
03:39 will be inspected only in the source region.
03:42 For example, if the traffic is going from this VPC-A in North Virginia region, then
03:47 it will only be inspected in that particular region.
14. Dual-hop Mode
时间范围：03:50–04:08
总结 / Summary
中文
Dual-hop 模式在源区域和目标区域各检查一次，适用于目的 VPC 位于另一 AWS 区域的场景。
English
Dual-hop mode inspects traffic in both the source and destination Regions when the destination VPC is in another AWS Region.
Transcript
03:50 However, you can make it dwell hop as well, where the traffic will be inspected in both
03:55 the source region and the target region, if your destination VPC is in another region,
04:01 which is for example Mumbai region in this case.
04:04 So in that case, you can configure the mode as dwell hop mode.
15. 通过 Policy 简化 Inspection
时间范围：04:08–04:40
总结 / Summary
中文
只需修改 Cloud WAN 策略（Cloud WAN Policy），即可让 Inspection VPC 中的网络设备自动检查流量，大幅降低整体网络管理复杂度。
English
Modifying the Cloud WAN policy is sufficient to steer traffic through appliances in the Inspection VPC, greatly simplifying network management.
Transcript
04:08 So likewise, you can simply just modify your cloud WAN policy document, and your traffic
04:14 will be inspected using your network appliances, which are in your inspection VPC.
04:21 So as you can see, this greatly simplifies your overall cloud WAN network management
04:26 when it comes to the traffic inspection, right?
04:30 So I hope it is clear and that's it really about the traffic inspection in cloud WAN.
04:36 And with that, now let's go to the next lecture. Thank you.
整讲总结 / Overall Summary
中文
本讲介绍 AWS Cloud WAN 的网络功能组（Network Function Group，NFG）与服务插入（Service Insertion）。NFG 把 Inspection VPC 中的 Gateway Load Balancer/第三方防火墙或 AWS Network Firewall 逻辑分组，并通过核心网络策略（Core Network Policy）自动引流，无需在各 Segment 手动维护静态路由。它能够跨 Segment 和 Region 扩展，并为有状态防火墙提供流对称（Flow Symmetry）。send-to 动作用于把出口流量重定向到 NFG 后再访问 Internet；send-via 用于 VPC 间、Segment 间或混合网络流量，并支持 Single-hop 和 Dual-hop 检查模式。
English
This lecture introduces AWS Cloud WAN Network Function Groups (NFGs) and service insertion. An NFG logically groups Gateway Load Balancer/third-party firewall or AWS Network Firewall appliances in Inspection VPCs and steers traffic through Core Network Policy instead of manually maintained static routes in every segment. It scales across segments and Regions and preserves flow symmetry for stateful firewalls. The send-to action redirects egress traffic through an NFG before the Internet, while send-via handles VPC-to-VPC, inter-segment, and hybrid traffic with single-hop or dual-hop inspection modes.