Lecture 154: AWS Cloud WAN Summary
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：03:57
- 来源：Udemy Lecture 42504406
- Slide 数量：10
- 画面切换：00:08、00:24、00:43、00:51、01:05、01:40、02:26、02:31、03:03
扫描说明
逐条检查了 Udemy 页面中的 45 条 Transcript cue，并扫描了全长约 03:57 的视频。该讲使用同一张 AWS Cloud WAN Summary 幻灯片逐条揭示考试要点；每个新增要点均作为小节。早期 2 张无新增内容的候选帧出现播放器错误弹窗，标题与前两条要点已在新标签重截，其余重复帧一并剔除；最终保留 10 个有效画面阶段。最终截图无错误弹窗、无 Transcript 侧栏、无播放器控件、无黑边或右下裁切，并统一输出为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. AWS Cloud WAN Summary 标题
时间范围：00:00–00:08
总结 / Summary
中文
本讲集中复习 AWS Cloud WAN 的核心概念和考试重点。
English
This lecture consolidates the key AWS Cloud WAN concepts and exam points.
Transcript
00:00 Okay, so quick summary of AWS CloudWAN and this is something also important to know for your exam.
2. Managed WAN Service
时间范围：00:08–00:24
总结 / Summary
中文
AWS Cloud WAN 是 AWS 提供的托管广域网服务（Managed Wide-area Networking Service），面向全球网络。
English
AWS Cloud WAN is an AWS-managed wide-area networking service for global networks.
Transcript
00:08 So AWS CloudWAN is a managed wide area network service from AWS and then it's a global service
00:16 and it provides you a centralized dashboard through which you can completely monitor and
00:21 manage your entire global network.
3. AWS Network Manager Dashboard
时间范围：00:24–00:43
总结 / Summary
中文
AWS Network Manager 提供中央控制台（Central Dashboard），用于监控和管理整个全局网络（Global Network）。
English
AWS Network Manager provides a central dashboard for monitoring and managing the entire Global Network.
Transcript
00:24 Now this central dashboard is a part of AWS Network Manager service.
00:29 Now CloudWAN also has a global network and global network consists of transit gateway
00:34 networks and the core networks.
00:36 But whenever we talk about CloudWAN, typically we are referring to the core network connections.
4. Core Network Policy
时间范围：00:43–00:51
总结 / Summary
中文
核心网络策略（Core Network Policy）用简单策略集中配置并自动化网络管理。
English
Core Network Policy uses simple policies to centralize configuration and automate network management.
Transcript
00:43 Now you use simple network policies to centrally configure and automate the network management
00:48 using the core network policy.
5. Segments 类似 VRF
时间范围：00:51–01:05
总结 / Summary
中文
分段（Segment）像虚拟路由与转发实例（Virtual Routing and Forwarding，VRF）一样隔离网络流量，这是 Cloud WAN 与 Transit Gateway 的重要区别。
English
Segments isolate network traffic like Virtual Routing and Forwarding instances, an important difference from Transit Gateway.
Transcript
00:51 And you can then have the different network segments, which works like virtual routing
00:57 and forwarding VR apps.
00:59 And this is one of the way in which the CloudWAN differs from the transit gateways.
6. 跨账户共享 Core Network
时间范围：01:05–01:40
总结 / Summary
中文
核心网络（Core Network）可通过 AWS Resource Access Manager（RAM）在同一或不同 AWS Organizations 的账户间共享，让伙伴或客户 VPC 接入同一全球网络。
English
A Core Network can be shared through AWS Resource Access Manager across accounts in the same or different AWS Organizations, allowing partner or customer VPCs to join one global network.
Transcript
01:05 Further core network can be shared across AWS accounts.
01:08 We haven't seen this in particular, but when you create a core network, you can share that
01:14 with other AWS account in the same AWS organization or across AWS organization.
01:20 Then the other AWS account owner can connect their VPCs to your core network.
01:27 Now in this fashion, you can really have your partner or customers also connecting to your
01:32 one large global network.
01:34 So this is done using the Resource Access Manager or RAM.
7. Supported Attachments
时间范围：01:40–02:26
总结 / Summary
中文
Cloud WAN 支持 VPC Attachment、Site-to-Site VPN Attachment、Connect/SD-WAN Attachment 和 Transit Gateway Route Table Attachment；后者要求先进行 TGW–Core Network Peering。
English
Cloud WAN supports VPC, Site-to-Site VPN, Connect/SD-WAN, and Transit Gateway route-table attachments; the last requires TGW-to-Core Network peering first.
Transcript
01:40 Now with respect to the attachment, AWS CloudWAN currently supports VPC attachment, site to
01:46 site VPN attachment and SD-WAN connect attachment and transit gateway route table attachment.
01:54 Now for transit gateway route table attachment, you have to first peer your transit gateway
01:59 to the core network and then you can create this attachment.
02:04 And another difference when you have the connect attachment is that alongside the GRE tunnel,
02:11 it also supports the tunnelless protocol, which is a more performant than the GRE.
02:18 So this is an additional protocol that you get to use while you connect your SD-WAN network
02:24 to the CloudWan.
8. GRE 与 Tunnel-less Protocol
时间范围：02:26–02:31
总结 / Summary
中文
Connect Attachment 除 GRE Tunnel 外还支持性能更高的无隧道协议（Tunnel-less Protocol），用于连接 SD-WAN。
English
Connect attachments support both GRE tunnels and a higher-performance tunnel-less protocol for SD-WAN connectivity.
Transcript
02:26 Further with respect to connecting your CloudWan network to your direct connect connection,
9. Direct Connect Gateway Attachment
时间范围：02:31–03:03
总结 / Summary
中文
原生 Direct Connect Gateway Attachment 通过 Transit VIF 和 Direct Connect Gateway 直接连接 Cloud WAN，不再需要中间 Transit Gateway。
English
The native Direct Connect Gateway attachment connects Cloud WAN through a Transit VIF and Direct Connect Gateway without an intermediate Transit Gateway.
Transcript
02:31 now AWS supports this native attachment that is direct connect gateway attachment.
02:38 And for this, you have to first create the transit wave on your direct connect connection
02:42 and then you have to create the direct connect gateway and then create the direct connect
02:47 gateway attachment on your CloudWan network.
02:51 So you can now natively connect direct connect and your CloudWan network. All right.
02:58 And finally, we also talk about the traffic inspection in the CloudWan.
10. Network Function Group Service Insertion
时间范围：03:03–03:57
总结 / Summary
中文
流量检查推荐网络功能组（Network Function Group）服务插入（Service Insertion）：Inspection VPC 关联 NFG，策略用 send-to 或 send-via 检查出口流量（Egress Traffic）和东西向流量（East–West Traffic）。
English
For traffic inspection, Network Function Group service insertion associates Inspection VPCs with an NFG and uses send-to or send-via policy actions for egress and East-West traffic.
Transcript
03:03 And for that, you should ideally use network function group, which is also called as service insertion.
03:11 And in there, you can deploy your network appliances in the inspection VPC and then
03:17 you can associate your inspection VPC with this network function group.
03:22 And once you do that, then you can define simply the CloudWan policy in the form of
03:26 send to traffic or send via traffic depending on the segment and depending on which traffic
03:34 you want to inspect.
03:36 So in this fashion, you can also perform the traffic inspection.
03:40 All right, so these are all the important things about the AWS CloudWan that you should
03:45 know for your exam and I hope you will remember those.
03:50 So that's it really about AWS CloudWan and with that, now let's go to the next section.
整讲总结 / Overall Summary
中文
本讲总结 AWS Cloud WAN 的考试重点：它是全球托管广域网服务（Managed WAN Service），由 AWS Network Manager 提供中央控制台；全局网络（Global Network）包含 Transit Gateway Network 与核心网络（Core Network），并通过核心网络策略（Core Network Policy）集中自动化配置。分段（Segment）类似 VRF，用于隔离路由域；Core Network 可通过 AWS Resource Access Manager（RAM）跨账户共享。支持的 Attachment 包括 VPC、Site-to-Site VPN、Connect/SD-WAN、Transit Gateway Route Table 和 Direct Connect Gateway；Connect 支持 GRE 与 Tunnel-less Protocol。流量检查推荐网络功能组（Network Function Group）服务插入（Service Insertion），通过 send-to 与 send-via 策略检查 Egress 和 East–West 流量。
English
This lecture summarizes the exam-relevant AWS Cloud WAN concepts. Cloud WAN is a global managed WAN service with a centralized AWS Network Manager dashboard. A Global Network contains Transit Gateway networks and Core Networks, and Core Network Policy centrally automates configuration. Segments act like VRFs for routing isolation, and Core Networks can be shared across accounts through AWS Resource Access Manager. Supported attachments include VPC, Site-to-Site VPN, Connect/SD-WAN, Transit Gateway route table, and Direct Connect Gateway; Connect supports GRE and a tunnel-less protocol. For inspection, Network Function Group service insertion uses send-to and send-via actions for egress and East-West traffic.