Lecture 235: Gateway Load Balancer and Traffic flow
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：11:06
- 来源：Udemy Lecture 29240466
- Slide 数量：7
- 画面切换：02:16、04:14、06:16、06:54、07:36、08:35
扫描说明
逐条读取了 Transcript 面板中的 283 条英文 cue，并按播放器可见时钟扫描全长约 11:06 的视频。依据 Components、GENEVE Encapsulation、Symmetric Flow、Multi-AZ、IGW Ingress Route、Subnet Routes、End-to-End Flow 划分为 7 个小节。7 张截图从实际视频内容区精确裁取，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Application VPC 通过 GWLBE 消费独立 Appliance VPC 中的服务
时间范围：00:00–02:16
总结 / Summary
中文
推荐把 Application Workload 与 Network Appliance Fleet 放在两个 VPC 中：Application VPC 是 Service Consumer，Network Appliance VPC 是 Service Provider。后者用 Gateway Load Balancer（GWLB）把多个 Firewall、IDS/IPS 或其他 Virtual Appliance 组织成 Target Group；前者创建 Gateway Load Balancer Endpoint（GWLBE），经 AWS PrivateLink 接入该 Service。也可部署在同一 VPC，但 GWLBE 与 Application Server 必须位于不同 Subnet。GWLBE 的关键能力是可直接作为 Route Table Target，因此 Traffic Steering 不依赖单台 Appliance ENI。
English
The recommended design separates application workloads from the network-appliance fleet. The Application VPC consumes a service, while the Network Appliance VPC provides it through a Gateway Load Balancer backed by multiple firewalls, IDS or IPS systems, or other virtual appliances. A Gateway Load Balancer endpoint in the consumer VPC reaches that service over AWS PrivateLink. The components may share one VPC, but the GWLBE and application servers must be in different subnets. Crucially, a GWLBE is a valid route-table target, so traffic steering is no longer tied to one appliance ENI.
Transcript
00:00 Okay so,
00:01 now let's see how Gateway load balancer
00:03 solves these problems, right.
00:04 Now here we are showing two VPCs
00:07 because this is what the ideal architecture would be,
00:09 but you can very well have just single VPC
00:12 and you could have Gateway load balancer
00:13 and endpoint and applications and firewalls
00:16 in the same VPC as well.
00:18 Bare minimum, it is required that your application sub-net
00:21 and Gateway load balancer endpoint subnet
00:23 should be different.
00:24 And what that means, I will explain that shortly.
00:27 But to have better architecture,
00:28 I'm showing here the two separate VPC for application VPC
00:32 and network appliances with VPC.
00:34 And I hope that is fine.
00:36 So on the left side, you have application VPC,
00:38 which obviously would have your application,
00:41 typically a web application,
00:42 probably running in a public subnet.
00:44 but let's not go into the details
00:47 at the sub-net level as of now.
00:48 Let's try to understand
00:49 how Gateway load balancer architecture looks like.
00:52 So on the right side,
00:54 you have a network appliance VPC,
00:56 which means there will be multiple network appliances.
00:59 And obviously as the name suggests
01:01 Gateway load balancer should be able to balance the load
01:04 across this network appliances.
01:06 So in the network appliance VPC,
01:08 you would have the Gateway load balancer provisioned,
01:12 which ultimately sends traffic to this network appliances.
01:15 Now, in order for the application VPC
01:18 to send the traffic to the Gateway load balancer,
01:21 you need something called Gateway load balancer endpoint.
01:24 This is very similar to the VPC endpoint.
01:27 So you might recall from the VPC private link lecture,
01:30 where you could host your own VPC and point services.
01:33 And then in order to access these services,
01:36 you have to provision the VPC endpoint
01:38 into your consumer VPC.
01:40 Now, similar architecture here, in that case,
01:43 you have Gateway load balancer endpoint
01:45 in the application VPC.
01:48 And this sets up the private link
01:49 with the Gateway load balancer.
01:51 There is one difference though
01:53 between the Gateway load balancer endpoint
01:55 and other VPC endpoint.
01:57 You can add the Gateway load balancer endpoint
01:59 as a next half in the route table.
02:02 Which you can't do with the VPC endpoints otherwise.
02:05 And that's where it allows you to, you know,
02:07 redirect traffic from internet
02:09 to the Gateway load balancer directly.
02:11 And we'll talk about that flow shortly,
02:13 but this is one difference that you will notice here.
2. Ingress Route 把 Packet 送入 GWLBE，GENEVE 保留原始 Flow 信息
时间范围：02:16–04:14
总结 / Summary
中文
Inbound Packet 到达 Internet Gateway 后，Edge-associated Ingress Route 把目标为 Application Subnet 的 Traffic 重定向到 GWLBE。Endpoint 通过 PrivateLink 交给 GWLB，GWLB 再选择一台健康 Appliance。GWLB 与 Appliance 之间使用 GENEVE（Generic Network Virtualization Encapsulation）封装 Layer-3 Packet；Appliance 解封装后仍能看到原始 Source/Destination IP、Protocol 与 Port，因此可以按真实 5-tuple 做 Inspection 和 Policy Enforcement，而不需要 Vendor-specific GRE 等专有封装。
English
When an inbound packet reaches the Internet gateway, an edge-associated ingress route redirects traffic for the application subnet to the GWLBE. The endpoint carries it over PrivateLink to the GWLB, which selects a healthy appliance. Between the GWLB and the appliance, GENEVE—Generic Network Virtualization Encapsulation—wraps the Layer-3 packet. After decapsulation, the appliance still sees the original source and destination addresses, protocol, and ports, enabling inspection and policy enforcement on the real five-tuple without vendor-specific encapsulation such as proprietary GRE.
Transcript
02:16 Now, if you look at the traffic flow,
02:17 as the ingress traffic hits the Internet Gateway,
02:21 somehow you will modify the route table
02:24 and will redirect all this traffic
02:26 to the Gateway load balancer endpoint,
02:28 instead of directly sending it to the application.
02:31 And then Gateway load balancer endpoint,
02:33 will send that traffic by default
02:35 to the Gateway load balancer,
02:37 and then Gateway load balancer
02:38 will forward that traffic to the network appliances.
02:42 And once the traffic is returned
02:44 from the Gateway load balancer
02:45 to the Gateway load balancer endpoint,
02:47 then it will hit the application.
02:49 And that's where every packet will be,
02:51 go through this network appliances.
02:53 Now, one thing to understand, that Gateway load balancer
02:55 uses something called Geneva protocol
02:59 to send traffic to the network appliances.
03:01 Now, if you've never heard about the Geneva protocol,
03:04 it is basically
03:06 Generic Network Virtualization Encapsulation protocol,
03:09 which is a wrapper over L3 traffic.
03:13 So as you get the packet at L3 level, right,
03:16 it encapsulates that traffic
03:18 and puts its own header on top of it.
03:21 And the benefit is that your packet is unchanged.
03:24 That means the source
03:26 and destination address of the packet remains the same.
03:28 So your network appliances
03:30 actually knows that the traffic
03:31 is coming from a particular IP address.
03:34 It can remove those encapsulation headers
03:36 and actually can see the source
03:38 and destination traffic IP's
03:40 and the ports for your packet, right?
03:43 So that's a Geneva protocol.
03:44 Now, there is some history to why Geneva protocol was made.
03:48 Earlier there were other protocols
03:50 or maybe a different vendors have their own protocol
03:52 like Cisco developed GRE,
03:54 that is Generic Routing Encapsulation.
03:56 It's a tunneling protocol, as you know.
03:58 And there are certain wide variety of the, you know,
04:01 such internet protocol for Encapsulations.
04:04 So in order to really have a standardized way
04:08 of this encapsulation,
04:09 Generic Network Virtualization Encapsulation,
04:12 that is Geneva protocol was developed.
3. Flow Stickiness 保证双向经过同一 Appliance，并提供 Health-aware Scale
时间范围：04:14–06:16
总结 / Summary
中文
检查后的 Packet 从 Appliance 回到 GWLB，再经同一个 GWLBE 到 Application；Return Traffic 也沿 Application → GWLBE → GWLB → 同一 Appliance → GWLB → GWLBE/IGW 的方向返回。GWLB 为 Flow 保持 Stickiness/Symmetry，避免普通 ECMP 让正向和反向流量落到不同的 Stateful Firewall。它同时进行 Health Check，把失效 Appliance 从可用目标中移除，并可在 Fleet 中 Horizontal Scale。相同 Service 还可供多个 Spoke VPC 消费，同时让每条 Flow 返回其原始 VPC。
English
After inspection, the packet returns from the appliance to the GWLB and then through the same GWLBE to the application. Return traffic follows the application to GWLBE to GWLB to the same appliance and back toward the IGW. GWLB maintains flow stickiness and symmetry, avoiding the ECMP problem where opposite directions reach different stateful firewalls. It also health-checks appliances, removes unhealthy targets, and supports horizontal fleet scaling. Multiple spoke VPCs can consume the same service while each flow returns to its originating VPC.
Transcript
04:14 Okay, back to the original flow of the traffic.
04:18 The network appliances will send the traffic
04:20 back to the Gateway load balancer.
04:22 It will come back to the Gateway load balancer endpoint,
04:24 and then it will again hit your application.
04:28 And application will then return the traffic
04:30 to the Gateway load balancer endpoint.
04:32 And the similar flow will apply now.
04:34 Instead of directly going to the internet Gateway,
04:37 the traffic again, will go to the Gateway load balancer
04:39 to the network appliances, will come back
04:41 and finally Gateway load balancer
04:43 will send it to the internet via this internet Gateway.
04:48 So if I talk about this architecture, it's simple,
04:50 low-latency, scalable,
04:52 because here there is a fleet of network appliances
04:55 and HA as well.
04:57 HA because Gateway load balancer supports the health checks.
05:00 And if one of the network appliance is not healthy,
05:03 it will automatically
05:04 send that traffic to another network appliance.
05:07 Now, good thing about the Gateway load balancer is that.
05:10 it does what other protocols cannot.
05:12 For example, you know ECMP, right.
05:15 Equal cost multi-part.
05:16 Now the problem with ECMP is that
05:18 it cannot really maintain the symmetric flow of the traffic.
05:23 That means if the traffic is
05:24 going through one of the tunnel,
05:26 it may come back from another tunnel, right?
05:29 It's asymmetric routing typically.
05:31 But Gateway load balancer maintains the symmetric flow.
05:34 It knows the source of the flow.
05:36 And it will send the traffic
05:38 to a particular network appliance only.
05:39 And we'll send the response back to the same flow.
05:43 So this allows sending the bi-directional traffic
05:45 transparently over the same consistent route, right?
05:49 And this is similar to, you know, bumping the wire target.
05:51 Like it also keeps the stickiness
05:53 with the network appliances
05:55 and that's where it makes it a great choice
05:57 when you have to maintain the symmetric flow
05:59 and the stickiness.
06:01 And which also means you could have multiple VPCs
06:04 say multiple spoke VPCs,
06:05 all sending to the traffic
06:07 to the same Gateway load balancer,
06:09 but the traffic will be routed back to the VPC,
06:12 which originated that traffic.
06:14 So this is what Gateway load balancer provides you.
4. 每个 AZ 部署 GWLBE，Appliance Fleet 用 UDP 6081 接收 GENEVE
时间范围：06:16–06:54
总结 / Summary
中文
GWLBE 是 Availability Zone 级资源，因此 Production Architecture 通常在每个需要 Inspection 的 AZ 中部署一个 Endpoint，并让该 AZ 的 Application Subnet 指向本地 GWLBE。Network Appliance VPC 中也跨多个 AZ 部署 Appliance Target，以获得 High Availability。GWLB 与 Appliance 之间的 GENEVE Traffic 使用 UDP Port 6081；Appliance、Security Group 与相关 ACL 必须允许这条数据路径及 Health Check。
English
A GWLBE is an Availability Zone-scoped resource, so production designs normally deploy one endpoint in every AZ that requires inspection and point each application subnet at its local endpoint. The Network Appliance VPC likewise places appliance targets across multiple AZs for high availability. GENEVE traffic between the GWLB and appliances uses UDP port 6081, which the appliance, security groups, and relevant ACLs must allow along with health-check traffic.
Transcript
06:16 Now let's see how the traffic flow looks like.
06:19 Now I am using here one availability zone,
06:22 but for high availability, as you know,
06:24 that should be multiple availability zones.
06:26 So Gateway load balancer endpoint
06:28 should be provision across multiple EC
06:30 because scope is as EC level, right.
06:33 On the right side, you have network appliance VPC.
06:35 Here I have shown two EC's
06:37 and then network appliances are across multiple EC's.
06:40 And then Gateway load balancer
06:41 will send traffic to this network appliances
06:44 or port 6, 0, 8, 1 using the Geneva protocol.
06:48 Okay. So there are users here
06:50 and they want to access your application here
06:52 in this EC2 machine.
5. IGW Ingress Route 将受保护 Subnet CIDR 指向 GWLBE
时间范围：06:54–07:36
总结 / Summary
中文
Application VPC 的 Internet Gateway 需要 Edge-associated Route Table。VPC Local Route 保留，而受保护 Application Subnet CIDR（示例 10.0.1.0/24）的 Target 改为对应 GWLBE。这样来自 Internet、原本会直接进入 Public Subnet 的 Packet，先被送到 Inspection Chain；只有 Appliance 允许并返回的 Traffic 才继续到 Application。Route Target 应与目标 Workload 的 AZ 设计保持一致。
English
The Application VPC's Internet gateway uses an edge-associated route table. The VPC local route remains, while the protected application-subnet CIDR—10.0.1.0/24 in the example—targets the corresponding GWLBE. Internet packets that would otherwise enter the public subnet directly are therefore sent through the inspection chain first, and only traffic allowed and returned by the appliance continues to the application. The route target should align with the target workload's AZ design.
Transcript
06:54 Now let's look at the route tables,
06:56 how they should be look like, right.
06:58 Now user will hit the Internet Gateway.
07:00 Internet Gateway knows where my EC2 instance is
07:03 and it converts your public IP traffic to the private IP.
07:07 And it typically redirects
07:09 that traffic to your EC2 instances
07:11 having the public IP, right?
07:13 But in this case, you want to modify that behavior
07:17 and say, if the traffic is going to the EC2 instances,
07:20 it should first go to the Gateway load balancer endpoint.
07:23 And that's where you would have an ingress routing table
07:27 for your internet Gateway.
07:29 And you will say if the traffic
07:30 is going to this particular sub-net,
07:32 it should go to the Gateway load balancer endpoint first.
6. Application Subnet 与 Endpoint Subnet 的 Default Route 分工形成闭环
时间范围：07:36–08:35
总结 / Summary
中文
Application Subnet Route Table 把 0.0.0.0/0 指向 GWLBE，使 Server 发起的 Outbound 与 Return Traffic 都必须重新进入 Appliance Service。GWLBE 所在 Subnet 的 Route Table 则把 0.0.0.0/0 指向 Internet Gateway：这是从 GWLB 检查完成后返回 Endpoint 的 Packet 离开 VPC 的路径。两张 Route Table 的方向不同但互补；配合 IGW Ingress Route，才形成 Inbound 与 Outbound 都对称经过 Inspection 的闭环。
English
The application-subnet route table sends 0.0.0.0/0 to the GWLBE, forcing both server-originated outbound traffic and return traffic back into the appliance service. The subnet containing the GWLBE instead sends 0.0.0.0/0 to the Internet gateway, providing an exit for packets returned to the endpoint after GWLB inspection. The two route tables have different but complementary roles; together with the IGW ingress route, they create a closed, symmetric inspection path in both directions.
Transcript
07:36 Okay, now let's look at the other route tables.
07:38 So there is a route table for your
07:41 Gateway load balancer endpoint, subnet as well.
07:43 Now in this sub-net,
07:44 there is an route table entry
07:46 which says the traffic going to the internet
07:48 should go through the Internet Gateway.
07:50 Now this will be used for the return traffic.
07:52 As the ingress traffic will hit the load balancer.
07:56 We'll come back, we'll go to the EC2 instances.
07:58 And then the return traffic will come back.
08:00 Then it knows how the traffic should go back to the users
08:04 via this internet Gateway.
08:05 And that's where this entry is.
08:07 Now, if you talk about the application server route tables,
08:12 you need to think right,
08:13 how the traffic will go back to the internet.
08:16 It shouldn't directly go back.
08:17 It should again go back through this
08:19 Gateway load balancer endpoint.
08:21 And in that case again, you would have entry,
08:24 which says if the traffic is going to the internet,
08:26 it should go to the Gateway load balancer endpoint, right?
08:30 So this is how the route table should look like
08:32 for your application server subnet as well.
7. 完整 Ingress/Egress Flow 始终两次穿过 Endpoint 与 GWLB
时间范围：08:35–11:06
总结 / Summary
中文
Inbound Flow 是 Internet → IGW → GWLBE → GWLB → 选中的 Appliance → GWLB → GWLBE → EC2。EC2 Response 由 Application Subnet Default Route 再送到 GWLBE，随后经 GWLB 和同一 Appliance 检查，返回 GWLB/GWLBE，并依据 Endpoint Subnet Route 到 IGW。Outbound Flow 从 EC2 开始也遵循 GWLBE → GWLB → Appliance → GWLB → GWLBE → IGW；外部 Response 再走对称路径。理解 Endpoint 的两个方向很重要：VPC 内 Route 指向 GWLBE 时，它把 Traffic 送往 GWLB；GWLB 返回 GWLBE 的 Traffic 则按 Endpoint Subnet Route 继续转发。
English
The inbound flow is Internet to IGW to GWLBE to GWLB to the selected appliance, then back through GWLB and GWLBE to EC2. The EC2 response is sent by the application subnet's default route to the GWLBE, inspected by the same appliance through the GWLB, returned to the GWLBE, and forwarded to the IGW according to the endpoint-subnet route. An outbound flow begins with the same GWLBE-GWLB-appliance-GWLB-GWLBE-IGW chain, and the external response follows the symmetric reverse path. The endpoint has two directional semantics: VPC routes targeting it send traffic to the GWLB, while traffic returned from the GWLB follows the endpoint subnet's route table.
Transcript
08:35 Now, if you look at the traffic flow,
08:37 there will be users,
08:38 who will be hitting the public IP off your EC2 application.
08:43 It will hit the internet Gateway.
08:44 Internet Gateway will redirect that traffic to
08:48 Gateway load balancer endpoint,
08:51 and it will further take this traffic
08:53 to the Gateway load balancer.
08:55 It will distribute that traffic to the network,
08:57 with your appliances.
08:59 It will get the traffic from there.
09:01 Now Gateway load balancer, we'll look at the route table
09:03 and we'll see the traffic is
09:05 the destination for the EC2 instances.
09:08 It will send the traffic EC2 instances.
09:10 EC2 instances will response back
09:12 to the Gateway load balancer
09:13 because there is this entry.
09:15 And in this point, a key in the Gateway load balancer
09:17 will send traffic to the Gateway load balancer.
09:21 It will return the traffic.
09:22 And now this route table
09:24 will be used to send the traffic back to the user.
09:27 So this is how N2 inflow look for the ingress traffic.
09:30 Now you must be wondering
09:32 why the Gateway load balancer endpoint
09:34 will only apply this particular entry
09:37 for the return traffic, right?
09:39 Why not for the incoming traffic?
09:41 Now Gateway load balancer endpoint understand that
09:45 the traffic has been originated within the VPC,
09:47 or it's been originated by the Gateway load balancer.
09:51 If it's a Gateway load balancer,
09:52 then only it applies this route table.
09:54 Otherwise the direct traffic,
09:56 which is coming to the Gateway load balancer,
09:58 which is not a return traffic,
09:59 will, it will directly send it to the Gateway load balancer.
10:03 I know this could be a little confusing,
10:05 but if you look at this architecture
10:06 and understand this flow,
10:08 I hope it will be clear to you.
10:10 So this is how the ingress traffic flow works.
10:12 Now, if EC2 machine wants to access the internet,
10:16 that is an ingress traffic for this,
10:18 similar flow would apply.
10:20 So in this case, the EC2 instances will send the traffic
10:23 to the Gateway load balancer endpoint
10:24 because there is this route table entry.
10:27 Now Gateway load balancer will then again,
10:29 send the traffic to Gateway load balancer
10:31 to the network appliance.
10:32 It will come back to the Gateway load balancer endpoint,
10:35 and finally it will apply this route table
10:37 and we'll send the traffic to Internet Gateway
10:39 and out the internet, right?
10:42 And then the reverse flow for the return traffic will apply.
10:45 That we just talked about for the ingress traffic.
10:48 So this is how the overall architecture should look like
10:51 for your Gateway load balancer.
10:53 So I hope that is clear.
10:54 And with that,
10:55 now we will look into some of the properties
10:58 of the Gateway load balancer
10:59 and then we'll also do some labs around it.
11:02 So thanks for watching.
整讲总结 / Overall Summary
中文
Gateway Load Balancer 把 Application VPC 中可作为 Route Target 的 GWLBE、PrivateLink、GWLB 和跨 AZ 的健康 Appliance Fleet 组合成透明 Inspection Service。GENEVE over UDP 6081 保留原始 Packet 信息，GWLB 提供 Health Check、Horizontal Scale 与 Flow Symmetry。正确的 IGW Ingress、Application Subnet 和 GWLBE Subnet Route 共同确保 Internet Ingress、Server Return 与 Outbound Traffic 都经过同一 Stateful Appliance。
English
Gateway Load Balancer combines a route-targetable GWLBE in the Application VPC, PrivateLink, a GWLB, and a health-checked multi-AZ appliance fleet into a transparent inspection service. GENEVE over UDP 6081 preserves original packet information, while the GWLB supplies health checks, horizontal scale, and flow symmetry. Correct IGW ingress, application-subnet, and GWLBE-subnet routes ensure that Internet ingress, server return, and outbound traffic all traverse the same stateful appliance.
返回顶部 ↑