Lecture 236: Hands On: Gateway Load Balancer
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：23:45
- 来源：Udemy Lecture 29240488
- Slide 数量：8
- 画面切换：04:48、09:44、12:01、14:29、17:51、20:04、21:39
扫描说明
逐条读取了 Transcript 面板中的 533 条英文 cue，并按播放器进度精确同步全长约 23:45 的视频。依据 Lab Architecture、Appliance Launch、GWLB/Target Group、Endpoint Service/GWLBE、Health/Packet Capture、IGW Ingress Route、Subnet Routes、Traffic Validation 划分为 8 个小节。期间 Udemy 的购券插屏短暂覆盖播放器，已通过切换课程项恢复；受遮挡截图全部作废并从真实讲座画面重截。8 张最终截图均从视频内容区裁取并统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 两 VPC、六 Subnet 与 Jump Host 组成可验证的 GWLB Lab
时间范围：00:00–04:48
总结 / Summary
中文
Lab 使用 Application VPC（10.0.0.0/16）与 Network Appliance VPC（192.168.0.0/16）。前者分别给 Jump Host、GWLBE 与 Application 使用 10.0.0.0/24、10.0.10.0/24、10.0.20.0/24；后者分别给 Jump Host、GWLB 与 Check Point Appliance 使用 192.168.0.0/24、192.168.10.0/24、192.168.20.0/24。Jump Host 保留管理路径，避免一旦修改 Application Route 或 Appliance 默认阻断 SSH 后失去访问。Lab 为节省时间只用单 AZ；Production 应让 Endpoint、GWLB 与 Appliance Fleet 跨多个 AZ。
English
The lab uses an Application VPC at 10.0.0.0/16 and a Network Appliance VPC at 192.168.0.0/16. The first assigns 10.0.0.0/24, 10.0.10.0/24, and 10.0.20.0/24 to the jump host, GWLBE, and application. The second assigns 192.168.0.0/24, 192.168.10.0/24, and 192.168.20.0/24 to its jump host, GWLB, and Check Point appliance. Jump hosts preserve a management path if route changes or the appliance's default policy blocks SSH. The lab uses one AZ for speed, but production endpoints, GWLB resources, and appliance fleets should span multiple AZs.
Transcript
00:00 Okay, so based on what we discussed so far,
00:03 let's try to do the lab now.
00:05 Now I know that this is a little early to get into the labs,
00:08 but essentially what we just looked at the flow,
00:11 we are going to implement the same,
00:13 and this is not a simple lab
00:15 because it involves a lot of route tables,
00:17 as you already saw.
00:19 It also involves traffic re-directions,
00:22 and therefore it is recommended that
00:24 you really watch this carefully
00:26 and try to then implement on your own.
00:29 Now, in order to set up this lab,
00:32 I have a similar setup that I just explained
00:35 in the earlier lecture.
00:37 That means we would have Application VPC,
00:39 and then we would have Network Appliance VPC.
00:42 And in Application VPC,
00:44 we will have Gateway Load Balancer endpoint,
00:46 which talks to the Gateway Load Balancer
00:48 in the Network Appliance VPC,
00:49 which further talks to the Network Appliances.
00:52 Now you might be having multiple questions at this moment.
00:55 The first one is what about this Network Appliances,
00:59 from where we'll get it?
01:00 So for Network Appliances, AWS already has so many partners
01:04 who can provide the ec2 base Network Appliances.
01:08 And for that, you have to just go to AWS Marketplace,
01:11 search for the Network Appliances,
01:13 which are compatible with the Gateway Load Balancer,
01:16 and then you will find a list of the providers.
01:19 So for this exercise, I'm using Check Point
01:21 as one of the Network Appliances.
01:24 Now, if you drill down into this architecture,
01:26 you know that we need multiple subnets
01:28 and then we need to have corresponding group tables
01:31 that we discussed in the last lecture.
01:33 So this is how my architecture will look like for this lab.
01:37 Now I'm having Application VPC with the CIDR 10.0.0.0/16
01:42 and Network Appliance VPC
01:44 with the CIDR range of 192.168.0.0/16.
01:49 Now in the Application VPC,
01:51 ultimate goal is to reach to this Application
01:54 from the internet,
01:55 as well as this Application
01:57 should be able to go to the internet,
01:59 but all this traffic should be routed
02:01 through my Gateway Load Balancer
02:03 and to my Check Point Network Appliance.
02:06 Now in the Application VPC, I have three subnets
02:10 and I'll explain why,
02:12 and in the Network Appliance VPC
02:14 I have again three subnets,
02:16 out of which two subnets are private,
02:17 and one subnet that is public, which is for the Jump host.
02:20 Now in both these VPCs, I have Jump host
02:23 and Jump host needs to be in a public subnet as you know.
02:26 Now, why do I have Jump host here?
02:29 Because say my Application can be reached directly
02:32 from the internet because it's in a public subnet.
02:35 But as soon as you change the traffic
02:37 to go through the Gateway Load Balancer instead,
02:41 your Network Appliance might block your SSH traffic.
02:44 And that's where I won't be able to go
02:46 to the Application server directly.
02:48 Instead, I'm using Jump host to just bypass
02:50 this Network Appliance all together
02:53 and I'll directly from Jump host can go to the Application,
02:56 and then from Application, I test my connectivity,
02:59 Say from this Application,
03:00 being to say, google.com is my traffic going actually
03:05 through this Check Point Network Appliance.
03:07 I should be able to check that.
03:09 Similarly, on the right side, you have two private subnets,
03:13 one for Gateway Load Balancer
03:15 and another for Network Appliance.
03:18 Now here, you don't need internet to be honest,
03:20 but in order to configure the Check Point
03:22 and also check whether traffic is actually flowing
03:25 through this Check Point Network Appliance,
03:28 you need to SSH to this machine
03:30 and in order to SSH, I'm having this Jump host here.
03:33 So these are redundant, but then for this exercise
03:37 and to actually see the traffic is flowing,
03:40 we need these Jump hosts so that we can lock
03:42 into the Application instance,
03:43 as well as your Network Appliance instance.
03:46 And as usual there is internet gateway.
03:49 And as of now, I'm doing this exercise
03:51 in a single availability zone,
03:53 but for production, it is recommended
03:55 that you always use multiple availability zones
03:59 for your Gateway Load Balancers,
04:00 for your Network Appliances,
04:02 as well as for your Gateway Load Balancer endpoint.
04:05 So I hope that is clear.
04:07 Now for consistency, I'm using the subnets
04:10 with the CIDR 10.0.0.0/24 for Jump host here
04:14 and similarly, 192.168.0.0/24 for Jump host
04:18 in Network Appliance VPC as well.
04:20 For Gateway Load Balancer endpoint, I'm using 10.0.10.0,
04:24 and for the Gateway Load Balancer itself,
04:27 I'm using 192.168.10.0.
04:30 For Application, I'm using 10.0.20.0,
04:33 and for Checkpoint or Network Appliance,
04:35 I'm using 192.168.20.0, right?
04:38 This is a sub-net.
04:39 So I hope this architecture is clear,
04:41 and to be honest, based on just this architecture,
04:44 you should be able to set this up
04:46 and that's what we are going to do.
2. 先准备基础网络，再从 Marketplace 启动兼容 GENEVE 的 Appliance
时间范围：04:48–09:44
总结 / Summary
中文
起始状态已创建两个 VPC、各 Subnet、Internet Gateway、两台 Jump Host 与一台普通 Linux Application Instance；Route 暂不改，防止 Inspection Chain 尚未完整时切断管理流量。随后从 AWS Marketplace 启动支持 GWLB 的 Check Point AMI，放入 Network Appliance VPC 的私有 Appliance Subnet，不分配 Public IP。示例最小使用 c5.large 和 100 GB Storage。Security Group 允许来自管理网段的 SSH、Vendor 指定的 TCP 443 Health Check，以及来自 GWLB 路径的 GENEVE UDP 6081。端口和健康检查必须按具体 Vendor 文档调整。
English
The starting state already contains both VPCs, their subnets and Internet gateways, two jump hosts, and a plain Linux application instance. Routes are deliberately left unchanged until the inspection chain is complete so management access is not cut off. A GWLB-compatible Check Point AMI is then launched from AWS Marketplace into the private appliance subnet without a public IP. The example uses a c5.large and 100 GB of storage as its minimums. Its security group permits administrative SSH, the vendor's TCP 443 health check, and GENEVE UDP 6081 from the GWLB path. Ports and health checks must follow the selected vendor's documentation.
Transcript
04:48 Now to save some time, what I have already done is
04:50 that I already created these subnets.
04:52 I haven't created anything like
04:54 Gateway Load Balancer endpoint or this or this,
04:57 but I just set up the network.
04:59 That means I created these two VPCs.
05:01 I created three public subnets here,
05:03 two private subnets here, one public subnet here,
05:06 and then I launched these two Jump hosts
05:09 in respect to public subnet,
05:11 and one Application host.
05:13 I haven't installed anything on that Application host.
05:15 It is just plain Linux box there.
05:18 And what I have done is from this Jump host,
05:20 I have SSH to this Application instance.
05:22 So this is what my start state is,
05:25 and next I want to do other things.
05:28 For example, I want to launch this Network Appliance
05:31 using Check Point AMI from the Marketplace,
05:34 and then I should be able to create Gateway Load Balancer,
05:37 Gateway Load Balancer endpoint,
05:39 and then finally I will change my route tables.
05:43 Now why I'm changing route tables at the end,
05:44 because if I do that right away, then I won't be able to
05:48 probably reach to the respective host
05:50 because my Check Point might be blocking
05:52 all my traffic, right?
05:54 That's where I'm first setting up everything,
05:56 and then I will change the route table.
05:58 So let's go to the AWS Console
06:00 and see what I have already done,
06:02 and then let's follow the next step.
06:04 I have already given all these steps
06:05 in this lecture as well.
06:07 So if you want to just do it on yourself,
06:09 you can also follow those steps on your own.
06:13 So I'm going to my AWS Console now.
06:14 Here, you can see, I have two VPCs:
06:17 Application VPC and Network Appliance VPC,
06:19 and you can see the CIDRs here.
06:22 And if you go to the subnets,
06:24 I have multiple subnets here for Application VPC.
06:28 I have one public subnet for Application itself.
06:32 You can see these route table
06:34 and there is a route to the internet gateway.
06:36 That means it's a public subnet.
06:38 For Gateway Load Balancer endpoint also,
06:41 it's a public subnet
06:43 and for Jump hosts also, it's a public subnet.
06:45 So I haven't done anything.
06:47 This is a very standard VPC that you have been seeing so far
06:50 in the other lectures as well.
06:52 Similarly Network Appliance side, I have Appliance subnet,
06:55 which is again, private.
06:58 Gateway Load Balancer, which is also private,
07:00 and then for Jump host, I'm having this public subnet right?
07:04 So this is what I have already done.
07:06 And then I have already launched three (inaudible) instances
07:10 two Jump host into VPCs,
07:12 and one Application host in the Application VPC,
07:15 and then from my terminal,
07:17 I logged into Jump host using the public IP,
07:20 and from there I logged into the Application host
07:23 over an SSH, so that from Application host,
07:25 I can try to go out to the internet
07:27 and see if traffic is flowing
07:29 through the Check Point Network Appliance.
07:32 Now I don't have Check Point Network Appliance as of now.
07:35 So I'm going to the AWS Marketplace.
07:37 I already subscribed
07:38 to this particular Check Point Appliance,
07:41 and if you haven't, you can also subscribe to that,
07:44 and once you subscribe, you just go and say,
07:47 "Launch new instance."
07:50 Now you will go with whatever is default.
07:52 As the region, I'm using Mumbai.
07:54 So make sure you use proper region there as well.
07:58 It's ap-south-1,
08:02 and then it will ask you to launch the instance
08:05 with the regular steps, right?
08:06 So it will ask you to select the (inaudible) instance.
08:10 So it allows at bare minimum,
08:13 the c5 size of the instance.
08:15 So I'm using c5 large, which will be the smallest one.
08:19 Now on the instance details,
08:21 I'll be using my Network Appliance VPC,
08:23 and I want to have that in an Appliance subnet,
08:29 and I don't want public IP.
08:30 Rest of the things I want to keep as it is.
08:33 And here I will go with the default storage.
08:35 So this checkpoint instance required
08:38 a hundred GB of minimum storage.
08:40 Add Tags.
08:41 Let me add some tag.
08:44 Network Appliance.
08:46 And then Security Group.
08:48 Now you have to think what security group
08:50 you are going to put here.
08:51 I want to allow SSH from my Jump host,
08:54 so I will keep 192.168.0.0/16.
09:01 Similarly, I want to do the health check on Port 443,
09:06 because this checkpoint allows health check on 443,
09:10 so that my load balancer marks it as healthy,
09:12 and the most important is I want to have
09:14 the new protocol enabled, and for that,
09:18 I will have Custom UDP traffic on Port 6081.
09:24 And again, this will come from my load balancer
09:28 so I can put the CIDR range.
09:31 So that's what my security group looks like.
09:35 Let's review and let's launch.
09:38 Okay, so it will take some time for this instance
09:40 to be up and running.
09:41 So by that time, let's do some other stuff.
3. 创建 Private GWLB、GENEVE Target Group 与 Vendor-specific Health Check
时间范围：09:44–12:01
总结 / Summary
中文
在 Network Appliance VPC 中创建 Gateway Load Balancer，并选择专用 GWLB Subnet。为它建立 Target Group，Target Type 可按设计选择 Instance 或 IP；Lab 注册 Check Point Instance。GWLB Data Plane 的 Protocol 固定为 GENEVE，Port 为 6081；Health Check 则是独立配置，本例用 TCP 443，因为该 Appliance 在 443 上监听。创建完成后，GWLB 会把健康 Target 作为可分发目的地，和普通 Load Balancer 一样需要等待 Target 状态变为 Healthy。
English
A Gateway Load Balancer is created in the Network Appliance VPC and placed in its dedicated GWLB subnet. Its target group can use instances or IP addresses according to the design; the lab registers the Check Point instance. The GWLB data-plane protocol is fixed to GENEVE on port 6081, while the health check is configured separately. TCP 443 is used here because this appliance listens on that port. After creation, the GWLB distributes only to healthy registered targets, so the target should reach Healthy before traffic testing begins.
Transcript
09:44 Okay, so now we have this instance running here.
09:47 It will come up in some time.
09:49 Now let's create this Gateway Load Balancer
09:51 and attach this Check Point as in target,
09:55 and then we will create the Gateway Load Balancer endpoint.
09:57 But for that, we also need to create
09:59 Gateway Load Balancer Service first.
10:01 So let's first get Gateway Load Balancer itself.
10:03 Okay, for this, I'm going to ec2 Console.
10:06 I'm going to my load balancers.
10:09 And here in the load balancer,
10:11 I will just create a load balancer.
10:15 And this time Gateway Load Balancer,
10:19 You can give it a name, say, Gateway Load Balancer.
10:22 That's the simplest name I can think of.
10:25 And in the VPC, you want to have it
10:27 in a Network Appliance VPC
10:30 in ap-south-1a,
10:31 because that's the only subnet we have in this AC.
10:34 And you should select
10:35 the Gateway Load Balancer subnet accordingly.
10:39 And finally you have to send this traffic
10:42 to the target group,
10:43 but we don't have any target groups.
10:44 So let's just create a new target group.
10:47 Now, this is similar to any other load balancer,
10:50 with some differences, which I'll talk about.
10:52 Now, you can send the traffic to IP addresses or instances.
10:56 In this case, you want to send it to our appliance instance.
10:59 Target group name will be Gateway Load Balancer Target Group
11:03 and protocol is GENEVE that's what you can't change.
11:07 That's the only protocol is supported.
11:08 VPC is Network Appliance VPC.
11:11 Health check is TCP.
11:12 Now, in this case, the checkpoint appliance listens
11:17 on Port 443.
11:18 That's where I'm keeping it, 443.
11:20 Now, depending on your Network Appliance,
11:22 you should know where you can reach for the health check.
11:27 Rest I'm keeping as default.
11:29 Now it shows two instances.
11:32 I'm adding the checkpoint one, right?
11:35 And the rest of the things already there.
11:38 So let's include.
11:40 So this is pending and let's create the target group.
11:46 Okay, while target group is in creation,
11:49 let's go back to the load balancer.
11:50 Let's refresh this and see if target group appears there.
11:53 Yes, it is there,
11:55 and I think we are all set to create this load balancer.
12:00 Okay, load balancer is created, and it also gives you hint,
4. 先发布 Gateway Load Balancer Endpoint Service，再由 Consumer VPC 创建 GWLBE
时间范围：12:01–14:29
总结 / Summary
中文
GWLB 本身是 Private，Application VPC 不能直接把 Route 指向它。Provider 需在 VPC Console 创建 Gateway Load Balancer Endpoint Service 并绑定刚才的 GWLB，复制 Service Name；Lab 为简化关闭 Acceptance Required，但真实环境应结合 Acceptance 与 Allowed Principals 控制谁能建立 Endpoint。Consumer 侧选择“Other endpoint services”，用 Service Name 验证 Service，在 Application VPC 的专用 GWLBE Subnet 中创建 Gateway Load Balancer Endpoint。Endpoint 进入 Available 后，PrivateLink Data Path 才完整。
English
A GWLB is private, so the Application VPC cannot route directly to it. The provider creates a Gateway Load Balancer endpoint service in the VPC console, associates the GWLB, and copies the service name. The lab disables acceptance for convenience, while real environments should combine acceptance settings with allowed principals to control who may establish endpoints. The consumer selects other endpoint services, verifies the service name, and creates a Gateway Load Balancer endpoint in the Application VPC's dedicated GWLBE subnet. PrivateLink connectivity is ready once the endpoint becomes Available.
Transcript
12:03 what's the next step, right?
12:04 So you can't directly access the load balancer
12:07 from the previous VPC
12:08 because this load balancer is private.
12:10 Now, remember that Gateway Load Balancer are not public.
12:13 They are private.
12:14 That means you would have to create
12:16 the Gateway Load Balancer endpoint service first,
12:19 and then you have to create endpoint in your consumer VPC.
12:22 So let's do that now.
12:24 So this is load balancer for creating the endpoint service.
12:28 Of course, you need to go to the VPC console
12:31 and let's go to the endpoint services.
12:34 And here let's create endpoint service.
12:38 Now endpoint service name is,
12:40 let's call it Gateway Load Balancer Endpoint Service.
12:47 This is a gateway.
12:48 It will automatically populate your load balancer name
12:51 and acceptance, we don't need to be
12:54 because we are just doing the kind of test setup,
12:58 but in production, always tick this box.
13:00 What it means is that if you un-tick this box,
13:04 anybody can create an endpoint in their consumer VPC
13:07 and they can connect to your load balancer.
13:09 Now you don't want that by default, right?
13:11 So in production, make sure you tick this box.
13:14 Okay, that's it.
13:15 The service is being created.
13:18 Now out of this service, what we want is this service name,
13:22 because we want to create the particular endpoint
13:26 for this endpoint service.
13:28 Now, if you're not sure about what I'm talking about,
13:30 endpoint and endpoint services,
13:32 please go back and visit the private link session
13:35 in the earlier sections, okay?
13:38 So now we have this endpoint service
13:40 and what we want to do is to create endpoint
13:44 in a consumer VPC.
13:45 Now for me, the consumer VPC is this,
13:47 where I want to create this Gateway Load Balancer endpoint.
13:51 So let's do that.
13:52 So I'm going to the endpoint now and let's create endpoint.
13:58 Now this endpoint is not for AWS service,
14:01 but it is for our own service.
14:02 So let's find the service by name.
14:05 Let's give this service name that we just created.
14:09 It says that service name found.
14:11 I want to create this in a Application VPC
14:15 and in the subnet of Gateway Load Balancer endpoint.
14:19 That's it and just create the endpoint.
14:24 Okay, so this will again take a couple of minutes
14:27 for this endpoint to be enabled.
14:28 By that time, let's go back to our architecture
5. 先确认 Target Healthy，再在 Appliance 上监听 GENEVE UDP 6081
时间范围：14:29–17:51
总结 / Summary
中文
Target Group 显示 Check Point 为 Healthy，证明 GWLB 能通过配置的 TCP 443 Health Check 到达 Appliance。为观察真实 Data Plane，先从 Network Appliance VPC 的 Jump Host SSH 到 Appliance Private IP；Check Point 需要进入 expert mode 才能运行 Linux Command。用 netstat 验证 443 正在监听，再运行 tcpdump -nvv port 6081 观察 GENEVE。此时尚未修改 Application VPC Route，因此看不到 6081 流量是预期现象；保持 Packet Capture 运行，后续用它验证 Steering。
English
The target group shows Check Point as Healthy, proving that the GWLB can reach the appliance on the configured TCP 443 health check. To observe the real data plane, the operator SSHs from the Network Appliance VPC jump host to the appliance's private address and enters Check Point expert mode for Linux commands. Netstat confirms that 443 is listening, then tcpdump -nvv port 6081 watches GENEVE. No 6081 packets are expected before the Application VPC routes change, so the capture is left running for the steering test.
Transcript
14:31 and see what is there.
14:32 Okay, so we created everything possibly, right?
14:36 We created Gateway Load Balancer, service,
14:38 Gateway Load Balancer endpoint,
14:40 the checkpoint as well.
14:43 Let's see if Gateway Load Balancer shows this checkpoint
14:46 as a healthy instance or not.
14:49 And now let's go back to the target groups
14:51 and see if the instance is healthy.
14:53 Yes, it is.
14:54 That means Gateway Load Balancer is successfully able
14:57 to connect to the Network Appliance.
14:59 And please, pardon the background noise.
15:02 I couldn't find the quiet place this time
15:04 and sorry about that.
15:06 Okay, now we have done most of it,
15:09 and one thing that we want to do is to monitor the traffic
15:13 that flows through this Network Appliance.
15:15 And for that, if you look at this architecture,
15:18 I had this Jump host here
15:19 and I should be SSH into this checkpoint
15:22 so that I can do a TCP dump on Port 6081
15:27 to check if any traffic is flowing through it or not.
15:30 As of now, we haven't really configured our route tables,
15:33 so I don't expect traffic to be flowing,
15:35 but at least let's try to get to the checkpoint instance
15:38 and observe that traffic through TCP dump.
15:41 Now, I already have this Jump host and I locked in there.
15:45 And on this Jump host, I also configured the SSH key,
15:49 with which I created this checkpoint.
15:51 So I just copied the SSH key on this machine
15:53 and using that SSH key,
15:55 I will now SSH to this checkpoint instance.
15:58 So let's do that.
15:59 Okay, so this is my Jump host
16:01 and I already have the key here.
16:04 I created it just now,
16:06 and I want to do SSH using this key,
16:09 and the username for this checkpoint is admin,
16:13 and the IP address, you should get the private IP address
16:17 from AWS console.
16:18 So let's do that.
16:20 So I'm going to the instances again,
16:22 or I already have this instance here
16:25 and let's go to the details,
16:27 and this is my private IP.
16:30 I'm just putting private IP here and I'm connecting.
16:33 Now, Check Point has its own console,
16:35 and in order to run the Linux command,
16:38 you have to get into the expert mode.
16:40 Now this is very specific to the checkpoint
16:42 and the Network Appliances might have something different,
16:44 and I had already logged into this with expert mode.
16:48 The first time you change it to the expert mode,
16:51 it will ask you to set the password for expert.
16:53 And I already did that,
16:55 but otherwise you can just fire
16:57 the command set expert password,
16:58 and it will ask you the password two times.
17:01 So let me change the mode to the expert
17:03 and now I get the shell here.
17:06 Now let's see if the Port 443 is running
17:09 so that the health check is successful.
17:11 We know that already,
17:12 and you can see the checkpoint 443 port is running
17:14 and that's where the health check was successful.
17:17 And now let's observe the Port 6081 with the TCP dump.
17:22 So the command will be TCP dump minus nvv
17:26 and then port number 6081 for the GENEVE protocol.
17:31 And it has started, you know,
17:34 dumping the traffic for this port.
17:37 As of now there is no traffic flowing through 6081,
17:39 and that's where it makes sense
17:40 that there is no traffic here.
17:41 So leave this console open
17:43 and see when we do the routing configuration,
17:45 does the traffic flow through this or not?
17:48 Okay, that's what our objective is.
6. IGW Edge Association 把 Application Subnet Ingress 指向 GWLBE
时间范围：17:51–20:04
总结 / Summary
中文
Jump Host 与 Network Appliance VPC 侧的 Route 保持不变；关键改动集中在 Application VPC。首先创建 Application Ingress Routing Table，保留 VPC Local Route，并添加 Destination 10.0.20.0/24 → Target GWLBE。仅创建表还不够，必须通过 Edge Association 把它关联到 Internet Gateway，而不是做普通 Subnet Association。这样外部访问 Application Public IP 时，IGW 对 Private Destination 完成映射后先把 Packet 交给 Endpoint，而不是直接进入 Application Subnet。
English
Jump-host routes and the Network Appliance VPC routes remain unchanged; the important changes are on the Application VPC side. An application ingress route table retains the VPC local route and adds destination 10.0.20.0/24 with the GWLBE as target. Creating the table is insufficient: it must be edge-associated with the Internet gateway rather than associated with a subnet. When external traffic addresses the application's public IP, the IGW maps it to the private destination and sends the packet to the endpoint before it can enter the application subnet directly.
Transcript
17:51 Okay, now comes the most important part
17:53 of setting up the right routes for this architecture, right?
17:57 We already have all this set up that you look at,
18:00 but now let's try to update the route tables.
18:03 Now in case of route table,
18:05 you know that this is a public subnet for Jump host.
18:07 We don't need to change anything
18:09 because we are not going to send the Jump host traffic
18:12 through this Gateway Load Balancer or through a checkpoint.
18:14 So no need to change that,
18:16 and similarly, on the right side, also,
18:18 we are not going to touch these two subnets, right?
18:21 Also, if you talk about the private subnets,
18:23 we are not going to touch here.
18:25 There is no need to change here,
18:27 as well as for the checkpoint also.
18:29 We don't need to change anything.
18:31 So that means all this two tables are typically
18:34 on the Application VPC site.
18:36 Very first thing we need to have Ingress route table
18:39 for your internet gateway,
18:40 as of now, internet gateway is not attached
18:42 to any route table.
18:43 And that's where let's first create the Ingress route table
18:48 for your internet gateway and understand this right,
18:51 you have to have the entry for this subnet as a destination,
18:56 and the target should be VPC endpoint.
18:59 That is this right. So let's do that.
19:05 So I'm into my VPC console
19:07 and let me go to the route tables.
19:13 Let me create a new route table
19:13 and let me call it Application Ingress Routing
19:20 and VPC would be Application, that's it.
19:24 And as in route, I want to add a new route,
19:27 and I'll say if the traffic is for the 10.0.20.0/24
19:36 which is my Application subnet,
19:38 it should go through the Gateway Load Balancer endpoint,
19:42 and it automatically gets populated here.
19:45 Just creating route table doesn't help.
19:48 You have to also associate that with the internet gateway.
19:51 Now, in this case, it's not subnet association,
19:54 but it's age association.
19:55 So let's go to the age association, edit that,
19:58 and just click this internet gateway and save the changes.
20:02 Okay, so our Ingress routing has been set up.
7. Endpoint Subnet 仍指向 IGW，Application Default Route 改为 GWLBE
时间范围：20:04–21:39
总结 / Summary
中文
GWLBE Subnet 在 Lab 中原本就是 Public Subnet，因此它的 0.0.0.0/0 → IGW 已存在；该 Route 负责把从 GWLB 检查后返回 Endpoint 的 Internet-bound Traffic 送出去。最后把 Application Subnet 原来的 0.0.0.0/0 → IGW 改为 0.0.0.0/0 → GWLBE，使 Application 发起的 Outbound 与 Inbound Return 都再次经过 Appliance。此步骤放到最后执行，可以降低尚未完成 Endpoint、Target 或 Policy 时造成自我锁定的风险。
English
The GWLBE subnet was created as a public subnet in this lab, so its 0.0.0.0/0 route to the IGW already exists. That route carries Internet-bound traffic returned to the endpoint after GWLB inspection. The application's original 0.0.0.0/0 to the IGW is then replaced by 0.0.0.0/0 to the GWLBE, forcing application-originated outbound traffic and inbound return traffic back through the appliance. Performing this step last reduces the risk of locking out access while the endpoint, targets, or policies are incomplete.
Transcript
20:06 Let's go back to the architecture
20:08 and next we want to update the route table
20:11 for Gateway Load Balancer endpoint.
20:13 And here we have to make change that
20:15 if the traffic is going to the internet,
20:17 it has to go through the internet gateway.
20:20 But I think this is already there
20:21 because we had anyways created this subnet
20:23 as a public subnet,
20:24 but let's just verify that.
20:28 So I'm into the subnet.
20:30 Let me go to the Gateway Load Balancer endpoint subnet,
20:33 and let me check the route table,
20:35 and there is already this route table
20:37 through internet gateway.
20:38 Understand that this is used for the return traffic, right?
20:41 I had explained that earlier.
20:44 Okay, now let's go back to the architecture again.
20:48 And this time we have one more route table,
20:49 which is for the Application,
20:50 and this is the most important one.
20:52 Here, all the traffic should be routed through VPC endpoint,
20:56 which is an outbound traffic for this application.
21:00 So let's do that as well.
21:06 So this is my Appliance, not this one.
21:09 So this is my Application subnet
21:11 and I have got a bonding entry for internet gateway,
21:15 but I will change that.
21:17 For that, I will go to this route table
21:18 of my application subnet and if you look at the routes,
21:24 it has a route for internet gateway, but let's modify that.
21:28 And instead of internet gateway,
21:29 it should be the Gateway Load Balancer endpoint.
21:33 Just select that and save the changes.
21:36 That's it.
21:37 I think we are good with the route tables
8. 从 Application 发包并在 tcpdump 中验证原始 IP 与 GENEVE 6081
时间范围：21:39–23:45
总结 / Summary
中文
通过 Application VPC 的 Jump Host 进入 Application Instance，从 10.0.20.113 发起到 amazon.com 的 Ping。Echo Reply 没有回来，因为 Check Point 默认 Policy 仍在丢弃该 Traffic；但 Appliance 上的 tcpdump 已出现 UDP 6081 GENEVE Packet，并能看到 Inner Packet 的原始 Application Source IP 10.0.20.113。这证明 Route、GWLBE、PrivateLink、GWLB 与 Appliance Target 的转发链已经生效。要实现完整 Internet Connectivity，还需在 Check Point/CloudGuard 中显式允许该流量；Vendor Policy Configuration 不属于本讲范围。
English
The operator reaches the application instance through its jump host and sends a ping to amazon.com from 10.0.20.113. No echo reply returns because the Check Point default policy still drops the traffic, but the appliance's tcpdump now shows UDP 6081 GENEVE packets and the inner packet's original application source address, 10.0.20.113. This proves that the routes, GWLBE, PrivateLink, GWLB, and appliance target forwarding chain are working. Full Internet connectivity additionally requires an explicit allow policy in Check Point or CloudGuard, which is outside this lecture's scope.
Transcript
21:40 and now let's do the final test.
21:42 Let me get into the Application instance.
21:46 For this, I have already SSH to this Jump host
21:49 and from the Jump host, I got the SSH key
21:51 of this application machine here
21:53 and using that SSH key, I already SSH'd
21:56 into this application instance.
21:59 Okay, I'm into the application host,
22:01 and now from here, let me try to ping to amazon.com,
22:05 and I just threw that.
22:06 Now traffic is not getting back to me
22:09 because maybe firewall is blocking that,
22:11 but let's see if checkpoint
22:13 is intercepting this traffic or not.
22:16 So I can see here that the traffic already started
22:19 showing up here,
22:20 and you can also verify the source IP,
22:23 which is 10.0.20.113,
22:26 which was my application IP.
22:29 And we can very well verify that from AWS console as well.
22:34 So I'm into the AWS console and this is my application,
22:38 ec2 machine, and this is the IP address,
22:41 and that's where you can see now the traffic is going
22:43 from my ec2 instance to the checkpoint,
22:46 but it is not going out because checkpoint is dropping that.
22:49 Now you have to do that configurations on the checkpoint
22:51 on a cloud guard, ec2 machine that all the traffic
22:55 for the pin should be allowed,
22:57 but that is out of scope of this particular exercise,
23:00 and if you know how to configure checkpoint,
23:03 then go ahead and do those configuration by yourself.
23:08 So that's it about this lab.
23:09 In this lab, we could successfully set up
23:12 the Gateway Load Balancer,
23:13 and we then saw how the traffic flows through.
23:16 Now, if you're to implement this on your own,
23:18 I have also given these steps at very high level,
23:22 and I'm sure you will be able to set this up by yourself.
23:25 So these steps are already documented here
23:28 with this presentation, right?
23:30 So I hope things are clear to you now,
23:33 and with that, we will move towards now
23:35 few additional details about the Gateway Load Balancer
23:39 that you should know for your exam,
23:40 and we will now cover that.
23:42 So thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
这次 Lab 完整搭建了 GWLB Appliance Insertion：准备独立 Application/Network Appliance VPC 与管理 Jump Host，从 Marketplace 启动 Check Point，开放 Vendor Health Check 与 GENEVE UDP 6081，创建 GWLB/Target Group、Endpoint Service 与 Consumer GWLBE，再按顺序配置 IGW Edge Route、GWLBE Subnet Route 和 Application Default Route。最终 tcpdump 看到了携带原始 10.0.20.113 Source IP 的 GENEVE Packet，证明 Traffic 已被透明送入 Appliance；Policy 是否放行仍由第三方 Appliance 决定。
English
This lab builds a complete GWLB appliance-insertion path: separate application and appliance VPCs with management jump hosts, a Marketplace Check Point appliance, vendor health-check access and GENEVE UDP 6081, a GWLB and target group, an endpoint service, and a consumer GWLBE. It then applies the IGW edge route, GWLBE-subnet route, and application default route in a safe order. A final tcpdump sees a GENEVE packet containing the original 10.0.20.113 source address, proving transparent delivery to the appliance; the third-party appliance policy still determines whether the traffic is allowed.
返回顶部 ↑