Try   HackMD

Configuring Transit Gateways

tags: AWS

完成本次的LAB您將有以下配置

● Configure a transit gateway
● Attach VPCs to a transit gateway
● Control and customize routing with AWS Transit Gateway
● Peer transit gateways between two Regions
● Use Network Manager to visualize and analyze your network

LAB環境如下

作為LAB的一部分，四個 EC2 實例在primary region各自的 VPC 上預置。 在remote region提供一個 EC2 實例和一個Transit gateway。 您在primary region中配置一個Transit gateway，將 VPC attach到Transit gateway，更新路由，並驗證primary region內的所有 EC2 實例是否可以互相Ping通。 然後，您將Transit gateway與remote region對等，並驗證所有 EC2 實例之間的網絡連接。 最後，您創建route filters以僅限制某些 VPC 之間的連接。

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

開始前的基礎環境設置
1.VPC

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

2.Subnets

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

3.Route tables(其他的private只有自己的網段)

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

4.Internet gateways

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

5.EC2 X 5

Primary region

  • Region : us-west
  • AZ : us-west-2a
  • VPC :
    1. a-public X 1
    2. b-private X 1
    3. C-private X 1
    4. d-private X 1
  • AMI : amzn2-ami-hvm-2.0.20221103.3-x86_64-gp2
  • Tpye : t3.small
  • EBS Volume size : 8 GiB
  • Security groups : allow 22Port、ICMP Protocol
    Image Not Showing Possible Reasons
    • The image file may be corrupted
    • The server hosting the image is unavailable
    • The image path is incorrect
    • The image format is not supported
    Learn More →

Remote region

  • Region : us-east
  • AZ : us-east-1a
  • VPC : e-private X 1
  • AMI : amzn2-ami-hvm-2.0.20221103.3-x86_64-gp2
  • Tpye : t3.small
  • EBS Volume size : 8 GiB
  • Security groups : allow 22Port、ICMP Protocol
    Image Not Showing Possible Reasons
    • The image file may be corrupted
    • The server hosting the image is unavailable
    • The image path is incorrect
    • The image format is not supported
    Learn More →

步驟 1：Review the Network Topology and Create the Baseline

在此步驟中，使用 Internet 的 (ICMP) 協議驗證command host與其他Host之間的網絡是否互通。 在同一個主要區域中有四個 Amazon EC2 實例，標記為Host A 到 D，每個VM都有自己的 VPC。 Host A 位於public subnet中，將用作command host。 下圖顯示了LAB環境中的當前基礎配置

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

※每台VM都在獨立的VPC環境中，先連線登入Command host並Ping其他Host VM

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

由於每個VM都在自己的private Subnets中，每個VM之間沒有配置路由，ICMP Ping 每個VM都會出現Time out。

步驟 2 : Create a Transit Gateway

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

配置以下內容

  • Name tag: maintransitgw
  • Amazon side ASN: 65001
  • Uncheck VPN ECMP support
  • Uncheck Default route table association
  • Uncheck Default route table propagation
  • Create a Transit Gateway

建立完成(並使用文字編輯器紀錄Transit Gateway ID) EX:tgw-0534607a68f959f70

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

步驟 3 : 將VPCs attach到Transit Gateway

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

在VPC左側列表Transit Gateway中選擇Transit gateway attachments

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

配置以下內容

  • Name tag: vpc-a
  • Transit Gateway ID: Select the transit gateway ID
  • Attachment type: VPC
  • VPC ID: Select the VPC with the name vpc-a
  • Choose the Create transit gateway attachment button.

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

對其他VPC重複相同的步驟，並等待狀態為Available

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

步驟 4 : Create the Transit Gateway Route Table

在VPC左側列表Transit Gateway中選擇Transit Gateway Route Table

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

配置以下內容

  • Name tag: maintransitgw-rt
  • Transit Gateway ID: Select the transit gateway ID

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

步驟 4-1 : Create Route Table Associations

※ 1個Transit Gateway只能和一個Route Table進行關聯，Route table可以和多個資源進行關聯

先選取maintransitgw-rt並選擇Actions

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

VPC-a~d 皆重複以下操作

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Associations完成後顯示如下

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

步驟 4-2 : Create Route Propagations

使用Route Propagations將路由從路由表添加到附件。 添加傳播使路由能夠從附件傳播到目標transit gateway route table。

一個附件可以propagated to multiple route tables。

先選取maintransitgw-rt並選擇Actions

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

VPC-a~d 皆重複以下操作

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Propagations完成後顯示如下

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

步驟 5 : Update the VPC Route Tables

※替所有VPC中的Subents添加一條目的為Transit gateway的路由

在VPC左側列表Virtual Private Cloud中選擇Route Table

配置以下內容

  • Destination: 10.0.0.0/8
  • Target: Copy and paste the transit gateway ID (參考步驟2複製的ID)

VPC-a~d 皆重複以下操作

連線到Command host並Ping其他Host VM，此時會發現只有Host E ping不通(編寫Lab過程有重新建立環境，Host IP 異動不影響Lab過程，VPC配置皆一樣)

因為Host E建立在remote region，因此會不通

步驟 6 : Create a Peering Connection to the Remote Region Transit Gateway

※選取VPC服務後，將Region切換至us-east-1(remote region)

先重複步驟2-4建立一個us-east-1(remote region)的Transit gateways
配置更動的內容為下列

  • Name tag: remote-tgw
  • Amazon side ASN: 65002

建立完成後一樣先使用文字編輯器紀錄Transit Gateway ID(EX:tgw-0fbb0e3f7515eb79c)

步驟 6-1 : Create the Transit Gateway Peering Connection

Create the Transit Gateway Peering Connection
切換回us-west-2(primary region)配置以下內容

  • Name tag - optional: remote-vpc-e
  • Transit Gateway ID: Select the transit gateway
  • Attachment type: Peering Connection
  • Account: My account
  • Region: Select the remote region name
  • Transit gateway (accepter): Copy and paste the transit gateway ID for the remote region that you recorded in the previous section
  • Choose the Create transit gateway attachment button

這時候會顯示 Pending Acceptance

※這時候先切換至us-east-1(remote region)

在Transit Gateway Attachments的地方可以看到有一個Pending acceptance，點選Accept transit gateway attachment進行接受

這時候可以看到跨Region的Transit Gateway Peering Connection 已經Available

步驟 6-2 : Update the Route Table Association - Remote Region

在us-east-1(remote region)的Transit gateway route tables 選擇 Associations

選擇Transit gateway 的 route tables 中的 CIDR 0.0.0.0/0 Replace static route

選擇沒有名稱Tag的TGW

步驟 6-3 : Update the VPC Route Table - Remote Region

選擇vpc_e-private並配置以下內容

  • Destination: 0.0.0.0/0
  • Target: Copy and paste the transit gateway ID of the remote region
  • Choose the Save changes button

配置完成如下

連線到Command host並Ping其他Host VM進行測試

步驟 6-4 : 這時候會發現Host E 仍然 Ping不通，需要先切換為us-west-2(PrimaryRegion)，並更新Transit gateway route tables

重新association並選擇remote-vpc-e

替Transit gateway route tables Create static route
配置以下內容

  • CIDR: 10.0.0.0/16
  • Choose attachment: Select attachment ID with the name tag remote-vpc-e
  • Choose the Create static route button

再次使用Command host對Host E進行Ping測試

透過測試確認可以成功透過Command host去Ping到各個獨立VPC中的Host VM

步驟 7 : Create Route Filters

※我們將blackhole routes在VPC-B、D，需先切換到us-west-2(PrimaryRegion)

替Transit gateway route tables Create static route
配置以下內容

  • CIDR: 10.2.2.0/24
  • Select Blackhole
  • Choose the Create static route button

對CIDR 10.4.4.0/24 重複上圖相同步驟，結果如下圖

連線到Command host並Ping其他Host VM進行測試

由測試結果可以發現VPC-B、D成功被Route Filters block

步驟 8 : Visualize and Analyze Your Network (Optional)

在VPC左側列表最下方選擇Network Manager

在Global networks點選Cerate Global networks

配置以下內容

  • Name: TGW-Network
  • Description: Transit Gateway Network
  • Choose Next
  • Deselect Add core network in your global network
  • Choose Next
  • Choose the Create global network button

等待狀態為Available後，點選該資源名稱後，在左側列表選取Transit gateways

點選Register Transit Gateway，兩個Transit Gateway都選取並Register

註冊完成並等待狀態為Available

步驟 8-1 : Visualize the Network

※先選取左側列表中的Transit gateway network，分別查看Geography, Topology tree, and Monitoring

Geography顯示如下圖

Topology tree顯示如下圖

Monitoring顯示如下圖

步驟 8-2 : Analyze Route

選擇Route Analyzer

配置以下內容-Source

  • Transit Gateway: maintransitgw
  • Transit Gateway attachment: vpc-a
  • IP address: Copy and paste the CommandHostPrivateIP IP address
  • Select Include return path in results

配置以下內容-Destination

  • Transit Gateway: remote-tgw
  • Transit Gateway attachment: vpc-e
  • IP address: Copy and paste the HostE IP address

分析結果如下圖

Last changed by 
 
alvin yang
0
1
433

Read more

AWS EC2更換SSH KEY

原先就已開啟SSH帳號密碼登入的user

Jun 26, 2023
Azure 與 AWS 之間建立VPN連線

關於高可用性，請注意在 AWS 上，默認情況下 VPN 連接始終有 2 個Public IP，每個Tunnel一個。在 Azure 上，默認情況下不會發生這種情況，在這種情況下，您將使用 Azure 端的Active/Passivity。 這意味著我們將只設置一個來自 Azure VPN Gateway的“node”來與 AWS 建立兩個 VPN 連接。如果出現故障，Azure VPN Gateway的第二個node將以Active/Passivity模式連接到 AWS。 Azure環境建置 1.建立資源群組 2.建立Virtual Network Lab環境的CIDR為:10.0.0.0/16，subnet設置為:10.0.1.0/24

Mar 28, 2023
如何啟用Azure帳號的MFA

最近各大公有雲帳號被盜慘遭建立大量機器的事件層出不窮，防範這種情況發生不外乎就是設定多因素驗證(MFA)來確保帳號登入的安全，以下將說明管理者如何替使用者設定MFA，以及使用者該如何設定自身的MFA。 :::info <span class="red">以下的操作說明需要您對Azure有初步的了解具備基本使用的基礎經驗，並且使用者已建立完成的情況</span> ::: 1.使用Azure AD的admin登入查看Azure AD底下的使用者 2.重製密碼的設定是授予Azure AD的所有用戶，開啟該設定後必須設置完成MFA才能自行重製密碼

Mar 28, 2023
**透過GCP的TCP Load Balancing訪問後端不同端口Services**

GCP上的Load Balancing 在任何的架構中最常見的是最外層放一個Load Balancing，常見GCP的Load Balancing有以下幾種 :::info ●HTTP(S)Load Balancing ●TCP load Balancing ●UDP load Balancing ::: 我們的架構會是透過TCP load Balancing當外層，透過用戶訪問到後端不同端口的Services!!! <span class="red">架構示意圖如下</span>

Mar 28, 2023
Read more from alvin yang
Published on HackMD