Herion and welcome back.
Now, in today's video, we'll be discussing about the gateway between points.
Now, before we go and discuss about the present point in great detail, let's quickly understand the
primary types of PCN points that are available.
So the first one is the gateway in point, and then you have the interface point and then you also have
the gateway load balancer endpoint and each one of them has a specific use case.
Now, the primary aim of today's video is to go ahead and understand the gateway between points now
in the Gateway Ripkin point based architecture, that traffic is routed from a specific instance to
a supporter destination service with the help of the appropriate role.
So the subnet in which this instance lays it needs to have a round table where there is a destination
and the target is the VPC endpoint.
Now, one of the questions that comes is what exactly this destination in place?
So at a high level or will this destination is associated with this idea range and this idea range that
you see over here?
It is associated with their destination.
So let's assume that you have a destination address of Amazon S3.
Then this idea range will be associated with that.
And whenever easy to instant since the traffic to this specific Syeda range, which is associated with
S3, then the traffic is automatically routing to VPC point.
And this is the basic architecture based on which the Gateway VPC endpoint works now do not target working,
but only supports limited services.
So you have Amazon S3 that is supported and you have a to be to support.
So with this basic SEC, let's go ahead and implement Gateway seeing points from scratch.
So for days we will go ahead and select one of the regions where the default will be expressing and
will go ahead and create gateway between points.
So within the search, let's go ahead and type VPC.
I think so we have a default VPC that is available.
The carrier is 170 172 31 zero zero 16 and it will have multiple subnets associated with it.
So now what will go ahead and do is will go ahead and assign one of the subnet as a VPC endpoint subnet,
or you can just see it as a private subnet without an aggregator.
So let us call it as VPC endpoint subnet so that it is easily identifiable already.
And for this specific subnet will also go ahead and create a new round table.
So you have a default.
Let's create one model table, just call it as VPC and point at our table and will associated with the
default VPC.
Let's create a round table.
All right.
Now at this stage you will see that you only have one road that is available.
The target is local and the destination is 172 31 zero zero 16.
So this specific round table will not allow communication to Internet, but in words as well as outward.
So now what we do is we associate this round table with the subnet so will be associated with the VPC
subnet.
That's great.
So for our first part of today's architecture, what we have, we have a website where there are certain
subnets, these very public subnet among which we selected one subnet to make it as a private subnet,
and we associated a new route so that the resources within the primate's does not have any inbound or
outbound Internet connectivity.
So now the next step is will go ahead and launch.
Do you see two instances, one in the public subnet and second one within our private subnet that we
have created?
So let's go ahead and go to the easy to instant service now within the easy to instance console.
First thing let's go ahead and do for today's video is we'll go ahead and create a keep it.
So this is a temporary cable that will be creating.
So let's call it as it and we'll create the file format of Ben-Meir.
So this Scheepers should be downloaded once, then let's go ahead and launch AC2 instances in this specific
region.
We'll use the Amazon next to e-mail the instance.
They just select the one associated with the fruitier eligible the subnet.
Make sure that you first select the endpoint subnet and we do not really need the IP, so we'll go ahead
and disabled auto ZENAB ones.
Then let's do a review and launch and will launch this with that key period.
Correct.
So let's go ahead and open this up.
And Liz, this Qualitest privately setup in a similar way.
Do note that since this is it does not have any communication, would embolden Albon towards the Internet,
will not be able to connect to it directly.
So what we need for it to be connected is one more easy to instance in a public subnet.
So we first connect to this instance in public something and from this easy to instance, will go and
witness it to the private security side.
Alright, so this is more if you have worked with the Bastin host with architecture, it's similar to
that.
So let's go ahead and launch one more instance in a public subnet this time.
Make sure you select one of the subjects here, let's use Sabaneta, it will do a review and launch
will do a launch with that, keep it perfect.
So let's go ahead and call this as public.
Easy to.
That's great.
One more thing that we have to do is we have to associate and role primarily because in today's practical,
we want to ensure that the easy to stands through the VPC and one is able to connect to the history
books and so forth.
This will be making use of Amarone.
So let's go to the IBM service here, will go to.
Let's create a new rule.
The rule use case would be easy to and within the permission.
Let's just give it as a three full access just for our testing purposes and let's call it as VPC and
point to collect.
That's great.
So now we'll go ahead and attach the rule to both of the easy to instantiate.
So let's quickly do that.
Unless security, I'll modify the rule and we have the back end point to let associate with the first
instance and in a similar way.
Let's also go ahead and do it for the second instance.
So I'll select the point.
Control will do the same.
Perfect.
So now we have our basic architecture set.
First, let's go ahead and connect to the easy two instance.
We are the public IP now from the system, which is a system you are using.
You can just specify that Gaede or PIN and let's go then and connect to the easy to your outlet.
So we are connected to the ITU.
So this is the public.
Easy to instantiate.
So from Ulufa'alu quickly, the idea is three ellis'.
You see, we're able to see a set of EU buckets that are part of this specific Idalis account.
Now what we'll do is since we want to connect from the public to instance to the private sector, we
need to have a keypad associated with the private.
Now, since the keypad is in my local workstation, there are multiple approaches to take care of that.
But we'll be using the simple one.
I basically copy the private Kuria.
Let me copy the private key and let's go ahead and create a new Giurgola stinky dot pimp will face the
private contents.
Let's save this and let's also change the permission to four zero zero.
All right.
So now using this specific private key from the public AC2, let's go ahead and connect to the private.
Easy to instance, we are the private IP alé.
Let's do that and do a yes and perfect.
We are connected.
So since this is it already has Amarula warrior, if you go ahead and do idolises trials and let's also
specify region lets us this to at this stage you will not see any result, primarily because there is
no connectivity towards the S3 that is available.
Perfect.
So our next step is to go ahead and create a Gateway VPC endpoint.
So let's go back to the VCR and let's go back down under the end points here.
Let's create a new endpoint.
And if you look here, there are multiple endpoints.
Type one is the interface endpoint and if you'll go down a bit down, you'll also see a gateway endpoint
here.
So let's go ahead and filter by service now for the S3 service.
You have both the interface as well as Gateway End Point.
We are more interested in Gateway Endpoint for the time interval.
Select that.
And now the next part is to recruitable this endpoint should be associated with.
So this specific destination and target associated with the VPC endpoint needs to be associated with
which of the roundtable.
So we want it to be associated with that VPC end point round table all at once.
Then let's go ahead and build down the policy.
We'll just leave it as it is for the time being.
Let's go ahead and create end point.
Perfect.
So let's do a close.
And now you should see you have a vision point that is created and will go to the round table.
Let's open up the table here.
Let's go to the road and you should see you have one more road that is created.
And this has a specific destination.
And the target is VPC.
As we were discussing this specific destination, in turn, it's like a logical destination, which
has this idea range associated with the S3 service or any traffic going to the S3 service will be targeted
towards the end point.
So that is the basic idea here.
So now once this specific breaking point is associated, let's go ahead and do it as three ls once more
and you see it is working perfectly well.
So from our private easy to, we are able to communicate with the S3 service.
Great.
So I hope with this you understood the basics of how the Gateway VPC endpoint as well as the routing
related to Xbox.
Now let's go ahead and look into some of the downsides of Gateway Ripkin Point.
First among them is the overall architecture.
So in this type of architecture, the actual VBC endpoint is not part of the BBC.
It is outside of the.
So with the help of the roundtable, the traffic is directed towards the in point.
Now, since this visiting point is not part of your VPC, it is not possible to use it directly from
the VPN or direct.
So this is one important thing that you should know.
Second important thing is that the end points are supported within the same region.
Only you cannot create an end point between a BBC and the service in a different region.
This is very important to remember.
Now, if you'll just do it as tearless from the private sector, you see we are not getting any results
here and this is the reason why we had explicitly specified originally.
So this is the region where Ekta is created.
And if a presenter, you're able to see the buckets.
You know, one more important part to remember is that you'll only be able to do operations on the bucket.
That is part of the same reasons, although it is listing you all the buckets right now.
But the operation will only work on the bucket that is part of the US based Pareja.
So, for example, let's say I do a dabblers as trialist.
Let's specify a bucket list escalator's any bucket.
So I just selected a number that is available.
Lets presenter as expected, you are not able to see anything.
So in case if you live in a specific region of uSwitch, do something similar to what we had done earlier.
You said you are not able to see anything yet, even though the easy instance has a full S3 permission
available.
Now, in order to also demonstrate this point in great detail, let me go ahead and create a bucket
so we'll be creating a new S3 bucket in the same region where this end point is created.
So let's create a new bucket list as Qualitest and point us where you can just give any region, make
sure that the region is same as the region where the endpoint and the easy to is present will go ahead
and leave everything as default will go ahead and create a bucket.
So now let's go ahead and do it.
Let's try again.
As expected, we are seeing this specific bucket.
Let's copy this and let's do it is three Ellis.
Let's specify the bucket name and also let's specify the region of the US to do.
And you see it is working perfectly well now since this bucket does not have any content, it basically
did not show you anything.
But in case there is an image or whatever content, it should show you the data.
No, in fact, let me also show you this.
So there is no doubt that arises in this specific video.
So let me go ahead and add a random file I learned.
So I'll just simply add a B and file.
So this is a BCP file.
Now let's run the same campaign again.
And you see we are able to see the contents as expected.
Great.
So I hope this first point makes sense now.
Second is that the endpoint supports IPV for traffic only and the third one is that you must turn on
the DNS resolution in your VBAC or if you are using your own DNS to ensure that the DNS request to the
required services such as three are reserved correctly.
Today, Beatriz's maintained by W.S. not.
This is important primarily because the destination in Erodible is associated with a specific Seada.
So if your DNS server is not giving you the resolution, so when you try to connect to the S3 endpoint
and it is giving a different IP address than the one that is part of this specific destination, then
the order routing will not work.
And this is the reason why it is important to ensure that either your user DNS resolution that is part
of the VPC or for your own Denisova, you have to ensure that the request is resolved correctly to the
IP address that is maintained by W.S..
That's great.
So I hope with this you understood about the Gateway VPC endpoint in great detail.