sitetositevpn
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseAWS Site-to-Site VPN
AWS Site-to-Site VPN
Overview
概述
Domain expertise for configuring AWS Site-to-Site VPN, the managed service that builds an encrypted
IP Security (IPsec) connection between an on-premises network and AWS. Covers the routing decision
(static versus dynamic (BGP) routing), creating the connection and its dependent resources in the right order,
sizing tunnel bandwidth, consolidating many sites through a VPN Concentrator, applying the customer
gateway device configuration, building for high availability, and monitoring and troubleshooting
tunnels.
This skill is a router. Each customer task maps to a procedure file under . Read the
matching reference in full before acting, then follow its constraints and steps. The reference
files are self-contained: each carries its own decision tables, constraints, procedure, and
troubleshooting.
references/Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging,
observability). Fall back to the AWS CLI otherwise. Site-to-Site VPN is a regional service: pass
matching the VPC or transit gateway the connection terminates on.
--region {region}本技能涵盖AWS Site-to-Site VPN的配置领域知识，该托管服务可在本地网络与AWS之间建立加密的IP Security（IPsec）连接。内容包括路由决策（静态路由与动态（BGP）路由对比）、按正确顺序创建连接及其依赖资源、调整隧道带宽规格、通过VPN Concentrator整合多个站点、应用客户网关设备配置、构建高可用架构，以及隧道的监控与故障排查。
本技能为导向型工具，每个客户任务对应下的一个流程文件。执行操作前请完整阅读匹配的参考文档，然后遵循其约束条件和步骤。参考文件为独立完整内容：每个文件都包含自身的决策表、约束条件、操作流程和故障排查指南。
references/连接后使用AWS MCP服务器执行命令（沙箱执行、审计日志、可观测性），否则使用AWS CLI作为备选。Site-to-Site VPN是区域性服务：请传入与连接终止的VPC或中转网关匹配的参数。
--region {region}Which Site-to-Site VPN task do you need?
您需要执行哪项Site-to-Site VPN任务？
| Goal | Reference |
|---|---|
| Decide between static and dynamic (BGP) routing before creating a connection | choosing static or dynamic routing |
| Create an encrypted VPN connection from on-premises to a VPC | creating a site-to-site vpn connection |
| Size tunnel bandwidth at Standard (1.25 Gbps) or Large (5 Gbps) | choosing tunnel bandwidth |
| Connect 25 or more low-bandwidth sites through one shared attachment | connecting many sites with a vpn concentrator |
| Configure the on-premises customer gateway device | applying the customer gateway device configuration |
| Make the connection survive tunnel maintenance and device failure | making a connection highly available |
| Detect a down tunnel and find out why | monitoring and troubleshooting tunnels |
| 目标 | 参考文档 |
|---|---|
| 创建连接前确定使用静态还是动态（BGP）路由 | 选择静态或动态路由 |
| 创建从本地到VPC的加密VPN连接 | 创建Site-to-Site VPN连接 |
| 将隧道带宽设置为标准型（1.25 Gbps）或大型（5 Gbps） | 选择隧道带宽规格 |
| 通过一个共享连接接入25个及以上低带宽站点 | 使用VPN Concentrator连接多个站点 |
| 配置本地客户网关设备 | 应用客户网关设备配置 |
| 确保连接可应对隧道维护和设备故障 | 实现连接高可用性 |
| 检测故障隧道并排查原因 | 监控与故障排查隧道 |
Routing notes
路由说明
- Decide routing before you build. The static-versus-dynamic decision shapes the customer gateway, the failover behavior, and whether the customer can control which routes enter their network. Run the choosing-static-or-dynamic-routing reference before creating the connection so the customer does not have to recreate it to change routing type.
- The target gateway gates almost everything. A virtual private gateway terminates the VPN at one VPC. A transit gateway fronts many VPCs and is the only target that supports Large (5 Gbps) tunnels, equal-cost multi-path (ECMP) bandwidth aggregation, IPv6 customer gateways, and the VPN Concentrator. The gateway choice lives in the creating reference and is referenced again by the bandwidth and concentrator references, because picking a virtual private gateway closes those doors.
- Bandwidth sizing vs the Concentrator. Both scale capacity, in opposite directions. Large tunnels give one connection more throughput (up to 5 Gbps per tunnel); the Concentrator gives many low-bandwidth sites a shared 5 Gbps attachment so each site does not need its own full-bandwidth connection. Match the reference to whether the customer has one high-throughput site or many small ones.
- AWS side vs device side. Creating the connection and downloading the configuration happen on the AWS side; applying that configuration happens on the customer's on-premises device, which AWS never touches. The applying-the-customer-gateway-device-configuration reference is device-side education, not an AWS-side step.
- Monitoring is its own task. Detecting and diagnosing a down tunnel (CloudWatch metrics, alarms, and VPN logs) is the monitoring reference, separate from building the connection.
- 先确定路由再构建连接：静态与动态路由的选择会影响客户网关、故障转移行为，以及客户是否能控制进入其网络的路由。创建连接前请先参考选择静态或动态路由的文档，避免客户因更改路由类型而需要重新创建连接。
- 目标网关决定大部分功能：虚拟专用网关在单个VPC终止VPN连接。中转网关可对接多个VPC，是唯一支持大型（5 Gbps）隧道、等价多路径（ECMP）带宽聚合、IPv6客户网关和VPN Concentrator的目标网关。网关选择在创建连接的参考文档中说明，带宽和Concentrator的参考文档也会再次提及，因为选择虚拟专用网关会限制这些功能的使用。
- 带宽规格与Concentrator的区别：两者均用于扩展容量，但方向相反。大型隧道可提升单个连接的吞吐量（每条隧道最高5 Gbps）；Concentrator可为多个低带宽站点提供共享的5 Gbps连接，使每个站点无需单独使用全带宽连接。请根据客户是拥有一个高吞吐量站点还是多个小型站点选择对应的参考文档。
- AWS侧与设备侧的区分：创建连接和下载配置操作在AWS侧完成；应用配置则在客户的本地设备上进行，AWS不会触及该设备。应用客户网关设备配置的参考文档是针对设备侧的指导，而非AWS侧的操作步骤。
- 监控为独立任务：检测和诊断故障隧道（CloudWatch指标、告警和VPN日志）属于监控参考文档的内容，与连接构建操作分离。