hello I'm Ishita a cloud Support
Engineer you're at the AWS headquarters
in Seattle sometimes customers ask me
how to migrate from an ad instance to an
ad gateway and they want to ensure that
the migration is graceful with minimal
downtime I tell them an ad instance - an
ad Gateway migration plan must be
audited first before the actual
completion let me walk you through some
of the points that need to be considered
for auditing do you plan to use the same
elastic IP address for nad gateway as
currently used by NAT instance a new
elastic IP address might not be
recognized by external clients is your
NAT instance performing other
functionalities such as port forwarding
customizing scripts providing VPN
services or acting as a bastion host an
ADD gateway enables instances in a
private subnet to connect to the
internet or other AWS services but it
prevents the internet from initiating
connections with those instances have
you configured your NAT instance
security groups and your NAT gateway NAC
else you can use security groups to
control traffic to NAT instances however
network ACLs are used to control traffic
to NAT gateways to your current NAT
instances provide high availability
across availability zones if so you
might want to create an availability
zone independent architecture you can do
this by creating an add gateway in each
availability zone and configuring your
routing to ensure that resources use the
NAD gateway in the same availability
zone if you change your routing from a
NAT instance to an add gateway or or if
you disassociate the elastic IP address
from your NAT instance any current
connections are dropped and have to be
re-established ensure that you don't
have any critical tasks or any other
tasks that operate through the NAT
instance running if supported by our
architecture change one NAT instance to
an add gateway and then test your
connectivity once that one is good move
on to the other migration after the
auditing is completed you can pursue the
following steps to complete the
migration as you can see I've logged
into my AWS management
and soul check your routes in the
private subnets route table to do that
you will navigate to the V PC management
console and this is the private
instances route table which has a
default route pointing to the NAT
instance now this associate elastic IP
address from existing that instance to
do that navigate to the elastic IP
section in the V PC dashboard click on
the elastic IP address associated with
your NAT instance and then click on
actions and click on disassociate
address next you need to deploy the NAT
gateway with the released or new elastic
IP address in the public subnet for the
NAT instance you need to replace to do
that you would want to go to the nad
gateway section in the V PC dashboard
click on create nad gateway search for
the subnet ID and then select the EIP
that was associated with your NAT
instance which you disassociated earlier
and click on create an add gateway if
you plan to use a new elastic IP address
then you can generate it while creating
the NAD gateway to do that you need to
create the NAD gateway with the
appropriate elastic IP and the subnet ID
at this point you need to go through the
route tables that reference the NAT
instance you replaced and edit the route
to now refer the newly created nad
gateway instead to do that you would
click on edit route tables click on edit
and change the default route pointing to
the NAT instance and change it to the
NAD gateway instead
next you would want to click on safe
depending on the number of nad instances
presently deployed in your environment
you may need to repeat the previous
steps for every NAT instance and subnet
that you want to migrate now you need to
attempt to access any one of the receipt
o instances in the private subnet and
verify connectivity to the Internet
based on what is allowed for that I'll
be going to the terminal as you can see
I am now logged into the terminal of the
private instance and I'm going to show
you how to verify Internet connectivity
the first test I'll be doing is a ping
test to dub dub dub amazon.com as you
can see the ping test is successful next
test I'll be doing is a cold test
we can see a 200 ok response from HTTP
after you have successfully migrated to
the NAD gateway and have verified
everything is working as expected then
you can start dominating or
decommissioning the nad instances thanks
for watching and happy cloud computing
from all of us here at leader of us
you