Examkin

Question

Difficulty: Very hardHigh-Performing and Scalable Network Architectures

A financial services firm is deploying a hybrid cloud architecture to synchronize real-time transaction ledger data between its on-premises mainframe cluster and multiple VPCs in the AWS Cloud. The synchronization process requires a sustained network throughput of at least 3.0 Gbps3.0 \text{ Gbps} with IPsec encryption in transit. The on-premises edge routers support IPsec VPN configurations and dynamic Border Gateway Protocol (BGP) routing. However, due to strict physical deployment constraints and immediate project timelines, the firm cannot deploy AWS Direct Connect. Which combination of actions should the solutions architect implement to meet these throughput and encryption requirements? (Select TWO.)

  1. Create an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing support.Answer
  2. Establish multiple AWS Site-to-Site VPN connections to the Transit Gateway, and configure dynamic Border Gateway Protocol (BGP) routing on the customer gateway to distribute traffic across the tunnels.Answer
  3. C
    Set up a single AWS Site-to-Site VPN connection with dynamic routing, and configure Amazon Route 53 latency-based routing policies to distribute the network traffic.
  4. D
    Deploy a Virtual Private Gateway (VGW) attached to the primary VPC, establish a single Site-to-Site VPN connection, and configure stateless Network Access Control Lists (NACLs) to load-balance traffic across the tunnels.
  5. E
    Establish a single AWS Site-to-Site VPN connection with static routing, and configure the on-premises firewall to bundle both tunnels into a single logical channel using Link Aggregation Control Protocol (LACP).

Answer

Create an AWS Transit Gateway, enable Equal-Cost Multi-Path (ECMP) routing support, and establish multiple AWS Site-to-Site VPN connections to the Transit Gateway while configuring dynamic Border Gateway Protocol (BGP) routing on the customer gateway.
To achieve a network throughput of 3.0 Gbps3.0 \text{ Gbps} over IPsec VPN, the architecture must bypass the single-tunnel limit of 1.25 Gbps1.25 \text{ Gbps}. The solutions architect must create an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing. By setting up multiple AWS Site-to-Site VPN connections to the Transit Gateway and configuring dynamic Border Gateway Protocol (BGP) routing on the customer gateway, the systems can distribute traffic across multiple tunnels, scaling aggregate bandwidth beyond the single-tunnel bottleneck.

Step-by-Step Solution

1
Analyze the bandwidth requirement and constraints.
The scenario requires 3.0 Gbps3.0 \text{ Gbps} of IPsec-encrypted throughput. Physical Direct Connect is ruled out, leaving AWS Site-to-Site VPN as the primary connection method.
A single AWS Site-to-Site VPN tunnel has a hard throughput limit of 1.25 Gbps1.25 \text{ Gbps}.
2
Identify the mechanism to aggregate VPN bandwidth.
AWS Transit Gateway can aggregate multiple VPN tunnels using Equal-Cost Multi-Path (ECMP) routing.
By enabling ECMP on the Transit Gateway, traffic can be load-balanced across multiple active VPN tunnels in parallel.
3
Configure the routing protocol and connection layout.
Multiple AWS Site-to-Site VPN connections must be established to the Transit Gateway, and dynamic BGP routing must be enabled on both sides.
Dynamic BGP routing is a prerequisite for ECMP to work, enabling the advertisement of identical weights for paths over all active tunnels.

Key Concept

Scaling VPN bandwidth using AWS Transit Gateway ECMP routing
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic