Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

An analytics firm wants to establish a secure, hybrid network connection between its on-premises database and a VPC on AWS to stream daily transactions. The transaction stream peaks at 2.0 Gbps2.0\text{ Gbps} of continuous bandwidth. The firm wants to leverage its existing internet connection and use IPSec VPN for security. Which TWO options should the solutions architect configure to establish a high-performing and scalable connection?

  1. Enable Equal-Cost Multi-Path (ECMP) routing on the AWS Transit Gateway.Answer
  2. Configure the customer gateway to establish multiple VPN connections terminating on the AWS Transit Gateway and advertise the same on-premises routes via Border Gateway Protocol (BGP).Answer
  3. C
    Establish a single AWS Site-to-Site VPN connection to a virtual private gateway, since a single VPN tunnel dynamically scales to support up to 2.5 Gbps.
  4. D
    Configure stateful Network ACL rules on the target subnets to track and permit return traffic for the high-throughput streams.
  5. E
    Use Amazon Route 53 latency-based routing to distribute the replication traffic across multiple customer gateway IP addresses without configuring health checks.

Answer

Enabling Equal-Cost Multi-Path (ECMP) routing on the AWS Transit Gateway and configuring the customer gateway to establish multiple VPN connections terminating on the AWS Transit Gateway and advertise the same on-premises routes via Border Gateway Protocol (BGP).
To achieve a network throughput exceeding 1.25 Gbps1.25\text{ Gbps} over IPSec VPN, multiple VPN tunnels must be aggregated. AWS Transit Gateway supports Equal-Cost Multi-Path (ECMP) routing, which balances traffic dynamically across multiple tunnels. By configuring the customer gateway to establish multiple VPN tunnels and advertising identical prefixes via BGP, the Transit Gateway can distribute the 2.0 Gbps2.0\text{ Gbps} load equally among the active tunnels.

Step-by-Step Solution

1
Identify the bandwidth constraint of a single AWS Site-to-Site VPN tunnel.
A single VPN tunnel has a maximum throughput of 1.25 Gbps1.25\text{ Gbps}.
The peak bandwidth requirement is 2.0 Gbps2.0\text{ Gbps}, which exceeds a single tunnel's capability.
2
Select the aggregation mechanism to scale VPN throughput.
AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing enabled.
ECMP allows the network to distribute traffic across multiple active paths (tunnels) to achieve aggregate throughput greater than 1.25 Gbps1.25\text{ Gbps}.
3
Configure routing on the customer gateway to support ECMP.
Establish multiple VPN connections terminating on the AWS Transit Gateway and advertise the same prefixes using Border Gateway Protocol (BGP).
The Transit Gateway requires BGP to dynamically balance traffic over multiple paths using ECMP.

Key Concept

Scaling VPN throughput using AWS Transit Gateway and Equal-Cost Multi-Path (ECMP) routing.
Estimated Time:2m 0s
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic