Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

A retail company is designing a hybrid network architecture to replicate real-time transactional data from their on-premises database to AWS. The primary connection is an AWS Direct Connect connection. The replication throughput can reach up to 3 Gbps3\text{ Gbps} during peak hours. The company requires a secure, encrypted backup path over the internet that can handle the full peak replication throughput in the event of a Direct Connect outage. Which two actions should the solutions architect take to meet these performance and backup requirements?

  1. Create an AWS Transit Gateway and ensure Equal-Cost Multi-Path (ECMP) support is enabled.Answer
  2. Establish multiple AWS Site-to-Site VPN connections terminating on the AWS Transit Gateway, and configure dynamic Border Gateway Protocol (BGP) routing.Answer
  3. C
    Establish a single AWS Site-to-Site VPN connection terminating on a Virtual Private Gateway (VGW) attached to the VPC.
  4. D
    Configure an Amazon Route 53 latency-based routing policy to automatically fail over database replication endpoints between the Direct Connect and the backup VPN connection.
  5. E
    Configure stateless Network Access Control Lists (NACLs) to automatically track and allow return traffic from the backup VPN connection without explicit rule definition.

Answer

Create an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) support enabled, and establish multiple AWS Site-to-Site VPN connections terminating on the Transit Gateway configured with dynamic Border Gateway Protocol (BGP) routing.
To achieve a secure backup over the internet that scales beyond the default limit of a single VPN tunnel (1.25 Gbps1.25\text{ Gbps}) to handle 3 Gbps3\text{ Gbps} of traffic, a Transit Gateway with ECMP enabled must be used. Combining this with multiple Site-to-Site VPN connections using dynamic BGP routing allows traffic to load-balance across multiple tunnels, successfully scaling the total bandwidth.

Step-by-Step Solution

1
Analyze the peak replication bandwidth requirements for the backup network connection.
Identify that the backup connection must support up to 3 Gbps3\text{ Gbps} of throughput, which exceeds the 1.25 Gbps1.25\text{ Gbps} capacity limit of a single AWS VPN tunnel.
Determining the performance constraint ensures that the architecture incorporates a multi-tunnel solution.
2
Select the appropriate routing and gateway architecture to scale the VPN throughput.
Choose AWS Transit Gateway with ECMP enabled to allow load balancing across multiple active VPN tunnels.
Transit Gateway supports ECMP, which allows traffic to be distributed across multiple paths, effectively scaling VPN throughput beyond the limit of a single tunnel.
3
Configure routing on the VPN connections.
Establish multiple VPN connections and configure dynamic Border Gateway Protocol (BGP) routing.
BGP is required for ECMP to advertise the same routes across multiple tunnels, enabling active-active load balancing.

Key Concept

Scaling VPN throughput using AWS Transit Gateway and Equal-Cost Multi-Path (ECMP) routing.
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic