Examkin

Question

Difficulty: MediumHigh-Performing and Scalable Network Architectures

A media company needs to securely back up large video archives from its on-premises data center to Amazon S3. The daily backup transfers require a secure, encrypted connection over the internet with a minimum throughput of 3 Gbps3\text{ Gbps}. Which network architecture should a solutions architect design to meet these throughput and security requirements?

  1. A
    Deploy a single AWS Site-to-Site VPN connection to a virtual private gateway (VGW), and configure stateful Network Access Control Lists (NACLs) to bypass the default tunnel bandwidth limits.
  2. B
    Set up a single AWS Site-to-Site VPN connection to an Amazon VPC virtual private gateway, and configure dynamic BGP routing to allow the tunnel to auto-scale up to 5 Gbps5\text{ Gbps}.
  3. Establish multiple AWS Site-to-Site VPN connections terminated on an AWS Transit Gateway, and enable Equal-Cost Multi-Path (ECMP) routing to aggregate the bandwidth of the VPN tunnels.Answer
  4. D
    Implement Amazon Route 53 latency-based routing to distribute the backup data streams across multiple virtual private gateways in different AWS Regions to bypass the VPN tunnel limit.

Answer

Establish multiple AWS Site-to-Site VPN connections terminated on an AWS Transit Gateway, and enable Equal-Cost Multi-Path (ECMP) routing to aggregate the bandwidth of the VPN tunnels.
AWS Site-to-Site VPN connections have a maximum throughput of 1.25 Gbps1.25\text{ Gbps} per tunnel. To achieve a throughput higher than this limit (such as the required 3 Gbps3\text{ Gbps}) over encrypted VPN connections, a solutions architect must terminate the VPN connections on an AWS Transit Gateway. By enabling Equal-Cost Multi-Path (ECMP) routing on the Transit Gateway, traffic is distributed across multiple VPN paths, effectively aggregating their bandwidth to meet the demand.

Step-by-Step Solution

1
Identify the network throughput and security constraints.
The solution requires an encrypted connection over the public internet (VPN) with at least 3 Gbps3\text{ Gbps} bandwidth.
Encryption over the internet points to AWS Site-to-Site VPN. However, a single VPN tunnel has a hard limit of 1.25 Gbps1.25\text{ Gbps}.
2
Evaluate bandwidth aggregation options for VPN connections.
To scale past the 1.25 Gbps1.25\text{ Gbps} limit of a single tunnel, multiple tunnels must be combined.
AWS Transit Gateway supports Equal-Cost Multi-Path (ECMP) routing, which allows load balancing traffic across multiple VPN paths simultaneously.
3
Design the architecture using AWS Transit Gateway and ECMP.
Terminating multiple VPN connections on the Transit Gateway with ECMP enabled aggregates their throughput to meet the 3 Gbps3\text{ Gbps} requirement.
This configuration meets the performance requirement while maintaining IPsec encryption over the internet.

Key Concept

AWS Site-to-Site VPN throughput limits can be exceeded by terminating multiple VPN connections on an AWS Transit Gateway and enabling Equal-Cost Multi-Path (ECMP) routing.
Rate this question

Topics

High-Performing and Scalable Network Architectures

More questions from this topic