Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network architecture to connect 10 spoke VPCs in an AWS Organization to their on-premises datacenter. The primary path must use a 10 Gbps AWS Direct Connect connection associated with an AWS Transit Gateway. An IPsec VPN over the internet is configured as a backup path and terminates on the same Transit Gateway. The system must automatically fail over to the VPN if the Direct Connect link fails, and fail back to the Direct Connect link once restored. Which configuration meets these requirements with the least administrative effort?

  1. A
    Configure a Route 53 Private Hosted Zone (PHZ) containing the on-premises endpoint records. Associate the PHZ only with a central hub VPC and configure DNS failover routing to point to the VPN endpoint when the Direct Connect Gateway becomes unreachable.
  2. Configure BGP sessions on both the Direct Connect and VPN connections. Program the on-premises router to advertise the on-premises prefixes to both paths, prepending the Autonomous System (AS) path on the VPN advertisement. Ensure the on-premises router is configured with a higher BGP local preference for routes received via Direct Connect.Answer
  3. C
    Configure VPC peering between all 10 spoke VPCs and a central transit VPC that contains the Direct Connect Gateway. Use static routes within the spoke VPCs to direct on-premises traffic through the peering connections, and use a Transit Gateway-attached VPN as a backup routing target.
  4. D
    Route all on-premises traffic from the spoke VPCs through a single NAT Gateway deployed in a shared services VPC. Configure the NAT Gateway's route table to forward on-premises traffic to the Transit Gateway, relying on static route tracking to switch the target from the Direct Connect Gateway to the VPN.

Answer

Configure BGP sessions on both paths, prepending the AS path on the VPN advertisement, and configuring a higher local preference for the Direct Connect routes on the on-premises router.
Configuring BGP sessions on both paths and using AS path prepending on the VPN connection ensures that the Transit Gateway prefers the Direct Connect path for traffic going from AWS to on-premises. Adjusting the local preference on-premises ensures that traffic going from on-premises to AWS also prefers the Direct Connect path. This dynamically manages failover and failback without static routing overhead.

Step-by-Step Solution

1
Configure BGP routing on both the Direct Connect Gateway association and the Transit Gateway VPN attachment.
Dynamic routing updates are established between AWS and the on-premises router.
BGP allows dynamic exchange of routing information and automated failover.
2
Prepend the AS path on the VPN BGP advertisement from the on-premises router.
The AWS Transit Gateway receives a longer AS path for the VPN connection compared to the Direct Connect connection.
AWS Transit Gateway selects the route with the shortest AS path, ensuring AWS-to-on-premises traffic prefers the Direct Connect link.
3
Configure a higher local preference for routes received via Direct Connect on the on-premises router.
The on-premises router prefers the Direct Connect path for outbound traffic targeting AWS.
This establishes symmetric routing, ensuring traffic from on-premises to AWS also prefers the Direct Connect link.

Key Concept

Dynamic hybrid routing failover using BGP AS path prepending and local preference.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic