Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A company has a multi-account AWS environment with 12 spoke VPCs in a single AWS Region. The company needs to design a highly available hybrid network architecture to connect these VPCs to its on-premises data center. The primary path must use a 10 Gbps AWS Direct Connect connection with a Direct Connect Gateway and an AWS Transit Gateway. An IPsec VPN over the public internet connected to the same Transit Gateway must serve as the backup path. All traffic must prefer the Direct Connect path under normal operations and automatically fail over to the VPN if the Direct Connect connection becomes unavailable. Which TWO routing configurations must the Solutions Architect implement on the customer gateway to ensure this symmetric routing behavior? (Select TWO.)

  1. Configure the customer gateway to set a higher BGP local preference attribute for routes received from AWS via the Direct Connect connection than for routes received via the VPN connection.Answer
  2. Configure the customer gateway to advertise the on-premises network prefixes over both connections, but prepend the customer gateway's Autonomous System (AS) number multiple times when advertising over the VPN connection.Answer
  3. C
    Configure a static route in the Transit Gateway route table pointing to the VPN attachment for the on-premises network range, while using BGP propagation for the Direct Connect Gateway attachment.
  4. D
    Associate the Route 53 Private Hosted Zone for on-premises domain resolution with only a single shared services VPC, and rely on standard VPC peering to route DNS queries from other VPCs.
  5. E
    Route all outbound traffic from the 12 spoke VPCs through a single NAT Gateway located in a central egress VPC to minimize NAT Gateway hourly charges.

Answer

Configure the customer gateway to set a higher BGP local preference attribute for routes received from AWS via the Direct Connect connection, and configure the customer gateway to advertise the on-premises network prefixes over both connections while prepending the AS number multiple times over the VPN connection.
Under normal operations, setting a higher local preference for routes received via the Direct Connect connection ensures that on-premises outbound traffic (inbound to AWS) uses the Direct Connect link. Prepending the AS path on the VPN link ensures that AWS prefers the Direct Connect path for outbound traffic from the VPCs. These two configurations guarantee symmetric routing over the primary path with automatic failover to the backup VPN path.

Step-by-Step Solution

1
Determine the routing mechanism for traffic originating from the on-premises data center (inbound to AWS).
BGP local preference is a local attribute used within an Autonomous System to prefer one exit point over another. Setting a higher local preference for the Direct Connect path ensures that the on-premises routers select this path for all traffic destined to AWS VPCs.
This establishes primary routing for inbound traffic to AWS.
2
Determine the routing mechanism for traffic originating from AWS VPCs (outbound to the on-premises data center).
AWS Transit Gateway selects the path with the shortest AS Path when multiple BGP routes are propagated. Prepending the AS number on the VPN connection artificially increases its AS Path length, making the Direct Connect path the preferred route.
This establishes primary routing for outbound traffic from AWS, preventing asymmetric routing.

Key Concept

BGP path selection attributes (Local Preference and AS Path prepending) are critical for establishing symmetric, deterministic routing over redundant hybrid connections (Direct Connect and VPN) connected to AWS Transit Gateway.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic