An enterprise is designing a hybrid network architecture to connect `45` spoke VPCs in the… — AWS Certified Solutions Architect - Professional

An enterprise is designing a hybrid network architecture to connect ` $45$ ` spoke VPCs in the `us-east-1` Region to its on-premises corporate data center. The architecture must support a high-throughput primary path and a redundant backup path. The enterprise has provisioned a ` $10\text{ Gbps}$ ` AWS Direct Connect connection and wants to use an IPsec Site-to-Site VPN over the public internet as the backup. The design must ensure that the Direct Connect connection is the preferred path for all bidirectional traffic under normal operating conditions, failover to the VPN is automatic, routing is symmetric to support stateful firewalls on-premises, and administrative overhead is minimized. Which architecture and routing configuration will meet these requirements?

Configure an AWS Transit Gateway in `us-east-1` and attach the ` $45$ ` spoke VPCs. Create a Direct Connect Gateway and associate it with the Transit Gateway using a Transit Virtual Interface. Establish an IPsec Site-to-Site VPN connection and attach it to the Transit Gateway. Enable BGP routing on both paths, and configure the on-premises router to assign a higher BGP Local Preference to routes received via the Direct Connect connection compared to the VPN connection.Answer
B
Configure an AWS Transit Gateway in `us-east-1` and attach the ` $45$ ` spoke VPCs. Create a Direct Connect Gateway and associate it with the Transit Gateway using a Private Virtual Interface. Establish an IPsec Site-to-Site VPN connection and attach it to the Transit Gateway. Configure static routes in the Transit Gateway route table pointing to the VPN attachment with a higher administrative distance to ensure it is only used during a failover.
C
Create a Virtual Private Gateway in each of the ` $45$ ` spoke VPCs. Set up a mesh of VPC peering connections among all ` $45$ ` VPCs to enable inter-VPC traffic. Associate each Virtual Private Gateway with a Direct Connect Gateway using Private Virtual Interfaces, and establish separate Site-to-Site VPN connections to each VPC to act as backup paths. Configure the on-premises router to prefer the Direct Connect path using BGP Local Preference.
D
Configure an AWS Transit Gateway in `us-east-1` and attach the ` $45$ ` spoke VPCs. Create a Direct Connect Gateway and associate it with the Transit Gateway using a Transit Virtual Interface. Establish an IPsec Site-to-Site VPN connection to the Transit Gateway. Enable Equal-Cost Multi-Path routing on the Transit Gateway, and configure the on-premises router to advertise more specific prefixes over the VPN connection than over the Direct Connect connection.

Answer

Configure an AWS Transit Gateway, connect the Direct Connect Gateway via a Transit Virtual Interface, establish a Site-to-Site VPN, use BGP routing on both paths, and configure the on-premises router to prefer the Direct Connect path using a higher BGP Local Preference.

The correct configuration uses AWS Transit Gateway to centralize connection management for the `

45

` spoke VPCs, which minimizes administrative overhead. By using a Direct Connect Gateway associated via a Transit Virtual Interface (Transit VIF), the enterprise can route traffic transitively from the Transit Gateway to the on-premises data center. BGP routing allows for dynamic failover. To ensure symmetric routing, the on-premises router must be configured with a higher BGP Local Preference for routes learned via Direct Connect, making it the preferred path for inbound traffic, while AWS automatically prefers the Direct Connect Gateway path over the VPN path for outbound traffic if AS path lengths are equal.

Step-by-Step Solution

Consolidate multi-VPC networking.

Attach all `

45

` spoke VPCs to a central AWS Transit Gateway to minimize administrative overhead.

Managing individual VPC connections or peering meshes at scale is administratively complex and does not scale.

Establish the primary and backup hybrid connectivity paths.

Associate the Direct Connect Gateway with the Transit Gateway via a Transit Virtual Interface (Transit VIF), and attach the IPsec Site-to-Site VPN directly to the Transit Gateway.

Transit Gateway requires a Transit VIF to integrate with Direct Connect Gateway for transitive routing. The Site-to-Site VPN acts as a backup path.

Configure dynamic routing for outbound traffic from AWS.

Enable BGP propagation. AWS Transit Gateway automatically prefers the Direct Connect Gateway path over the VPN path for outbound traffic when prefix lengths and AS path lengths are equal.

Using dynamic BGP propagation ensures automatic failover and allows AWS to utilize its default path selection hierarchy.

Configure dynamic routing for inbound traffic from on-premises and ensure symmetry.

Configure the customer gateway router to assign a higher BGP Local Preference to prefixes received over the Direct Connect path compared to the VPN path.

Symmetric routing is achieved when both inbound and outbound traffic prefer the same path under normal operating conditions. Local Preference is a local BGP attribute that ensures the on-premises router prefers the Direct Connect link.

Key Concept

Symmetric routing and failover in a hybrid Transit Gateway architecture using Direct Connect and Site-to-Site VPN.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic