Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

An enterprise is migrating its legacy on-premises ERP application consisting of 15 virtual machines to AWS using AWS Application Migration Service (MGN). The hybrid connectivity between the on-premises data center and AWS is established via a 1 Gbps AWS Direct Connect connection that terminates at an AWS Transit Gateway in a centralized Network Services VPC. The Transit Gateway distributes traffic to a dedicated Staging VPC where the MGN replication servers are provisioned. After installing the AWS Replication Agent on the on-premises source servers, the migration team observes that the data replication status remains stuck at 'Initiating' and the agent log files show connection timeouts when attempting to reach the replication servers. Which of the following actions should a Solutions Architect take to resolve this issue and allow data replication to proceed?

  1. Configure the on-premises firewall to permit outbound traffic on TCP port 1500 to the staging area subnet CIDR block, and verify that the security group associated with the replication servers in the Staging VPC allows inbound traffic on TCP port 1500 from the on-premises IP address range.Answer
  2. B
    Create an Amazon Route 53 private hosted zone for the MGN replication endpoints, associate it with both the Staging VPC and the Network Services VPC, and configure the on-premises firewall to allow outbound HTTPS traffic on TCP port 443.
  3. C
    Modify the Transit Gateway route tables to bypass the Network Services VPC and route the replication traffic through a Direct Connect Gateway associated directly with the Staging VPC, as Transit Gateway does not support transitive routing between Direct Connect and a Staging VPC.
  4. D
    Deploy redundant NAT Gateways across multiple Availability Zones in the Staging VPC, and update the route tables of the replication server subnets to route default outbound traffic (0.0.0.0/0) through these NAT Gateways to the internet.

Answer

Configure the on-premises firewall to permit outbound traffic on TCP port 1500 to the staging area subnet CIDR block, and verify that the security group associated with the replication servers in the Staging VPC allows inbound traffic on TCP port 1500 from the on-premises IP address range.
The correct answer is to configure the on-premises firewall and the Staging VPC security group to allow traffic on TCP port 1500. AWS MGN requires TCP port 1500 for replication data transmission from the Replication Agent on the source servers to the replication servers in the staging area. Opening this port resolves the connection timeout.

Step-by-Step Solution

1
Identify the network port required for data replication in AWS Application Migration Service (MGN).
AWS MGN requires TCP port 1500 to be open from the source servers to the replication servers in the staging area.
Although control plane communication uses HTTPS over port 443, the actual replication stream flows over TCP port 1500.
2
Analyze the network path and security controls between the on-premises environment and the Staging VPC.
The connection times out, indicating a firewall or security group block on the data replication port (TCP 1500) rather than a routing or DNS resolution failure.
A timeout indicates packets are being dropped by a security mechanism (firewall or security group) along the network path.
3
Verify and apply the correct security configurations.
Allowing outbound traffic on TCP port 1500 from on-premises and inbound traffic on the replication servers' security group establishes the replication channel.
This establishes private, secure data replication over the Direct Connect and Transit Gateway network path.

Key Concept

Data replication in AWS MGN requires TCP port 1500 to be open from the source servers to the replication servers in the staging area.
Estimated Time:2m 0s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic