A global pharmaceutical corporation has a multi-account AWS environment spread across two AWS Regions: ap-southeast-1 and ap-northeast-1. The corporation connects its regional on-premises research facilities in Singapore and Tokyo to AWS. In each AWS Region, a Transit Gateway (TGW) connects regional VPCs. The two TGWs are peered. For hybrid connectivity, a global Direct Connect Gateway (DXGW) is associated with both TGWs. A Singapore Direct Connect Transit Virtual Interface (VIF) connects the Singapore data center to the DXGW, and a Tokyo Direct Connect Transit VIF connects the Tokyo data center to the DXGW. To ensure high availability, the solutions architect deploys AWS Site-to-Site VPN connections from each data center to its local regional TGW as a backup. The Singapore data center uses the IP prefix , and the Tokyo data center uses the IP prefix . The architecture must satisfy the following routing requirements: (1) Under normal operating conditions, all traffic between the Singapore data center and AWS resources in ap-southeast-1 must use the Singapore Direct Connect connection; (2) If the Singapore Direct Connect connection fails, traffic between the Singapore data center and ap-southeast-1 must fail over to the Singapore Site-to-Site VPN; (3) Transitive routing between the Singapore data center and the Tokyo data center through the AWS network must be prevented; (4) Symmetrical routing must be maintained to prevent stateful firewalls on-premises from dropping packets due to asymmetric routing. Which TWO configurations should the solutions architect implement to meet these requirements? (Select TWO.)
- On the customer gateway devices in both Singapore and Tokyo, configure a higher BGP Local Preference for routes received over the Direct Connect Transit VIFs compared to routes received over the Site-to-Site VPN connections.Answer
- In each Transit Gateway, create separate route tables for the VPC attachments, the peering attachment, and the hybrid (Direct Connect and VPN) attachments. In the peering route table, associate the peering attachment and propagate routes only from the VPC attachments. In the hybrid route table, associate the Direct Connect Gateway and VPN attachments and propagate routes only from the VPC attachments.Answer
- COn the customer gateway devices, prepend the on-premises Autonomous System (AS) path multiple times when advertising the local data center prefixes over the Direct Connect Transit VIFs, while advertising the prefixes without prepending over the Site-to-Site VPN connections.
- DOn the customer gateway devices, configure BGP communities to tag all prefixes advertised over the Site-to-Site VPN as (high preference) and routes advertised over the Direct Connect Transit VIFs as (low preference).
- EEnable route propagation from the peered Transit Gateway attachment to the default Transit Gateway route table, and configure a NAT Gateway in a shared services VPC in each region to translate and drop traffic destined for the other region's data center CIDR.