Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a highly resilient hybrid network architecture for its multi-account AWS environment. The environment consists of 4040 VPCs distributed across two AWS Regions: `us-east-1` (2525 VPCs) and `eu-west-1` (1515 VPCs). The enterprise needs to establish redundant connectivity to its primary on-premises data center in London.

The network design must meet the following requirements:
- Establish a primary, high-bandwidth path using a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection.
- Establish a backup IPsec VPN connection over the public internet.
- Minimize administrative overhead for managing routing tables.
- Support transitive routing between the VPCs in both regions and the on-premises data center.
- Ensure that the Direct Connect path is preferred for both inbound and outbound traffic, with automatic failover to the VPN connection in the event of a Direct Connect outage.

Which of the following architectures meets these requirements?

  1. Deploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and establish a TGW peering connection between them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating on each regional TGW. Configure BGP routing on all connections, and configure the on-premises router to assign a higher BGP Local Preference to routes received via the Direct Connect Gateway.Answer
  2. B
    Deploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and peer them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating only on the `eu-west-1` TGW. Configure BGP routing on all connections, and rely on the TGW peering connection to route `us-east-1` traffic to the `eu-west-1` TGW's VPN attachment during a Direct Connect outage.
  3. C
    Deploy a Direct Connect Gateway (DXGW) and associate it directly with all 4040 Virtual Private Gateways (VGWs) of the VPCs across both regions. Terminate a Private VIF from the Direct Connect connection on the DXGW. For the backup path, establish an AWS Site-to-Site VPN connection to each individual VPC's VGW. Configure BGP routing on all VGWs to manage failover dynamically, preferring the Direct Connect path using BGP community tags.
  4. D
    Deploy an AWS Transit Gateway (TGW) in `us-east-1` and another in `eu-west-1`, and peer them. Attach the local VPCs in each region to their respective TGW. Create a Direct Connect Gateway (DXGW), associate it with both TGWs, and terminate a Transit VIF from the DX connection on the DXGW. Establish an AWS Site-to-Site VPN connection terminating on each regional TGW. Associate a single Route 53 Private Hosted Zone (PHZ) for the on-premises domain with a central Shared Services VPC in `eu-west-1`, and rely on the TGW peering connection to automatically resolve on-premises DNS queries for all VPCs in both regions.

Answer

The correct architecture requires deploying a Transit Gateway in each region, peering them, associating both with a Direct Connect Gateway using a Transit VIF, terminating Site-to-Site VPNs on each regional Transit Gateway, and using BGP with Local Preference configuration on the on-premises router to prioritize the Direct Connect path.
The correct architecture uses a Transit Gateway (TGW) in each region peered together, with a Direct Connect Gateway (DXGW) associated with both TGWs using a Transit VIF. This setup allows all VPCs to access the Direct Connect connection. To provide backup connectivity, an AWS Site-to-Site VPN must be terminated on each regional TGW because TGW peering does not support transitive routing to VPN attachments. Dynamic routing with BGP is used, and configuring a higher BGP Local Preference on the on-premises router for routes received via Direct Connect ensures that inbound traffic prefers the Direct Connect path.

Step-by-Step Solution

1
Evaluate the VPC scale and routing requirements.
With 4040 VPCs across two regions, using individual Virtual Private Gateways (VGWs) associated with a Direct Connect Gateway (DXGW) is not feasible due to the association limit of 1010 VGWs per DXGW. Thus, regional AWS Transit Gateways (TGWs) must be used to aggregate VPC connectivity.
Transit Gateway simplifies the network topology and scales to thousands of VPCs, making it the appropriate choice for a multi-account, multi-VPC environment.
2
Determine the inter-region connectivity and Transit Gateway configuration.
Deploy a Transit Gateway in `us-east-1` and another in `eu-west-1`, peering them to allow inter-region VPC-to-VPC communication. Connect local VPCs to their respective regional TGWs.
TGW VPC attachments are regional, so regional TGWs are required, and TGW peering enables cross-region routing.
3
Configure the primary and backup hybrid connectivity.
Associate the Direct Connect Gateway (DXGW) with the TGWs in both regions, terminating a Transit VIF. Establish local AWS Site-to-Site VPN connections terminating directly on each regional TGW.
Since TGW peering does not support transitive routing to VPN attachments, each TGW must have its own local VPN connection to the on-premises data center to ensure backup connectivity for both regions during a Direct Connect outage.
4
Configure BGP routing parameters to enforce path preference and failover.
For AWS-to-on-premises traffic, TGW automatically prefers the DXGW attachment over the VPN attachment for identical prefixes. For on-premises-to-AWS traffic, configure the customer gateway to assign a higher Local Preference to routes received via the Direct Connect Gateway than those received via VPN.
BGP configuration ensures symmetric routing and automatic failover by preferring the higher-bandwidth Direct Connect path under normal conditions.

Key Concept

Multi-region hybrid connectivity requires the combination of regional Transit Gateways (TGWs) associated with a Direct Connect Gateway (DXGW) for high-performance routing, supplemented by local Site-to-Site VPN connections on each TGW to circumvent TGW peering transitive routing limitations.
Estimated Time:2m 30s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic