Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

A financial institution is migrating a core banking application consisting of 1515 physical servers from an on-premises data center to AWS. The replication traffic must flow privately over an existing AWS Direct Connect connection to a staging area VPC, which is connected to a shared services VPC via an AWS Transit Gateway. The Solutions Architect has installed the AWS Replication Agent on the source servers, but the replication status shows that the agents are unable to communicate with the replication servers in the staging area VPC, preventing the initialization of the data replication process.

Which action should the Solutions Architect take to resolve this connectivity issue and allow data replication to begin?

  1. A
    Associate the Route 53 Private Hosted Zone for the MGN endpoints only with the shared services VPC, and rely on default DNS resolution in the staging area VPC without associating the zone to it.
  2. Configure the on-premises firewall to allow outbound traffic on TCP port 1500 to the staging area VPC, and update the staging area's security groups to allow inbound traffic on TCP port 1500 from the on-premises CIDR block.Answer
  3. C
    Modify the staging area security group to permit inbound TCP port 443 traffic from the on-premises environment, as the replication agent tunnels all data blocks and control signals through HTTPS.
  4. D
    Configure a Direct Connect Gateway to perform transitive routing directly between the staging area VPC and a shared transit VPC to bypass the need for an AWS Transit Gateway.

Answer

Configure the on-premises firewall to allow outbound traffic on TCP port 1500 to the staging area VPC, and update the staging area's security groups to allow inbound traffic on TCP port 1500 from the on-premises CIDR block.
The correct action is to ensure that TCP port 1500 is open in both the on-premises network firewall (outbound) and the staging area security groups (inbound). AWS Application Migration Service (MGN) uses TCP port 1500 for the actual replication data stream between the AWS Replication Agent on the source servers and the replication servers in the staging area VPC.

Step-by-Step Solution

1
Identify the network requirements for AWS Application Migration Service (MGN) data plane replication.
Determine that the AWS Replication Agent replicates data blocks to the replication servers in the staging area VPC over TCP port 1500.
Replication data does not use port 443, which is reserved for the control plane.
2
Analyze the on-premises firewall and AWS security group configurations.
Confirm that outbound TCP port 1500 must be open from on-premises servers and inbound TCP port 1500 must be open in the staging area security groups.
Without these rules, replication packets cannot reach the replication servers in the staging area VPC.
3
Implement the necessary security group and firewall changes.
Allow TCP port 1500 outbound on the on-premises firewall and inbound on the staging area VPC security group.
This establishes the necessary connection path for the data replication streams to start.

Key Concept

Data replication traffic in AWS Application Migration Service (MGN) requires TCP port 1500 to be open between the source servers and the replication servers in the staging area VPC.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic