Examkin

Question

Difficulty: HardInfrastructure Migration with AWS Application Migration Service (MGN)

A clinical research organization is migrating its regulatory-compliant data ingestion workload, consisting of 1818 servers, from a private colocation facility to AWS. Security policies mandate that all replication traffic must be encrypted in transit and must not traverse the public internet. The hybrid connectivity is established using an AWS Direct Connect connection terminating at an AWS Transit Gateway. A dedicated staging VPC contains the AWS Application Migration Service (MGN) staging area subnet. During the agent installation on the on-premises servers, replication fails to initiate. A solutions architect discovers that while the agent can establish a control plane connection to the MGN VPC endpoints over port 443443, the agent cannot establish a data replication connection to the MGN replication servers in the staging area subnet.

Which of the following actions will resolve this replication failure?

  1. Configure the on-premises firewall to allow outbound traffic on TCP port 15001500 to the staging area subnet, and verify that the security group for the MGN replication servers allows inbound traffic on TCP port 15001500 from the on-premises server CIDR block.Answer
  2. B
    Modify the MGN replication template to use TCP port 443443 for data replication traffic instead of TCP port 15001500, and configure the on-premises firewall to allow outbound HTTPS traffic to the staging area subnet.
  3. C
    Deploy a Direct Connect Gateway and associate it directly with the virtual private gateway of the staging VPC, then configure the Transit Gateway route tables to allow transitive routing between the Direct Connect gateway and the replication servers.
  4. D
    Associate the Route 53 Private Hosted Zone for the MGN VPC endpoints with the staging VPC, and configure the on-premises DNS forwarder to route all queries for the replication server hostnames to the Route 53 Resolver inbound endpoint.

Answer

Configure the on-premises firewall to allow outbound traffic on TCP port 1500 to the staging area subnet, and verify that the security group for the MGN replication servers allows inbound traffic on TCP port 1500 from the on-premises server CIDR block.
AWS Application Migration Service (MGN) requires two distinct paths of network communication: control plane communication over TCP port 443443 to the MGN service endpoints, and data replication traffic over TCP port 15001500 directly to the replication servers in the staging area subnet. Since the control plane connection over port 443443 is working but replication cannot initiate, the corporate firewall or the security group in the staging area is blocking the replication channel on TCP port 15001500. Allowing outbound traffic on port 15001500 at the corporate firewall and inbound traffic on port 15001500 in the staging area security group resolves this block.

Step-by-Step Solution

1
Identify the network ports required for AWS Application Migration Service (MGN) agent data replication.
Determine that the replication agent requires outbound TCP port 15001500 to send data blocks directly to the replication servers in the staging area subnet.
AWS MGN separates control plane traffic (TCP port 443443) from data replication traffic (TCP port 15001500).
2
Examine the status of the replication connection from the source servers to the staging area.
Identify that the control plane connection over port 443443 is successful, but the data replication channel to the replication servers is failing.
This isolates the issue specifically to TCP port 15001500 routing, firewall rules, or security groups rather than DNS resolution or endpoint configuration.
3
Adjust the security groups and on-premises firewall configurations to permit replication traffic.
Allow outbound TCP port 15001500 on the corporate firewall and inbound TCP port 15001500 on the staging area subnet's security group.
This allows the replication agent on the on-premises servers to establish a direct data channel to the replication servers over the private Direct Connect and Transit Gateway connection.

Key Concept

AWS Application Migration Service (MGN) requires TCP port 15001500 to be open for data replication from the source servers to the replication servers in the staging area subnet. Control plane communication uses TCP port 443443.
Estimated Time:2m 30s
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic