A global manufacturing corporation operates a multi-account AWS environment in the `us-eas… — AWS Certified Solutions Architect - Professional

A global manufacturing corporation operates a multi-account AWS environment in the `us-east-1` Region, managed under AWS Organizations, with all VPCs connected to a central AWS Transit Gateway. The corporation must design a highly resilient hybrid network to connect its AWS resources to two on-premises facilities: a primary factory in Detroit (representing the $172.16.0.0/16$ IP range) and a secondary backup warehouse in Nashville (representing the $172.17.0.0/16$ IP range).

The connectivity requirements are as follows:
- The Detroit factory connects via a $10 \text{ Gbps}$ AWS Direct Connect (DX) connection using a Transit VIF through a Direct Connect Gateway (DXGW) attached to the Transit Gateway. A Site-to-Site VPN connection from the Detroit factory to the Transit Gateway serves as a backup.
- The Nashville warehouse connects via a $1 \text{ Gbps}$ AWS Direct Connect connection using a Transit VIF through the same DXGW.
- Traffic from AWS to the Detroit factory must prefer the Detroit DX link, and fail over to the Site-to-Site VPN only if the Detroit DX link is unavailable.
- Traffic from AWS to the Nashville warehouse must prefer the Nashville DX link. If the Nashville DX link fails, traffic to Nashville must traverse the Detroit DX link and route via the company's internal private WAN.
- For all traffic from on-premises to the AWS network ( $10.0.0.0/8$ ), both facilities must prefer their respective Direct Connect paths over the Site-to-Site VPN.

Which of the following routing configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

Advertise the $172.16.0.0/16$ prefix from the Detroit factory over the Direct Connect connection, and advertise the same prefix with AS-Path prepending over the Site-to-Site VPN. Additionally, advertise the Nashville $172.17.0.0/16$ prefix with AS-Path prepending from the Detroit factory over its Direct Connect connection.Answer
Configure the customer routers at both Detroit and Nashville to assign a higher BGP Local Preference value to the AWS prefix ( $10.0.0.0/8$ ) received via the Direct Connect connections than the same prefix received via the Site-to-Site VPN.Answer
C
Configure the AWS Transit Gateway route table with a static route for $172.16.0.0/16$ pointing to the Direct Connect Gateway attachment, and another static route for $172.16.0.0/16$ pointing to the VPN attachment with a higher metric.
D
Configure the Transit Gateway to enable Equal-Cost Multi-Path (ECMP) routing, and advertise both the $172.16.0.0/16$ and $172.17.0.0/16$ prefixes from both locations without AS-Path prepending over all Direct Connect and VPN links.
E
Associate the Direct Connect Gateway and the Site-to-Site VPN with separate Transit Gateway route tables, and configure a Route 53 Resolver outbound endpoint to dynamically route traffic based on path latency.

Answer

To establish the desired routing preferences: first, advertise the Detroit prefix over Detroit Direct Connect and with AS-Path prepending over the VPN, while also advertising the Nashville prefix with AS-Path prepending over the Detroit Direct Connect link. Second, configure the on-premises routers to assign a higher BGP Local Preference to the AWS prefix received via the Direct Connect connections.

The correct options ensure optimal BGP routing and failover behavior. Advertising the local Detroit network over the Direct Connect link and with AS-Path prepending over the VPN connection ensures that AWS Transit Gateway prefers the high-bandwidth Direct Connect link under normal operations, and only uses the VPN as a backup. Advertising the Nashville prefix with AS-Path prepending over the Detroit Direct Connect connection provides a backup path to Nashville via the Detroit factory's connection. On the other hand, configuring a higher BGP Local Preference on the customer routers for routes received via the Direct Connect links ensures that on-premises-to-AWS traffic always traverses the Direct Connect path instead of the VPN.

Step-by-Step Solution

Influence inbound AWS-to-on-premises routing for the Detroit site.

Advertise the Detroit prefix over both the Direct Connect connection and the VPN connection, but prepend the AS-Path multiple times on the VPN connection.

AWS Transit Gateway path selection will prefer the Direct Connect route because it has a shorter AS-Path than the VPN route.

Establish backup routing for the Nashville site via the Detroit path.

Advertise the Nashville prefix from the Detroit factory over the Detroit Direct Connect connection with AS-Path prepending.

AWS will route Nashville traffic over the direct Nashville Direct Connect link under normal operations (shorter AS-Path). If the Nashville Direct Connect link fails, AWS will select the next best route, which is the Detroit Direct Connect link (longer AS-Path), and route traffic through the internal WAN.

Influence outbound on-premises-to-AWS routing.

Configure the BGP routers at both locations to set a higher BGP Local Preference for the AWS prefix (

10.0.0.0/8

) received via the Direct Connect links.

BGP Local Preference is evaluated first within the customer autonomous system to determine the outbound path, ensuring that Direct Connect is preferred over the backup VPN.

Key Concept

BGP path selection attributes (AS-Path prepending and Local Preference) are used to influence inbound and outbound traffic paths in hybrid AWS networks utilizing Transit Gateway and Direct Connect.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic