A pharmaceutical company has deployed 12 VPCs in a single AWS region under a multi-account organization. The company needs to establish hybrid connectivity between all 12 VPCs and its on-premises data center. The connectivity design must use a 2 Gbps AWS Direct Connect connection as the primary path and an AWS Site-to-Site VPN connection over the public internet as a backup path. The failover between the primary and backup paths must be automatic, and the network team wants to minimize the administrative overhead of managing route tables. Which configuration meets these requirements with the least administrative effort?
- AConfigure VPC peering between a central transit VPC and the other 11 spoke VPCs. Deploy a pair of software VPN appliances in the transit VPC, and establish the Direct Connect and Site-to-Site VPN connections to these appliances. Configure the routing tables in the spoke VPCs to route on-premises traffic through the peering connections to the transit VPC.
- BCreate an AWS Transit Gateway and attach all 12 VPCs. Connect the Transit Gateway to a Direct Connect Gateway using a transit virtual interface. Create a Transit Gateway VPN attachment for the Site-to-Site VPN. Add a static route in the Transit Gateway route table pointing to the Direct Connect Gateway attachment, and add a backup static route with a higher administrative distance pointing to the VPN attachment.
- Create an AWS Transit Gateway and attach all 12 VPCs. Connect the Transit Gateway to a Direct Connect Gateway using a transit virtual interface. Create a Transit Gateway VPN attachment for the Site-to-Site VPN. Configure BGP on both the Direct Connect and VPN connections to advertise the same on-premises prefixes. On the on-premises router, use BGP local preference to prefer the Direct Connect path for outbound traffic to AWS.Answer
- DCreate a Virtual Private Gateway in each of the 12 VPCs. Configure a private virtual interface on the Direct Connect connection and a Site-to-Site VPN connection for each Virtual Private Gateway. Configure BGP routing on each connection to advertise the same prefixes, and configure the on-premises router to prefer the Direct Connect path.
Answer
The correct architecture uses AWS Transit Gateway to centralize VPC attachments, connects it to a Direct Connect Gateway using a transit virtual interface, and creates a Transit Gateway VPN attachment. By using BGP on both paths to advertise identical on-premises prefixes, Transit Gateway naturally prefers the Direct Connect path over the VPN path for AWS-to-on-premises traffic. Configuring BGP local preference on the customer gateway ensures that on-premises-to-AWS traffic also prefers the Direct Connect path.
The correct design uses AWS Transit Gateway to centralize VPC connections. Connecting the Transit Gateway to a Direct Connect Gateway via a transit virtual interface and establishing a Site-to-Site VPN attachment allows both paths to run BGP. When identical prefixes are advertised, AWS Transit Gateway naturally prioritizes the Direct Connect Gateway path over the VPN path for AWS-to-on-premises traffic. Setting BGP local preference on the customer gateway router ensures that on-premises-to-AWS traffic also prefers the Direct Connect path, ensuring symmetric routing and automatic failover with minimal administration.
Step-by-Step Solution
Key Concept
AWS Transit Gateway automatically prioritizes routes propagated from a Direct Connect Gateway over those from a Site-to-Site VPN when identical prefixes are advertised. Symmetrical routing is completed by configuring BGP attributes (such as local preference) on the on-premises customer gateway.
Estimated Time:2m 0s