Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

An automotive manufacturer is establishing a hybrid network to connect its on-premises assembly plant's industrial control systems to a multi-account AWS environment consisting of 2525 spoke VPCs in the `us-east-1` region under an AWS Organization. The network architecture requires: (1) High-speed, low-latency primary connectivity using a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection terminating at a Direct Connect Gateway (DXGW). (2) An IPsec Site-to-Site VPN connection terminating on an AWS Transit Gateway (TGW) to serve as a passive backup. (3) Transitive routing between all 2525 spoke VPCs and the on-premises network. (4) Minimal administrative overhead for routing table updates. (5) Symmetrical routing where the DX path is strictly preferred for both inbound and outbound traffic, and the VPN is only utilized during a DX outage. Which configuration meets these requirements?

  1. Share the central Transit Gateway (TGW) with the spoke accounts using AWS Resource Access Manager (RAM), and attach the spoke VPCs to the TGW. Associate the TGW with the Direct Connect Gateway (DXGW) using a transit virtual interface (Transit VIF), and attach the Site-to-Site VPN to the TGW. Enable BGP propagation for both attachments in the TGW route table. On the customer gateway, prepend the autonomous system number (ASN) on the VPN BGP path advertised to AWS, and set a higher BGP local preference for AWS routes received via the Direct Connect connection.Answer
  2. B
    Associate the 2525 spoke VPCs directly with the DXGW, and configure a Site-to-Site VPN connection using a Virtual Private Gateway (VGW) in each spoke VPC. Enable BGP routing on all VGWs and the DXGW. On the customer gateway, configure the BGP community values to prioritize the Direct Connect path over the VPN paths for inbound and outbound traffic.
  3. C
    Share the central Transit Gateway (TGW) with the spoke accounts using AWS Resource Access Manager (RAM), and attach the spoke VPCs to the TGW. Associate the TGW with the DXGW, and attach the Site-to-Site VPN to the TGW. To enable on-premises DNS resolution, associate the central account's Route 53 Private Hosted Zone (PHZ) with the Transit Gateway, relying on TGW propagation to share the DNS records with all spoke VPCs.
  4. D
    Attach the spoke VPCs to the TGW. Create a central egress VPC with a single NAT Gateway to handle outbound internet traffic and peer the egress VPC with the TGW. Associate the TGW with the DXGW and configure static routes in the TGW route table pointing to the DXGW with a metric of 10, and static routes pointing to the VPN attachment with a metric of 50 to establish the primary and backup path relationship.

Answer

Share the central Transit Gateway (TGW) with the spoke accounts using AWS Resource Access Manager (RAM), and attach the spoke VPCs to the TGW. Associate the TGW with the Direct Connect Gateway (DXGW) using a transit virtual interface (Transit VIF), and attach the Site-to-Site VPN to the TGW. Enable BGP propagation for both attachments in the TGW route table. On the customer gateway, prepend the autonomous system number (ASN) on the VPN BGP path advertised to AWS, and set a higher BGP local preference for AWS routes received via the Direct Connect connection.
The correct configuration leverages AWS RAM to share a central TGW, which satisfies the requirement for transitive routing between all 25 spoke VPCs and the on-premises network while keeping administrative overhead low. To establish active/passive symmetric routing with BGP, path attributes must be configured on both sides: prepending the customer gateway ASN on the VPN path ensures that AWS TGW prefers the shorter AS_PATH of the Direct Connect path for outbound traffic, while setting a higher Local Preference on the customer gateway ensures on-premises routers prefer the Direct Connect path for inbound traffic.

Step-by-Step Solution

1
Evaluate spoke-to-spoke and hybrid transit requirements.
Determine that AWS Transit Gateway (TGW) shared via AWS Resource Access Manager (RAM) is required to interconnect 25 spoke VPCs transitively and connect them to on-premises networks with minimal administrative overhead.
Direct Connect Gateway alone does not support transitive VPC-to-VPC routing, and managing 25 individual VGWs is administratively complex.
2
Configure AWS Transit Gateway routing for outbound traffic (AWS to on-premises).
Enable BGP propagation on both the DXGW and VPN attachments. To make TGW prefer the DX path, configure AS Path prepending on the customer gateway's BGP advertisement over the VPN connection.
Since TGW evaluates propagated routes with the same prefix length, it prefers the path with the shortest AS_PATH. Prepending the CGW ASN on the VPN path makes the AS_PATH longer, forcing TGW to prefer the Direct Connect path.
3
Configure on-premises routing for inbound traffic (on-premises to AWS).
Configure the customer gateway router to assign a higher Local Preference to BGP routes received from the Direct Connect connection compared to those received from the VPN.
Local Preference is a BGP attribute evaluated first by the customer gateway router to determine the exit path from the on-premises network, ensuring that traffic to AWS prefers the DX link.

Key Concept

Symmetric hybrid routing failover using AWS Transit Gateway with Direct Connect and Site-to-Site VPN
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic