A multinational corporation operates a multi-account AWS environment. VPCs in the 'us-east… — AWS Certified Solutions Architect - Professional

A multinational corporation operates a multi-account AWS environment. VPCs in the 'us-east-1' region use the CIDR block $10.10.0.0/16$ , while VPCs in the 'us-west-2' region use the CIDR block $10.20.0.0/16$ . Each region has an AWS Transit Gateway (TGW) managing local VPC traffic, and the two TGWs are peered.

The company is setting up hybrid connectivity to its on-premises data center (CIDR $172.16.0.0/12$ ) with the following requirements:
- A $10\text{ Gbps}$ AWS Direct Connect (DX) connection with a Transit VIF terminates on a Direct Connect Gateway (DXGW) associated with the 'us-east-1' TGW. This is the primary path.
- An AWS Site-to-Site VPN connection is terminated on the 'us-west-2' TGW as a backup.
- Under normal operations, all traffic between both AWS regions and the data center must use the DX connection.
- If the DX connection or the 'us-east-1' TGW fails, all traffic must automatically fail over to the VPN connection.
- Active-active asymmetric routing must be prevented; the on-premises routers must prefer the DX path over the VPN path for all inbound AWS traffic.

Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

Associate the Direct Connect Gateway (DXGW) with both Transit Gateways. In each Transit Gateway route table, propagate the routes from both the DXGW attachment and the respective local Site-to-Site VPN attachment.Answer
B
Use AWS Resource Access Manager (RAM) to share the Direct Connect Transit VIF directly with the spoke VPCs to bypass the Transit Gateways, and configure static route tables in the VPCs for failover.
Configure AS Path prepending on both AWS Site-to-Site VPN connections to advertise the local VPC CIDR with a longer AS path to the on-premises customer gateway.Answer
D
Configure the customer gateway to advertise more specific subnets of the on-premises network (e.g., $172.16.0.0/13$ ) over the VPN connection and a summary subnet (e.g., $172.16.0.0/12$ ) over the Direct Connect connection.
E
Create a Route 53 Private Hosted Zone for the on-premises domain, associate it with all VPCs in both regions, and configure failover routing policies pointing to the VPN public IP addresses as the primary path.

Answer

The correct configurations are: associating the Direct Connect Gateway (DXGW) with both Transit Gateways and propagating the routes from both the DXGW and VPN attachments; and configuring AS Path prepending on both AWS Site-to-Site VPN connections.

Associating the Direct Connect Gateway (DXGW) with both Transit Gateways and propagating the routes from both the DXGW attachment and the VPN attachment ensures that the Transit Gateways dynamically route outbound traffic. By default, Transit Gateway prefers Direct Connect over VPN when identical prefix lengths are propagated via BGP. Configuring AS Path prepending on the VPN connection causes the on-premises router to receive a longer AS path for VPN routes, forcing it to prefer the Direct Connect path for inbound traffic, thus preventing asymmetric routing.

Step-by-Step Solution

Analyze the path preference requirements from AWS to on-premises.

AWS Transit Gateway route evaluation order prefers Direct Connect Gateway propagated routes over VPN propagated routes for identical prefix lengths.

This allows for automatic, dynamic failover at Layer 3 without static routing or administrative overhead.

Establish DXGW associations for both regions.

Associate the DXGW with the TGW in 'us-east-1' and the TGW in 'us-west-2', enabling direct access to the DX connection from both regions.

This avoids routing 'us-west-2' traffic through the peered TGW to 'us-east-1' under normal operations, reducing cross-region transit charges and eliminating a single point of failure.

Configure path selection on-premises to prevent asymmetric routing.

Apply AS Path prepending on the Site-to-Site VPN connection on the AWS side.

By lengthening the AS Path advertised over the VPN, the customer gateway will prefer the shorter AS Path advertised via Direct Connect, ensuring symmetric routing over the primary link.

Key Concept

Redundant hybrid networking path selection using Direct Connect and VPN with AWS Transit Gateway, utilizing BGP AS Path prepending and TGW route preference rules.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic