Examkin

Question

Difficulty: Very hardHybrid and Multi-Account Network Connectivity Design

A financial services company is establishing a multi-account, multi-region AWS environment. In the primary Region (`us-east-1`), they have deployed a central AWS Transit Gateway (TGW) to interconnect 1515 spoke VPCs. To connect their main on-premises data center to AWS, they deploy a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection terminating at a Direct Connect Gateway (DXGW) associated with the TGW. For high availability, they also configure an IPsec AWS Site-to-Site VPN terminating directly on the same TGW as a backup. The network team requires symmetric routing: all traffic between AWS and the on-premises data center must utilize the DX connection during normal operation, failing over to the VPN only if the DX link becomes unavailable. The on-premises network uses the prefix 10.0.0.0/810.0.0.0/8, which must be reachable from AWS, and on-premises systems must reach resources in the AWS VPCs. The solution must minimize administrative overhead and rely on dynamic routing protocols where possible. Which TWO configurations will achieve this routing policy while preventing asymmetric traffic flows? (Select TWO.)

  1. Configure the customer gateway (CGW) to advertise the 10.0.0.0/810.0.0.0/8 prefix over the Direct Connect connection, and advertise the same 10.0.0.0/810.0.0.0/8 prefix over the Site-to-Site VPN connection with its own Autonomous System Number (ASN) prepended at least three times in the AS-Path.Answer
  2. Configure the CGW to assign a higher BGP Local Preference value to AWS prefixes received over the Direct Connect connection than to those received over the Site-to-Site VPN connection.Answer
  3. C
    Create static routes for 10.0.0.0/810.0.0.0/8 pointing to the VPN attachment in the Transit Gateway route table, and configure dynamic propagation for the Direct Connect Gateway attachment.
  4. D
    Configure the CGW to advertise the 10.0.0.0/810.0.0.0/8 prefix over the Direct Connect connection, and advertise a more specific prefix such as 10.0.0.0/910.0.0.0/9 over the VPN connection.
  5. E
    Associate a Route 53 Private Hosted Zone (PHZ) for on-premises DNS resolution with the primary transit VPC only, and configure a single NAT Gateway in that VPC to route all failover traffic to the customer gateway.

Answer

Configure the customer gateway (CGW) to prepend its own ASN at least three times when advertising the prefix over the Site-to-Site VPN, and assign a higher BGP Local Preference value to AWS prefixes received over the Direct Connect connection compared to the VPN on the CGW.
To achieve symmetric routing, both paths must prefer the Direct Connect connection under normal conditions. AWS Transit Gateway evaluates the AS-Path length for BGP advertised prefixes. By prepending the customer gateway's ASN multiple times on the VPN connection, AWS Transit Gateway will see a longer AS-Path and select the Direct Connect path as the active route. For return traffic, configuring the customer gateway to assign a higher BGP Local Preference value to prefixes received via Direct Connect ensures that traffic originating from the on-premises network to AWS exits via the Direct Connect connection.

Step-by-Step Solution

1
Determine how to influence outbound traffic from AWS to the on-premises network.
Evaluate AWS Transit Gateway's path selection process: Transit Gateway evaluates AS-Path length first when comparing identical prefixes.
To ensure Direct Connect is preferred, the Site-to-Site VPN path must be configured with a longer AS-Path using AS-Path prepending on the customer gateway.
2
Determine how to influence inbound traffic from the on-premises network to AWS.
Identify that the customer gateway will receive identical AWS VPC prefixes from both the Direct Connect connection and the VPN connection.
Since the local router decides how to reach AWS, BGP attributes must be tuned on the on-premises side.
3
Apply BGP Local Preference on the customer gateway.
Configure a higher Local Preference (e.g., 200200) for prefixes received over Direct Connect compared to those received over VPN (e.g., 100100).
In BGP path selection, Local Preference is the highest-priority attribute processed locally within an AS, ensuring that all outbound traffic to AWS exits via the Direct Connect connection.

Key Concept

Ensuring symmetric routing in hybrid network environments with AWS Transit Gateway, Direct Connect, and VPN backup using BGP path attributes.
Estimated Time:3m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic