Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

An enterprise is migrating its legacy database and application servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The on-premises network is connected to a staging VPC in AWS via an AWS Direct Connect connection attached to an AWS Transit Gateway. Immediately after installing the AWS Replication Agent on the on-premises servers, the migration console shows the replication status as stalled. The on-premises servers cannot establish communication with the replication servers in the staging VPC or the MGN control plane. Which TWO of the following actions must the solutions architect take to resolve this issue and start replication? (Select TWO)

  1. Configure the security group of the staging area in the staging VPC to allow inbound traffic on TCP port 1500 from the on-premises CIDR block, and ensure the on-premises firewall allows outbound traffic on TCP port 1500 to the staging VPC CIDR block.Answer
  2. Ensure that the on-premises servers can resolve and access the AWS Application Migration Service regional endpoints over HTTPS port 443, updating the on-premises firewall to allow outbound port 443 traffic if necessary.Answer
  3. C
    Modify the target VPC security group to allow inbound traffic on TCP port 1500, and configure the on-premises agents to use a custom port for data replication to bypass the on-premises firewall.
  4. D
    Configure a Direct Connect gateway to handle transitive routing between the target VPC and the staging VPC without using the Transit Gateway, and update the on-premises firewall to permit all traffic over UDP port 1500.

Answer

To resolve the stalled replication, the solutions architect must allow inbound TCP port 1500 on the staging area security groups from the on-premises network, allow outbound TCP port 1500 traffic on the on-premises firewall, and verify that the on-premises servers can connect to the regional MGN control plane endpoints over HTTPS port 443.
The AWS Replication Agent relies on two network paths to start replication: HTTPS (port 443) outbound to the MGN regional control plane service endpoints to authenticate and pull configurations, and TCP port 1500 to push block-level data to the replication servers in the staging VPC. Allowing inbound TCP port 1500 on the staging area security group from the on-premises network and enabling outbound port 443 on the on-premises firewall resolves both communication failures.

Step-by-Step Solution

1
Examine the outbound rules on the on-premises firewall and the inbound rules on the staging area security group in the staging VPC.
Identify that TCP port 1500 replication traffic is blocked between the on-premises servers and the replication servers.
Data replication requires a clear network path over TCP port 1500 to send disk block changes.
2
Review DNS resolution and network access from the on-premises servers to the AWS Application Migration Service control plane regional endpoints.
Ensure port 443 outbound to mgn.<region>.amazonaws.com is allowed.
The replication agent cannot register or receive configuration without control plane access over HTTPS port 443.

Key Concept

AWS Application Migration Service (MGN) network configuration requirements for replication and control plane connectivity.
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic