Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

An organization manages a multi-account AWS environment with 1212 spoke VPCs in the `eu-west-1` Region and 88 spoke VPCs in the `eu-central-1` Region. Spoke VPCs in each region are connected to a regional AWS Transit Gateway (TGW), and the two TGWs are peered. The organization is setting up hybrid connectivity to their on-premises data center. They want to implement a highly resilient design using a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection as the primary path and an AWS Site-to-Site VPN connection as an active-passive backup. The design must ensure that the VPN connection only carries traffic if the DX connection fails, and it must avoid asymmetric routing.

Which TWO configurations must a Solutions Architect implement to meet these requirements?

  1. Associate the Direct Connect Gateway (DXGW) with the Transit Gateway in each region, and configure BGP sessions over a Transit Virtual Interface (Transit VIF).Answer
  2. Establish Site-to-Site VPN connections to the Transit Gateways, and configure the on-premises router to set a higher BGP Local Preference for routes received via Direct Connect compared to the VPN.Answer
  3. C
    Configure static routes in the Transit Gateway route tables pointing to the VPN attachments, while enabling BGP route propagation for the Direct Connect Gateway association.
  4. D
    Associate the Direct Connect Gateway with the Transit Gateway peering attachment to enable transitive cross-region routing.
  5. E
    Configure the on-premises router to prepend its autonomous system (AS) path multiple times when advertising prefixes over the Direct Connect connection.

Answer

Associate the Direct Connect Gateway with the Transit Gateway in each region, and configure the on-premises router to set a higher BGP Local Preference for routes received via Direct Connect compared to the VPN.
The correct architecture uses a Direct Connect Gateway associated with regional Transit Gateways via a Transit VIF. For traffic leaving the on-premises data center to AWS, setting a higher BGP Local Preference for prefixes received over Direct Connect ensures that the data center router prefers the Direct Connect path. For traffic leaving AWS to on-premises, AWS automatically prefers Direct Connect over VPN for identical BGP-propagated prefixes, avoiding asymmetric routing.

Step-by-Step Solution

1
Analyze how to establish multi-region, multi-account hybrid connectivity for the Transit Gateways.
Associate the Direct Connect Gateway (DXGW) with the Transit Gateway in each region using a Transit Virtual Interface (Transit VIF) to support scalable routing across regions.
Direct Connect Gateway allows a single DX connection to be shared across multiple Transit Gateways in different AWS Regions.
2
Determine the proper configuration to ensure that the on-premises data center prefers sending traffic via the Direct Connect connection rather than the VPN.
Configure the customer gateway router to assign a higher Local Preference to the BGP routes received over the Direct Connect path.
Local Preference is the primary BGP attribute used to influence outbound traffic paths from an autonomous system. Setting a higher value for DX routes ensures they are preferred over VPN routes.
3
Ensure that AWS prefers sending traffic to on-premises via Direct Connect rather than VPN.
Ensure BGP route propagation is enabled for both connections without static route overrides.
AWS naturally prefers Direct Connect paths over VPN paths when identical prefixes are received via BGP, so no additional AWS-side route prepending or path tuning is strictly required, provided static routes do not override the BGP path.

Key Concept

To establish a highly available hybrid network with AWS Transit Gateway, a Direct Connect Gateway associated with Transit Gateways via a Transit VIF provides primary routing, while a Site-to-Site VPN provides backup. Proper BGP configuration (such as Local Preference on-premises) is required to control traffic symmetry and failover priority without relying on static route overrides which would disrupt dynamic failover.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic