Examkin

Question

Difficulty: MediumInfrastructure Migration with AWS Application Migration Service (MGN)

A pharmaceutical company is migrating its core inventory management system, consisting of 10 on-premises virtual machines, to AWS using AWS Application Migration Service (MGN). The migration network path utilizes a secure IPSec VPN connection terminating on an AWS Transit Gateway, which is associated with a staging VPC. After installing the AWS Replication Agent on the source servers, the replication status displays as stalled. The on-premises network monitoring tools show that the replication agents are failing to communicate with the replication servers in the staging VPC subnet. Which of the following is the most direct and necessary configuration change to resolve this replication issue?

  1. Adjust the on-premises firewall policies to permit outbound traffic on TCP port 1500 to the staging subnet CIDR, and configure the staging area's security group to allow inbound traffic on TCP port 1500 from the on-premises network.Answer
  2. B
    Modify the Transit Gateway route tables to establish transitive VPC-to-VPC routing for the replication traffic, and replace the VPN with a Direct Connect gateway configuration to handle the data flow without Transit Gateway attachment.
  3. C
    Create a Route 53 private hosted zone for the MGN replication endpoint in the staging VPC, and ensure that this private hosted zone is associated with all local and remote VPCs to resolve the endpoint address.
  4. D
    Deploy a single NAT Gateway in the staging VPC to route the replication traffic, and update the routing tables of all staging subnets to route outbound replication traffic destined for the on-premises network through this NAT Gateway.

Answer

Adjust the on-premises firewall policies to permit outbound traffic on TCP port 1500 to the staging subnet CIDR, and configure the staging area's security group to allow inbound traffic on TCP port 1500 from the on-premises network.
AWS Application Migration Service uses TCP port 1500 for continuous replication of data blocks from the on-premises AWS Replication Agent to the replication servers in the staging area. Restricting this port blocks the replication stream, causing a stalled state. Adjusting the on-premises firewall and staging area security group resolves this block.

Step-by-Step Solution

1
Identify the data replication port required by the AWS Replication Agent.
Determine that the AWS Replication Agent requires TCP port 1500 to communicate with the replication servers.
This is the default and mandatory port used by AWS Application Migration Service for data transit.
2
Examine firewall configurations on both the source and destination networks.
Identify that the firewall on-premises and the staging area security groups must explicitly allow TCP port 1500 traffic.
Security controls must be aligned to prevent packets from being dropped at either end of the VPN tunnel.
3
Apply the rule changes to allow communication.
The replication agent establishes a connection, changing the replication status from stalled to active synchronization.
Allowing the port permits the control and data channel to be successfully initialized.

Key Concept

Replication Agent network requirements for AWS Application Migration Service (MGN)
Rate this question

Topics

Infrastructure Migration with AWS Application Migration Service (MGN)

More questions from this topic