Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

A multinational logistics enterprise is designing a hybrid network architecture for its multi-account environment on AWS. The setup consists of 2020 spoke VPCs in the `us-east-1` Region, all connected via an AWS Transit Gateway (TGW). The primary hybrid connection is a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection terminating at an on-premises data center, routed via a Direct Connect Gateway (DXGW) associated with the TGW. A backup 1.25 Gbps1.25\text{ Gbps} AWS Site-to-Site VPN is established between the on-premises data center and the TGW. The spoke VPCs also require highly available outbound internet access routed through a centralized Shared Services VPC. During initial testing, the operations team observes that outbound traffic from AWS to the on-premises network correctly prefers the Direct Connect path. However, inbound traffic from the on-premises network to the spoke VPCs is routed over the backup VPN connection, causing asymmetric routing and firewall packet drops. Additionally, all internet-bound traffic from the spoke VPCs is currently routed through a single NAT Gateway in the Shared Services VPC. Which combination of actions should the Solutions Architect take to resolve the routing asymmetry and ensure a highly available egress architecture?

  1. A
    Deassociate the spoke VPCs from the Transit Gateway and connect them directly to the Direct Connect Gateway using Private Virtual Interfaces (VIFs) to establish hybrid routing. In the Shared Services VPC, route all internet-bound traffic to a single NAT Gateway located in a single Availability Zone to centralize egress routing and minimize NAT Gateway hourly charges.
  2. Configure the on-premises edge routers to assign a higher BGP local preference attribute to the prefixes received from AWS over the Direct Connect connection compared to the Site-to-Site VPN. In the Shared Services VPC, deploy a NAT Gateway in each Availability Zone where Transit Gateway attachments are present. Configure the subnet route tables containing the Transit Gateway attachments in the Shared Services VPC to route outbound 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway in the same Availability Zone.Answer
  3. C
    Configure the on-premises edge routers to advertise more specific subnet prefixes to AWS over the Site-to-Site VPN connection than over the Direct Connect connection. In the Shared Services VPC, deploy a single NAT Gateway in one Availability Zone, and update the Transit Gateway route table to direct all spoke VPC egress traffic to that single NAT Gateway.
  4. D
    Configure AS Path prepending on the Direct Connect Gateway association on AWS to make the Direct Connect path appear longer to the on-premises network. Create a Route 53 Private Hosted Zone for local DNS resolution in a centralized account without associating it with the spoke VPCs. Route all egress traffic to a single NAT Gateway in the Shared Services VPC.

Answer

Configure the on-premises edge routers to assign a higher BGP local preference attribute to the prefixes received from AWS over the Direct Connect connection compared to the Site-to-Site VPN. In the Shared Services VPC, deploy a NAT Gateway in each Availability Zone where Transit Gateway attachments are present. Configure the subnet route tables containing the Transit Gateway attachments in the Shared Services VPC to route outbound traffic to the NAT Gateway in the same Availability Zone.
The correct solution addresses both the hybrid routing asymmetry and the egress high availability requirements. By default, AWS Transit Gateway prefers Direct Connect paths over VPN paths for outbound traffic. To resolve the inbound asymmetry, the on-premises network must be configured to prefer the Direct Connect path when sending traffic to AWS. Configuring a higher BGP local preference on the on-premises edge routers for prefixes received via Direct Connect achieves this. For the egress path, deploying NAT Gateways in multiple Availability Zones and configuring Transit Gateway attachment subnets to route traffic to the local NAT Gateway in the same zone provides a highly available, fault-tolerant egress architecture.

Step-by-Step Solution

1
Analyze the asymmetric routing behavior.
AWS Transit Gateway automatically prefers the Direct Connect path over VPN for outbound traffic to on-premises because it evaluates propagated routes in the following order of preference: VPC, Direct Connect, VPN. However, the on-premises routers are choosing the VPN path for inbound traffic to AWS.
To ensure symmetric routing, we must influence the BGP path selection on the on-premises side so that the Direct Connect path is preferred for traffic entering AWS.
2
Configure BGP attributes on the on-premises routers.
By assigning a higher BGP local preference to routes received over the Direct Connect connection and a lower local preference to routes received over the VPN connection, the on-premises routers will always select the Direct Connect path as primary.
Local preference is a standard BGP attribute propagated within an Autonomous System to determine the preferred exit point for outbound traffic (which is inbound to AWS).
3
Design highly available egress in the Shared Services VPC.
Deploy a NAT Gateway in each Availability Zone inside the Shared Services VPC.
A single NAT Gateway represents a single point of failure. Deploying one in each Availability Zone provides redundancy.
4
Configure routing for the Shared Services VPC TGW attachments.
Configure the route tables of the subnets containing the Transit Gateway attachments to point the default route to the NAT Gateway within the same Availability Zone.
This keeps egress traffic within the same Availability Zone, avoiding cross-AZ traffic charges and dependency on the availability of a single zone.

Key Concept

BGP route optimization for hybrid routing symmetry and multi-AZ egress design via Transit Gateway
Estimated Time:3m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic