Examkin

Question

Difficulty: MediumAWS VPN, Direct Connect, and Transit Gateway Management

A company uses an AWS Transit Gateway to connect multiple VPCs to its on-premises network. Hybrid connectivity is established using a 1 Gbps1\text{ Gbps} AWS Direct Connect connection (via a Transit VIF and a Direct Connect Gateway) as the primary path, and an AWS Site-to-Site VPN connection as the backup path. The administrator configures dynamic BGP routing on the Direct Connect connection, which dynamically propagates the on-premises prefix 192.168.0.0/16192.168.0.0/16 to the Transit Gateway route table. The Site-to-Site VPN is configured with a static route for 192.168.0.0/16192.168.0.0/16 pointing to the VPN attachment in the Transit Gateway route table. During a failover test, the administrator observes that all outbound traffic destined for the on-premises network continues to be sent over the backup VPN connection, even though the Direct Connect connection is fully operational. Which of the following actions will ensure that the Transit Gateway routes traffic to the on-premises network via the Direct Connect connection as the primary path under normal operating conditions?

  1. Reconfigure the Site-to-Site VPN connection to use dynamic BGP routing, propagate the on-premises prefix to the Transit Gateway route table, and delete the static route pointing to the VPN attachment.Answer
  2. B
    Update the VPC subnet route tables to direct the 192.168.0.0/16192.168.0.0/16 prefix directly to the Direct Connect Gateway target rather than the Transit Gateway.
  3. C
    Configure BGP path prepending on the customer gateway to increase the AS-Path length of the static VPN connection route advertised to the Transit Gateway.
  4. D
    Deploy an AWS NAT Gateway in a public subnet within each VPC and update the subnet route tables to forward all 192.168.0.0/16192.168.0.0/16 traffic through the NAT Gateway.

Answer

Reconfigure the Site-to-Site VPN connection to use dynamic BGP routing, propagate the on-premises prefix to the Transit Gateway route table, and delete the static route pointing to the VPN attachment.
AWS Transit Gateway route tables evaluate routes by prioritizing static routes over dynamically propagated routes. Because the Site-to-Site VPN was configured with a static route, it overrode the dynamically propagated Direct Connect route. Reconfiguring the VPN to use dynamic BGP routing and deleting the static route allows both attachments to propagate the prefix dynamically. Transit Gateway then defaults to selecting the Direct Connect gateway attachment over the Site-to-Site VPN attachment for identical propagated prefixes.

Step-by-Step Solution

1
Analyze the Transit Gateway route evaluation rules.
AWS Transit Gateway route tables prioritize static routes over dynamically propagated routes for the same destination prefix.
This explains why the static route pointing to the VPN attachment is being preferred over the dynamic BGP route propagated by the Direct Connect connection.
2
Determine the required configuration change to place both routes on equal evaluation terms.
The Site-to-Site VPN must be converted to use dynamic BGP routing and the static route must be deleted from the Transit Gateway route table.
This allows the Transit Gateway to evaluate both paths as dynamically propagated routes.
3
Apply the default Transit Gateway route selection behavior for propagated routes.
The Transit Gateway automatically prefers the Direct Connect Gateway path over the Site-to-Site VPN path for the identical propagated prefix.
This ensures the Direct Connect connection serves as the primary path and the VPN automatically serves as the backup path.

Key Concept

AWS Transit Gateway Route Table Precedence (Static vs. Propagated Routes)
Rate this question

Topics

AWS VPN, Direct Connect, and Transit Gateway Management

More questions from this topic