Examkin

Question

Difficulty: MediumAWS VPN, Direct Connect, and Transit Gateway Management

A company is connecting its on-premises network to AWS using a 1 Gbps1\text{ Gbps} AWS Direct Connect connection via an AWS Transit Gateway and a Direct Connect Gateway. To ensure high availability, the company sets up an AWS Site-to-Site VPN connection to the same Transit Gateway as a backup path. The company wants to ensure that all traffic between the VPCs and the on-premises network automatically uses the Direct Connect connection under normal conditions, and only fails over to the VPN if the Direct Connect connection becomes unavailable. Which TWO configuration steps must the SysOps Administrator perform to achieve this routing behavior? (Select TWO.)

  1. Configure the on-premises router to advertise the same network prefixes to both the Direct Connect BGP session and the Site-to-Site VPN BGP session, prepending the AS path on the VPN advertisements.Answer
  2. In the VPC subnet route tables, add a route for the on-premises IP address range targeting the Transit Gateway.Answer
  3. C
    In the Transit Gateway route table, add a static route for the on-premises network pointing to the VPN attachment with a longer prefix match than the Direct Connect gateway attachment.
  4. D
    In the VPC subnet route tables, add a route for the on-premises IP address range pointing directly to the customer gateway IP address of the VPN connection.
  5. E
    Deploy a NAT Gateway in a public subnet and route all traffic destined for the on-premises network through the NAT Gateway to prevent BGP routing conflicts.

Answer

To configure the failover routing, the SysOps Administrator must advertise the same on-premises prefixes over both paths while prepending the AS path on the VPN BGP advertisements so that AWS prefers the Direct Connect path. Additionally, they must add a route in the VPC subnet route tables pointing to the Transit Gateway for the on-premises IP range to ensure VPC resources can reach the on-premises network.
Prepend the AS path on the VPN BGP advertisements to ensure that AWS Transit Gateway views the VPN route as less desirable than the Direct Connect route. In addition, the VPC subnet route tables must be configured with a route pointing to the Transit Gateway so that traffic from the VPC can reach the Transit Gateway and be sent to the on-premises network.

Step-by-Step Solution

1
Configure dynamic BGP routing advertisements on-premises.
The on-premises router advertises identical CIDR blocks to both Direct Connect and VPN BGP sessions, but with the AS path prepended on the VPN advertisements.
This configuration forces the AWS Transit Gateway to prefer the shorter AS path of the Direct Connect connection for traffic heading from AWS to the on-premises data center.
2
Configure VPC subnet routing.
A route targeting the Transit Gateway for the on-premises IP address range is added to the VPC subnet route tables.
This ensures that instances inside the VPC subnets send their outbound hybrid traffic to the Transit Gateway, which then handles path selection.

Key Concept

AWS Transit Gateway BGP path selection and routing precedence for Direct Connect and Site-to-Site VPN failover.
Rate this question

Topics

AWS VPN, Direct Connect, and Transit Gateway Management

More questions from this topic