Examkin

Question

Difficulty: MediumAWS VPN, Direct Connect, and Transit Gateway Management

A SysOps Administrator is migrating hybrid connectivity for a company's AWS environment. Currently, an on-premises data center is connected to a single VPC via an AWS Site-to-Site VPN attached to a Virtual Private Gateway (VGW). To support connectivity to multiple new VPCs, the administrator deploys an AWS Transit Gateway, attaches the existing VPC to the Transit Gateway, and establishes a new Site-to-Site VPN connection terminating on the Transit Gateway. The IPsec tunnels are successfully established and show as UP, but EC2 instances in the VPC are unable to reach the on-premises network. Which of the following is the most likely cause of this issue?

  1. A
    The Security Group associated with the EC2 instances does not contain an outbound rule to allow ephemeral ports (10241024-6553565535) for response traffic from the on-premises network.
  2. B
    The customer gateway (CGW) configuration on the AWS side must be deleted and recreated because a CGW can only be associated with one active VPN connection at a time.
  3. The VPC subnet route tables have not been updated to direct traffic destined for the on-premises network to the Transit Gateway attachment.Answer
  4. D
    The Transit Gateway route table lacks a route propagation association for the VPC attachment, preventing the VPC from learning the on-premises routes.

Answer

The VPC subnet route tables have not been updated to direct traffic destined for the on-premises network to the Transit Gateway attachment.
The correct option is correct because when migrating VPN termination from a Virtual Private Gateway (VGW) to an AWS Transit Gateway (TGW), VPC subnet route tables do not automatically update their targets. The static or propagated routes pointing to the VGW (vgw-xxxx) must be manually updated to target the Transit Gateway attachment (tgw-attach-xxxx) to ensure outbound traffic is successfully routed to the Transit Gateway.

Step-by-Step Solution

1
Analyze the physical layer and connection status of the VPN.
The VPN tunnels are established and UP, confirming that the physical/tunnel connection between on-premises and AWS is operational.
This rules out direct VPN establishment errors or CGW configuration issues on the physical link.
2
Examine the VPC routing path to the on-premises network.
The EC2 instances in the subnets rely on the VPC subnet route tables to direct traffic. If these tables still reference the old Virtual Private Gateway (VGW) instead of the new Transit Gateway (TGW) attachment, traffic destinies fail.
Subnet route tables must be explicitly updated to point traffic destined for the on-premises CIDR block to the TGW attachment ID.
3
Verify return routing from the Transit Gateway back to the VPC.
The Transit Gateway route tables route traffic from the VPN attachment to the VPC attachment, but this only functions if traffic actually reaches the Transit Gateway from the VPC first.
VPC routing takes precedence, and VPC subnet route tables do not automatically propagate routes from the Transit Gateway.

Key Concept

AWS Transit Gateway VPC routing behavior requires static route additions in VPC subnet route tables to direct traffic to the Transit Gateway attachment.
Rate this question

Topics

AWS VPN, Direct Connect, and Transit Gateway Management

More questions from this topic