Examkin

Question

Difficulty: Very hardAWS VPN, Direct Connect, and Transit Gateway Management

A company has an AWS Transit Gateway connecting three VPCs to their on-premises datacenter. The network connects to the on-premises network via two paths: a primary path using an AWS Direct Connect connection with a Transit VIF terminating on a Direct Connect Gateway associated with the Transit Gateway, and a backup path using an AWS Site-to-Site VPN connection attached directly to the Transit Gateway. Both connections use BGP to dynamically advertise the on-premises network prefix 10.0.0.0/1610.0.0.0/16. During a failover simulation, the SysOps Administrator notices that traffic destined for the on-premises network continuously routes over the backup Site-to-Site VPN connection even though the Direct Connect path is healthy and operational. Which of the following actions should the SysOps Administrator take to resolve this routing issue? Select two.

  1. Remove any static routes for the on-premises prefix pointing to the Site-to-Site VPN attachment from the Transit Gateway route table.Answer
  2. Ensure that the on-premises router does not advertise more specific prefixes over the Site-to-Site VPN connection than over the Direct Connect connection.Answer
  3. C
    Configure the Transit Gateway route table to increase the BGP Multi-Exit Discriminator (MED) value for the routes received via the Direct Connect Gateway attachment.
  4. D
    Prepend the on-premises Autonomous System Number (ASN) multiple times on the BGP advertisements sent over the Direct Connect connection.
  5. E
    Disable route propagation for the Site-to-Site VPN attachment on the Transit Gateway route table.

Answer

Remove any static routes for the on-premises prefix pointing to the Site-to-Site VPN attachment from the Transit Gateway route table, and ensure that the on-premises router does not advertise more specific prefixes over the Site-to-Site VPN connection than over the Direct Connect connection.
Under normal routing operations on an AWS Transit Gateway, routes are evaluated by prefix length (longest prefix match first) and then by static definition over dynamic propagation. If a static route pointing to the VPN attachment is present, it will always be preferred over dynamically learned BGP routes from a Direct Connect Gateway. Additionally, if the on-premises router advertises more specific subnets over the VPN, the Transit Gateway will forward traffic via the VPN due to longest prefix match. Removing the static route and ensuring identical prefix advertisements over both connections forces the Transit Gateway to use dynamic routing logic, which inherently prefers Direct Connect paths over Site-to-Site VPN paths when the prefix and AS-Path lengths match.

Step-by-Step Solution

1
Inspect the Transit Gateway route tables for static routes.
Identify if a static route to the VPN attachment exists for the prefix.
Static routes override dynamically learned BGP routes regardless of metric or interface type.
2
Remove the identified static route targeting the VPN attachment.
The Transit Gateway route table now evaluates dynamic BGP routing advertisements from both paths.
To allow BGP path selection to determine the active route.
3
Analyze BGP advertisements on the on-premises router.
Verify if prefix lengths differ (e.g., VPN advertising sub-prefixes while Direct Connect advertises the summary prefix).
Longest prefix match is evaluated before routing protocol preferences.
4
Configure uniform prefix advertisements across both interfaces.
Ensure identical prefix lengths are advertised dynamically over both the VPN and Direct Connect paths.
To allow the Transit Gateway to select the Direct Connect path based on default path preferences and AS-Path length.

Key Concept

AWS Transit Gateway route evaluation order and path selection criteria for Direct Connect and Site-to-Site VPN.
Estimated Time:3m 0s
Rate this question

Topics

AWS VPN, Direct Connect, and Transit Gateway Management

More questions from this topic