An Amazon EC2 instance is configured with two Elastic Network Interfaces (ENIs). The prima… — AWS Certified SysOps Administrator - Associate

An Amazon EC2 instance is configured with two Elastic Network Interfaces (ENIs). The primary interface ( $eth0$ ) is in Subnet A ( $10.0.1.0/24$ ) and the secondary interface ( $eth1$ ) is in Subnet B ( $10.0.2.0/24$ ). Both subnets are public subnets with default routes ( $0.0.0.0/0$ ) targeting the VPC's Internet Gateway. A SysOps administrator assigns an Elastic IP address to both interfaces. External clients can successfully establish SSH connections to the Elastic IP of $eth0$ . However, SSH connection attempts to the Elastic IP of $eth1$ time out. The administrator verifies that both security groups and network ACLs allow inbound TCP port $22$ and outbound traffic. Which of the following is the root cause of this connectivity failure?

A
The network ACL associated with Subnet B blocks outbound SSH responses due to missing ephemeral port rules.
B
The route table associated with Subnet B is missing a default route ( $0.0.0.0/0$ ) pointing to the Internet Gateway.
C
Subnet B's route table lacks a Gateway VPC endpoint association required to route outbound SSH traffic.
The operating system of the EC2 instance routes all outbound traffic through the default gateway of $eth0$ , causing asymmetric routing for traffic entering $eth1$ .Answer

Answer

The operating system of the EC2 instance routes all outbound traffic through the default gateway of the primary interface (

eth0

), causing asymmetric routing for traffic entering the secondary interface (

eth1

The correct answer is that the operating system of the EC2 instance routes all outbound traffic through the default gateway of the primary interface (

eth0

). When an inbound packet arrives on the secondary interface (

eth1

), the response packet is generated. Because the operating system only has a single default gateway configured for the primary interface (

eth0

), the response is routed out through

eth0

instead of

eth1

. This asymmetric routing causes the connection to time out because the client receives response packets from a different IP address than the one it initiated the connection with, or the VPC routing fabric drops the asymmetric traffic. To resolve this, policy-based routing (source-based routing) must be configured in the OS.

Step-by-Step Solution

Analyze the entry path of the inbound SSH request to the secondary interface (

eth1

The packet successfully reaches the secondary interface (

eth1

) via the Internet Gateway because the subnet's route table, security groups, and network ACLs permit inbound traffic.

Establishing the entry path helps isolate if the problem is inbound blockages or outbound routing.

Examine the operating system routing table of the EC2 instance.

The instance operating system is configured with a single default route (

0.0.0.0/0

) pointing to the gateway of Subnet A via

eth0

Operating systems by default only configure one active default gateway route, even when multiple network interfaces are attached.

Trace the return packet path generated by the EC2 instance.

The operating system sends the response packet out via

eth0

because of the default route, even though the request entered via

eth1

. This constitutes asymmetric routing.

Asymmetric routing causes client-side connection timeouts because the client receives response packets from a different IP address than the one it targeted, or intermediate firewalls drop the packet.

Key Concept

Asymmetric Routing on Multi-homed EC2 Instances

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic