Examkin

Soru

Zorluk: Çok zorInfrastructure Migration with AWS Application Migration Service (MGN)

A multinational retail corporation is migrating 150 legacy on-premises CentOS and Windows servers to AWS. The hybrid network infrastructure consists of a 10 Gbps AWS Direct Connect (DX) connection with a private virtual interface (VIF) terminating on a Direct Connect Gateway (DXGW), which is associated with an AWS Transit Gateway (TGW). The TGW is shared with a dedicated Migration VPC where the staging area subnets for AWS Application Migration Service (MGN) reside. Security policies dictate that all replication traffic must be encrypted, must not traverse the public internet, and the staging area subnets must not have direct internet access. The migration team has installed the AWS Replication Agent on the on-premises servers. However, the replication status for all servers is 'Stalled', and the agents cannot communicate with either the MGN control plane or the staging area replication servers. Which combination of actions should a solutions architect recommend to resolve the connectivity issues and establish private replication?

  1. Establish VPC interface endpoints for the MGN and EC2 services within the Migration VPC. Deploy Route 53 Resolver Inbound Endpoints in the Migration VPC, and configure the on-premises DNS forwarders to redirect MGN and EC2 API queries to these Resolver IP addresses. Adjust the staging area security group in the Migration VPC to allow inbound TCP port 1500 and TCP port 443 from the on-premises server subnet CIDR, and verify that the Transit Gateway route table has active routes routing the on-premises CIDR to the Migration VPC and vice versa.Cevap
  2. B
    Establish VPC interface endpoints for the MGN and EC2 services within the Migration VPC. Deploy Route 53 Resolver Inbound Endpoints in the Migration VPC, and configure the on-premises DNS forwarders to redirect MGN and EC2 API queries to these Resolver IP addresses. Adjust the staging area security group in the Migration VPC to allow inbound TCP port 443 from the on-premises server subnet CIDR, while blocking port 1500 as data replication occurs securely over TLS/SSL on standard HTTPS ports.
  3. C
    Establish VPC interface endpoints for the MGN and EC2 services within the Migration VPC. Associate the private hosted zones for these endpoints directly with the Direct Connect Gateway. Adjust the staging area security group in the Migration VPC to allow inbound TCP port 1500 and TCP port 443 from the on-premises server subnet CIDR. Since the Transit Gateway does not support transitive routing between a Direct Connect Gateway and a VPC endpoint, configure a public virtual interface (VIF) on the Direct Connect connection to bypass the Transit Gateway routing tables.
  4. D
    Establish VPC interface endpoints for the MGN and EC2 services in a shared services VPC. Configure the staging area security group in the Migration VPC to allow inbound TCP port 1500 and TCP port 443 from the on-premises server subnet CIDR. Rely on the default AWS public DNS resolution over the Direct Connect private VIF to resolve the MGN endpoints, and ensure that the private hosted zones created for the interface endpoints are left unassociated with the Migration VPC to prevent routing loops.

Cevap

The correct architecture requires deploying interface VPC endpoints for MGN and EC2, configuring Route 53 Resolver Inbound Endpoints to resolve those endpoints from on-premises, opening inbound TCP ports 1500 and 443 in the staging area security group, and establishing bidirectional routing on the Transit Gateway.
The correct solution addresses all aspects of the communication failure. First, private endpoints for MGN and EC2 provide local private IP addresses for the agents to send API requests without internet access. Second, the Route 53 Resolver Inbound Endpoints resolve the DNS names of these interface endpoints for the on-premises DNS servers. Third, opening TCP port 1500 and TCP port 443 in the staging area security groups satisfies both the control plane (443) and data plane (1500) traffic requirements. Finally, verifying Transit Gateway routing establishes the network paths required to carry the replication traffic between the on-premises data center and the staging subnets in the Migration VPC.

Adım Adım Çözüm

1
Deploy VPC interface endpoints for MGN and EC2 in the Migration VPC.
Establishes private IP addresses within the VPC for agent API communications, eliminating the need to access the public internet.
The replication agent must reach MGN control plane APIs privately to coordinate replication tasks.
2
Create Route 53 Resolver Inbound Endpoints in the Migration VPC and configure on-premises DNS forwarding.
Allows on-premises source servers to resolve the private DNS names of the interface endpoints to their respective private IP addresses in the VPC.
On-premises servers cannot natively resolve AWS Private Hosted Zones without an inbound DNS resolver query path.
3
Open TCP port 1500 and TCP port 443 in the staging area security groups.
Enables data transmission over port 1500 to the replication servers and API communication over port 443.
The replication agent writes blocks directly to replication servers in the staging subnet over port 1500, which must be allowed through the staging area security group.
4
Verify bidirectional routing tables on the AWS Transit Gateway.
Ensures that packet paths between the DXGW and the Migration VPC are defined and active.
Without correct route propagation or static routes in the Transit Gateway route tables, IP packets cannot traverse between the on-premises network and the staging subnets.

Anahtar Kavram

AWS MGN private replication architecture requires control plane access via VPC endpoints (port 443), data plane access to replication servers (port 1500), hybrid DNS resolution via Route 53 Resolver Inbound Endpoints, and hybrid network routing via Direct Connect and Transit Gateway.
Bu soruyu puanla

Konular

Infrastructure Migration with AWS Application Migration Service (MGN)

Bu konudan daha fazla soru