Examkin

Soru

Zorluk: ZorHybrid and Multi-Account Network Connectivity Design

An enterprise has a multi-account AWS environment with 3030 spoke VPCs distributed across 22 regions: `us-east-1` (2020 VPCs) and `us-west-2` (1010 VPCs). The enterprise needs to connect these VPCs to two on-premises locations: a primary data center in New York and a backup data center in San Francisco.

The primary data center in New York has a 10 Gbps10\text{ Gbps} AWS Direct Connect connection. The backup data center in San Francisco has an internet connection capable of establishing IPsec VPN tunnels. The network architecture must ensure:
- High availability: If the primary New York Direct Connect connection or New York data center fails, hybrid traffic must automatically fail over to the San Francisco VPN connection.
- Symmetric routing: Traffic from AWS to the on-premises network must prefer the New York Direct Connect path under normal operations.
- Scalability: The solution must minimize administrative overhead and avoid configuring individual connections to every spoke VPC.

Which TWO configuration steps must be implemented to meet these requirements?

  1. Configure a Direct Connect Gateway (DXGW) and associate it with the Transit Gateways (TGWs) deployed in both `us-east-1` and `us-west-2`. Create a transit virtual interface (transit VIF) on the New York Direct Connect connection and terminate it on the DXGW.Cevap
  2. Establish AWS Site-to-Site VPN connections from the San Francisco customer gateway to the Transit Gateways in both `us-east-1` and `us-west-2`. Configure the San Francisco customer gateway to advertise the on-premises IP ranges via BGP with multiple AS-Path prepends.Cevap
  3. C
    Associate the Direct Connect Gateway (DXGW) directly with the Virtual Private Gateways (VGWs) of all 3030 spoke VPCs. Terminate the New York Direct Connect connection on the DXGW using a private virtual interface (private VIF).
  4. D
    Create a Route 53 Private Hosted Zone (PHZ) in the primary network account to resolve on-premises hostnames, and rely on Transit Gateway routing and BGP propagation to automatically share and resolve DNS queries in all 3030 spoke VPCs.
  5. E
    Deploy a single centralized NAT Gateway in a shared services subnet within a single Availability Zone in `us-east-1`. Point all Transit Gateway route tables to this NAT Gateway to handle hybrid traffic failover and outbound internet connectivity.

Cevap

The correct configurations are to set up a Direct Connect Gateway associated with Transit Gateways in both regions using a transit VIF for the primary path, and to establish Site-to-Site VPN connections from the backup site to the Transit Gateways while prepending AS paths to ensure the VPN is passive.
The correct solution involves deploying a Transit Gateway (TGW) in each region and associating them with a central Direct Connect Gateway (DXGW) using a transit virtual interface (transit VIF) for the primary connection from New York. For backup connectivity from San Francisco, Site-to-Site VPN connections are established to both TGWs, with BGP AS-Path prepending configured on the customer gateway. This configuration provides a scalable architecture that satisfies the active-passive routing requirements automatically via dynamic BGP routing.

Adım Adım Çözüm

1
Evaluate the scalability requirements for 3030 spoke VPCs across 22 regions.
Determine that deploying local Transit Gateways (TGWs) in `us-east-1` and `us-west-2` is the most scalable pattern, as associating individual VGWs is limited to 1010 per Direct Connect Gateway.
Direct Connect Gateway (DXGW) allows up to 66 Transit Gateway associations, which easily accommodates the two regional TGWs.
2
Configure primary connectivity from New York.
Create a transit virtual interface (transit VIF) on the New York Direct Connect connection and terminate it on the DXGW associated with both regional TGWs.
Transit VIF is required when routing traffic from Direct Connect to Transit Gateways.
3
Configure backup connectivity from San Francisco.
Establish Site-to-Site VPN connections from San Francisco to both Transit Gateways.
Terminating the VPN on the Transit Gateways provides a backup path to all spoke VPCs in both regions.
4
Configure routing preferences to establish active-passive behavior.
Configure BGP on the backup VPN customer gateway to advertise the on-premises CIDR block with AS-Path prepends.
AS-Path prepending makes the VPN route less preferred than the Direct Connect route, ensuring symmetric routing over the primary path during normal operations.

Anahtar Kavram

Designing scalable hybrid connectivity with AWS Transit Gateway, Direct Connect Gateway, and Site-to-Site VPN using BGP AS-Path prepending for active-passive routing.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru