Examkin

Soru

Zorluk: ZorHybrid and Multi-Account Network Connectivity Design

An organization has a multi-account AWS environment with 2525 VPCs deployed across two AWS Regions: `us-east-1` and `us-west-2`. The organization has established a hybrid network using two 10 Gbps10\text{ Gbps} AWS Direct Connect connections terminating at separate DX locations. To ensure resiliency, they want to configure a backup path using a Site-to-Site VPN over the internet. The Direct Connect connections terminate at an AWS Direct Connect Gateway associated with AWS Transit Gateways in each region. Under normal operating conditions, all hybrid traffic must use the Direct Connect connections. The Site-to-Site VPN should only be used if both Direct Connect connections fail. Which two routing configurations must the solutions architect implement on the on-premises router and within AWS to achieve this dynamic failover behavior?

  1. Configure the on-premises router to advertise the on-premises IP prefixes to AWS with a shorter AS path over the Direct Connect transit virtual interface than over the Site-to-Site VPN connections.Cevap
  2. Configure the on-premises router to assign a higher BGP local preference to the AWS routes received over the Direct Connect transit virtual interface than those received over the Site-to-Site VPN connections.Cevap
  3. C
    Configure the on-premises router to prepend its autonomous system (AS) number multiple times when advertising routes over the Direct Connect transit virtual interface.
  4. D
    Associate the Route 53 Private Hosted Zone of the organization's core services with the customer gateway device using a virtual private gateway.
  5. E
    Deploy a single NAT Gateway in a public subnet of a central egress VPC and configure all Transit Gateway route tables to route on-premises traffic through it.

Cevap

The solutions architect should configure the on-premises router to advertise the on-premises IP prefixes with a shorter AS path over the Direct Connect virtual interface, and configure the on-premises router to assign a higher BGP local preference to the AWS routes received over the Direct Connect interface.
To ensure the Direct Connect connection is used as the primary path and the VPN as the backup, routing preferences must be set for both directions of traffic. For traffic going from AWS to on-premises (outbound), the Transit Gateway evaluates the BGP AS path length. By advertising the on-premises prefixes with a shorter AS path over the Direct Connect transit virtual interface, AWS will prefer this path. For traffic going from on-premises to AWS (inbound), the customer gateway should prefer the Direct Connect path by assigning it a higher BGP local preference, which is processed locally on the router before other BGP path attributes.

Adım Adım Çözüm

1
Configure the outbound routing preference from AWS to on-premises by adjusting the AS path length advertised from the customer gateway.
The Transit Gateway receives routes for on-premises CIDRs over both Direct Connect and VPN, but prefers Direct Connect due to the shorter AS path length.
This guarantees that all outbound traffic from the AWS VPCs to the on-premises environment uses the Direct Connect path under normal operating conditions.
2
Configure the inbound routing preference from on-premises to AWS on the local router using BGP local preference.
The local router receives the AWS prefixes over both Direct Connect and VPN, and selects Direct Connect as the best path due to the higher local preference value.
This guarantees that all inbound traffic from the on-premises environment to AWS VPCs uses the Direct Connect path under normal operating conditions.

Anahtar Kavram

Using BGP attributes such as AS path length and local preference to establish symmetric routing preferences over hybrid network connections.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru