An enterprise is designing a highly available hybrid network architecture for its multi-ac… — AWS Certified Solutions Architect - Professional

An enterprise is designing a highly available hybrid network architecture for its multi-account AWS environment across two regions: $us-east-1$ (primary) and $us-west-2$ (secondary). The network architecture consists of an AWS Transit Gateway in each region, connected via a Transit Gateway peering attachment. The on-premises network has two data centers: one in New York and one in Chicago.

The New York data center connects to the $us-east-1$ Transit Gateway via a 10 Gbps AWS Direct Connect connection using a Transit VIF terminated on a central Direct Connect Gateway. The Chicago data center connects to the $us-west-2$ Transit Gateway in the same manner. To ensure disaster recovery capability, the enterprise deploys redundant IPsec VPN connections from both data centers to the Transit Gateways in their respective local regions.

The company's routing policy has the following constraints:
- Under normal operating conditions, all traffic between the VPCs in $us-east-1$ and the New York data center must use the local Direct Connect path.
- If the Direct Connect connection in $us-east-1$ fails, traffic between $us-east-1$ and the New York data center must immediately fail over to the local IPsec VPN connection. It must NOT route through the peered Transit Gateway in $us-west-2$ to avoid high inter-region data transfer charges and latency.
- Only if both the local Direct Connect and the local IPsec VPN connections in $us-east-1$ fail should traffic fail over transitively through the Transit Gateway peering connection to use the hybrid paths in $us-west-2$ .

Which TWO configurations must the Solutions Architect implement to satisfy these routing requirements?

On the on-premises routers, advertise specific subnets (such as /24 prefixes) via BGP over both the local Direct Connect Transit VIFs and the local IPsec VPN tunnels, and configure a static route for the summary corporate network range (such as a /16 prefix) pointing to the Transit Gateway peering attachment in each region's Transit Gateway route table.Cevap
Configure the customer gateway routers to assign the highest BGP Local Preference to routes for the local AWS region's VPC CIDR received over the local Direct Connect path, a medium Local Preference to routes received over the local IPsec VPN, and the lowest Local Preference to routes received via the remote region's Direct Connect and VPN paths.Cevap
C
Enable dynamic BGP route propagation across the Transit Gateway peering attachment, and configure BGP Local Preference attributes within the Transit Gateway route tables to prioritize the Direct Connect path over the local IPsec VPN path.
D
Deploy a single, non-redundant NAT Gateway in a shared services VPC in us-east-1 to route all outbound corporate traffic, and configure the on-premises routers to prioritize the IPsec VPN tunnels by advertising more specific subnets over the VPN than over the Direct Connect Transit VIFs.
E
Create a single Route 53 Private Hosted Zone (PHZ) in the network account, associate it with the Transit Gateway peering attachment, and rely on the peered Transit Gateways to automatically route DNS queries and VPC-to-VPC traffic without associating the PHZ with the VPCs in the spoke accounts.

Cevap

Configure on-premises routers to advertise specific subnets via BGP over both local Direct Connect and local VPN connections, and configure a static route for the summary corporate network range pointing to the Transit Gateway peering attachment in each region. Additionally, configure the customer gateway routers to assign BGP Local Preference hierarchically, prioritizing the local Direct Connect, followed by the local VPN, and setting the lowest preference for the remote region's paths.

The correct answer combines BGP local preference on-premises and longest prefix match (LPM) routing in AWS Transit Gateway. By advertising specific /24 subnets over the local Direct Connect and IPsec VPN, the local Transit Gateway will prefer these local paths because their prefixes are more specific than the static summary /16 route pointing to the Transit Gateway peering attachment. If both local paths fail, the /24 prefixes are withdrawn, allowing traffic to fail over to the /16 summary route via the peered Transit Gateway. The customer gateway configuration ensures that return traffic from the on-premises network prefers the local Direct Connect, then the local VPN, and only uses the remote region's paths when all local options are exhausted.

Adım Adım Çözüm

Configure BGP Local Preference on the on-premises customer gateway (CGW) routers.

On-premises routers will prefer the local Direct Connect first, local IPsec VPN second, and the remote region's Direct Connect/VPN paths only as a last resort for outbound traffic to AWS VPCs.

This guarantees correct failover order and avoids asymmetric routing for traffic entering AWS.

Advertise specific subnets (e.g., /24 prefixes) via BGP from the on-premises routers over both the local Direct Connect Transit VIF and the local IPsec VPN.

These specific prefixes are dynamically propagated to the local Transit Gateway's spoke VPC route table.

By propagating specific subnets, we ensure that the local Transit Gateway prefers local paths over any summary static routes due to Longest Prefix Match (LPM) rules.

Configure a static summary route (e.g., /16 prefix) pointing to the Transit Gateway peering attachment in the spoke VPC route tables of both Transit Gateways.

A backup path is established across the peering connection for times when local routes are unavailable.

Since the static route is for a broader CIDR block (/16) than the dynamically propagated local routes (/24), it remains inactive for local traffic. It only becomes active if both local paths fail, causing the specific /24 routes to be withdrawn.

Anahtar Kavram

Combining Longest Prefix Match (LPM) with dynamic BGP propagation and summary static routing to implement selective failover across peered Transit Gateways.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru