An enterprise has a multi-account AWS environment with VPCs in the us-east-1 and us-west-2… — AWS Certified Solutions Architect - Professional

An enterprise has a multi-account AWS environment with VPCs in the us-east-1 and us-west-2 regions. Each region contains an AWS Transit Gateway (TGW-East and TGW-West), and the two Transit Gateways are peered. The on-premises datacenter uses the IP address range $172.16.0.0/12$ .

The datacenter connects to AWS using a Direct Connect Gateway (DXGW) associated with both Transit Gateways via Transit Virtual Interfaces (VIFs). As a backup, AWS Site-to-Site VPN connections are established from the datacenter directly to both TGW-East and TGW-West.

The Solutions Architect must design a routing policy for us-east-1 spoke VPCs to access the $172.16.0.0/12$ network. The policy must prioritize the paths in the following order:
1. Primary: The local Direct Connect link via TGW-East.
2. Secondary: The local backup Site-to-Site VPN via TGW-East.
3. Tertiary: The peered TGW link to TGW-West, then via the us-west-2 Direct Connect link.

Additionally, traffic from the datacenter to the us-east-1 VPCs must prefer the Direct Connect link over the VPN link.

Which TWO configurations should the Solutions Architect implement to meet these requirements?

Configure a static route for $172.0.0.0/8$ pointing to the TGW peering attachment in the TGW-East route table, and enable route propagation for the local Direct Connect Gateway and VPN attachments to dynamically learn the $172.16.0.0/12$ prefix.Cevap
Configure the on-premises customer gateway router to assign a higher BGP Local Preference value to routes received from AWS via the Direct Connect connection than those received via the Site-to-Site VPN.Cevap
C
Configure a static route for $172.16.0.0/12$ pointing to the TGW peering attachment in the TGW-East route table, and configure the route propagation for the local Direct Connect Gateway and VPN attachments.
D
Enable dynamic BGP route propagation for the TGW peering attachment in TGW-East, allowing TGW-West to advertise the $172.16.0.0/12$ prefix with a larger AS-Path attribute than the local VPN connection.
E
Deploy a single NAT Gateway in a public subnet of the us-east-1 VPCs, and route all outbound on-premises traffic through it to translate the source IP to a public IP before reaching the peered TGW connection.

Cevap

Configure a static route for

172.0.0.0/8

pointing to the TGW peering attachment in the TGW-East route table, and enable route propagation for the local Direct Connect Gateway and VPN attachments. Also, configure the on-premises customer gateway router to assign a higher BGP Local Preference value to routes received from AWS via the Direct Connect connection than those received via the Site-to-Site VPN.

The correct architecture uses a summarized static route (such as

172.0.0.0/8

) in the local Transit Gateway route table pointing to the peering attachment. This ensures that the local Direct Connect and VPN dynamic advertisements for

172.16.0.0/12

take priority due to longest prefix match. If both local paths fail, the dynamic routes are withdrawn, and traffic falls back to the peering attachment. Additionally, configuring a higher BGP Local Preference on the on-premises router for routes learned via Direct Connect ensures that return traffic from the customer network to AWS prefers the Direct Connect path over the backup VPN.

Adım Adım Çözüm

Analyze Transit Gateway route preference rules.

Static routes always take precedence over dynamically propagated BGP routes of the same prefix length. Therefore, configuring a static route for the exact prefix

172.16.0.0/12

pointing to the peering attachment would incorrectly make the peered path the primary path.

To ensure correct path preference, the peered path must be configured with a less specific prefix (e.g.,

172.0.0.0/8

) so that the more specific dynamic routes (

172.16.0.0/12

) are preferred via longest prefix match.

Evaluate Transit Gateway peering limitations.

TGW peering attachments do not support dynamic routing or BGP propagation. Routes across peering links must be configured statically.

This rules out any options proposing BGP propagation or dynamic advertisements over TGW peering.

Determine path selection for on-premises to AWS traffic.

To make the customer gateway router prefer the Direct Connect path for outbound traffic to AWS, BGP Local Preference should be set higher for the Direct Connect routes on the customer's on-premises router.

BGP Local Preference is an administrative attribute used within an Autonomous System (AS) to select the outbound exit point.

Anahtar Kavram

AWS Transit Gateway route evaluation order and TGW peering static routing constraints.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru