Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network architecture to connect 3030 VPCs in a multi-account AWS environment to an on-premises data center. The AWS environment uses an AWS Transit Gateway in the `us-east-1` Region to interconnect all VPCs. The primary connection to the data center is a 10 Gbps10\text{ Gbps} AWS Direct Connect connection using a Transit Virtual Interface (VIF) connected to a Direct Connect Gateway. To ensure high availability, the solutions architect is deploying an IPsec AWS Site-to-Site VPN over the Internet as a backup connection. Both connections must support dynamic routing and automatically failover, but the Direct Connect path must be preferred for both inbound and outbound traffic under normal operating conditions. Which two configurations must the solutions architect implement to achieve these routing requirements? (Select TWO.)

  1. Configure the on-premises router to assign a higher BGP local preference attribute to the AWS routes received over the Direct Connect connection than those received over the VPN connection.Cevap
  2. Configure the on-premises router to advertise its local network prefixes over the VPN connection with Autonomous System (AS) path prepending.Cevap
  3. C
    Configure static routes on the Transit Gateway route table pointing to the VPN attachment, ensuring they have a higher metric than the dynamic routes propagated by the Direct Connect Gateway.
  4. D
    Configure a Private Hosted Zone in Route 53 with failover routing policies pointing to the Direct Connect Gateway and Site-to-Site VPN endpoints.
  5. E
    Deploy a single NAT Gateway in a shared services VPC and route all hybrid traffic through it to allow the Transit Gateway to prioritize the Direct Connect path.

Cevap

Configure the on-premises router to assign a higher BGP local preference attribute to the AWS routes received over the Direct Connect connection, and configure the on-premises router to advertise its local prefixes over the VPN connection using AS path prepending.
To achieve a preferred primary path over Direct Connect and an active-backup dynamic failover via Site-to-Site VPN, path preferences must be configured for both inbound and outbound traffic. Configuring the on-premises router to assign a higher BGP local preference attribute to routes received over the Direct Connect connection ensures that outbound traffic from the data center to AWS utilizes Direct Connect. Advertising the local network prefixes over the VPN connection with AS path prepending increases the path length for the VPN route, prompting AWS Transit Gateway to prefer the shorter Direct Connect path for inbound traffic.

Adım Adım Çözüm

1
Influence outbound traffic (on-premises to AWS) by configuring BGP local preference on the customer gateway.
The on-premises router prefers the Direct Connect link for all traffic destined for the AWS VPCs.
BGP local preference is a non-transitive attribute used to control outbound traffic routing policies within a local Autonomous System.
2
Influence inbound traffic (AWS to on-premises) by prepending the Autonomous System (AS) path on the customer gateway BGP advertisements over the VPN.
AWS Transit Gateway sees a longer AS path for routes learned via the VPN and prefers the shorter AS path via the Direct Connect Gateway.
AWS Transit Gateway uses BGP AS path length to evaluate dynamic routing paths. Prepending the AS path makes the VPN backup connection less preferred.

Anahtar Kavram

BGP routing policy optimization for hybrid network paths utilizing AS path prepending and local preference to establish primary and backup connectivity.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru