A financial services company is migrating its legacy core ledger system, consisting of physical on-premises servers, to AWS using AWS Application Migration Service (MGN). Due to strict security and compliance regulations, all migration and replication traffic must remain private and be routed over an existing AWS Direct Connect (DX) connection linked to an AWS Transit Gateway. The solutions architect has established AWS PrivateLink interface VPC endpoints for MGN in the Staging Area VPC and enabled the 'Use private IP' option in the MGN replication template. After installing the MGN agent on all on-premises source servers, the replication status is reported as stalled.
Which of the following actions should the solutions architect take to resolve this issue and enable replication?
- AReconfigure the Direct Connect connection to use a Direct Connect Gateway directly attached to the Staging Area VPC to route replication traffic, bypassing the Transit Gateway under the assumption that Direct Connect Gateway supports transitive routing between the source and multiple target VPCs.
- Allow outbound traffic on TCP port 1500 from the on-premises servers, update the Staging Area VPC security group to allow inbound traffic on TCP port 1500 from the on-premises IP ranges, and verify that AWS Transit Gateway routing tables are configured to route traffic correctly between the on-premises network and the Staging Area VPC.Cevap
- CConfigure Route 53 Resolver Inbound Endpoints in the Staging Area VPC, associate the Route 53 Private Hosted Zone (PHZ) containing the MGN endpoint names with the on-premises DNS servers directly instead of associating the PHZ with the VPC, and open TCP port 443 on the on-premises firewalls.
- DDeploy a single NAT Gateway in a public subnet of the Staging Area VPC to route replication traffic through public endpoints, configure the on-premises firewalls to allow outbound TCP port 443, and configure Transit Gateway routing tables to direct replication traffic through this NAT Gateway.