An enterprise is designing a hybrid network architecture for its multi-account AWS environ… — AWS Certified Solutions Architect - Professional

An enterprise is designing a hybrid network architecture for its multi-account AWS environment. The environment consists of $30$ spoke VPCs spread across two AWS Regions: `us-east-1` and `us-west-2`. The VPCs are connected using an AWS Transit Gateway (TGW) in each region. The on-premises data center must connect to AWS with high availability and optimal performance.

The primary path is a $10$ Gbps AWS Direct Connect (DX) connection using a Transit Virtual Interface (Transit VIF) terminated at a Direct Connect Gateway (DXGW) associated with both TGWs. A backup path is established using an AWS Site-to-Site VPN connection over the internet, terminating directly on the TGWs.

During failover testing, the network team observes that traffic originating from the on-premises data center to the AWS spoke VPCs is being load-balanced across both the DX and VPN paths, causing asymmetric routing. Furthermore, outbound traffic from the AWS spoke VPCs to the on-premises network ( $10.0.0.0/8$ ) is preferring the VPN path because the on-premises router is advertising $10.0.0.0/8$ over the DX connection and more specific subnets ( $10.0.0.0/16$ and $10.1.0.0/16$ ) over the VPN connection.

Which combination of routing configurations will resolve these routing issues and ensure that the DX connection is prioritized for bi-directional traffic, while maintaining the VPN as a dynamic failover?

Configure the on-premises router to advertise the identical $10.0.0.0/8$ prefix over both the DX and VPN BGP sessions. Set a higher BGP Local Preference on the on-premises router for routes received from AWS via the DX connection compared to the VPN. Prepend the on-premises Autonomous System (AS) number multiple times on the BGP advertisements sent to AWS over the VPN connection.Cevap
B
Configure the on-premises router to advertise the identical $10.0.0.0/8$ prefix over both BGP sessions. Set a higher Multi-Exit Discriminator (MED) value on the BGP advertisements sent to AWS over the VPN connection. On the on-premises router, prepend the Autonomous System (AS) number on the DX BGP advertisements to skew the inbound path selection.
C
Leave the prefix advertisements as they are. In the AWS Transit Gateway route tables, configure a static route for $10.0.0.0/8$ pointing to the DXGW attachment, and set its administrative distance lower than the propagated routes from the VPN connection to override the subnet specificity.
D
Route all on-premises and outbound traffic through a centralized egress VPC in each region containing a single NAT Gateway. On the on-premises router, configure policy-based routing to forward traffic to the NAT Gateway IP address, and configure the Transit Gateway to prioritize the NAT Gateway route over the VPN.

Cevap

Configure the on-premises router to advertise the identical

10.0.0.0/8

prefix over both the DX and VPN BGP sessions. Set a higher BGP Local Preference on the on-premises router for routes received from AWS via the DX connection compared to the VPN. Prepend the on-premises Autonomous System (AS) number multiple times on the BGP advertisements sent to AWS over the VPN connection.

The correct configuration addresses both inbound and outbound traffic paths. First, by advertising the identical prefix of

10.0.0.0/8

over both BGP sessions, it eliminates the longest prefix match bias toward the VPN. Second, by prepending the Autonomous System (AS) number on the VPN advertisements, the AS-path length for the VPN route becomes longer than the DX route, which causes AWS Transit Gateway to prefer the DX path for outbound traffic. Finally, setting a higher BGP Local Preference on the on-premises router for the DX connection ensures that traffic originating from the data center to AWS prefers the DX path, resolving the asymmetric routing issue.

Adım Adım Çözüm

Align prefix advertisements across both hybrid paths.

The on-premises router is configured to advertise the same

10.0.0.0/8

prefix on both the DX Transit VIF and Site-to-Site VPN BGP sessions.

AWS Transit Gateway evaluates route preference starting with the longest prefix match. Because the VPN was advertising more specific subnets (

10.0.0.0/16

and

10.1.0.0/16

), AWS preferred the VPN path. Identical prefixes allow the TGW to move to the next BGP selection criteria.

Configure AS-path prepending on the standby path.

The Autonomous System (AS) number is prepended multiple times to BGP route advertisements sent over the VPN connection to AWS.

When prefix lengths are equal, AWS Transit Gateway prefers routes with shorter AS-path lengths. Prepending the AS-path on the VPN makes it look longer, forcing AWS to prefer the DX path for outbound traffic to on-premises.

Configure Local Preference on the customer gateway (on-premises router).

A higher BGP Local Preference is applied to routes received from AWS via the DX connection relative to those received via the VPN.

Local Preference is an attribute used within an Autonomous System to choose the exit point for outbound traffic. Setting it higher on the DX connection ensures that traffic originating from the data center to AWS prefers the DX connection over the VPN, preventing asymmetric routing.

Anahtar Kavram

BGP Path Selection and Longest Prefix Match in Hybrid AWS Environments

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru