Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A healthcare provider operates a multi-account AWS environment with 1515 spoke VPCs in the `us-west-2` Region and 1010 spoke VPCs in the `us-east-1` Region. The provider requires a private, high-bandwidth hybrid network configuration to connect all VPCs to their on-premises data center. The connection must use a primary AWS Direct Connect connection and a backup AWS Site-to-Site VPN connection. The architecture must allow all VPCs to communicate with the on-premises network and with each other. Which architecture and routing strategy will meet these requirements with the least administrative overhead?

  1. Provision a Transit Gateway in each Region, attach the local VPCs to their respective Transit Gateway, and peer the two Transit Gateways. Link a central Direct Connect Gateway with both Transit Gateways to terminate the primary Direct Connect connection, and establish a Site-to-Site VPN connection to each Transit Gateway as a backup. Advertise on-premises routes via BGP over both paths, prepending the AS path on the VPN to ensure the Direct Connect path is preferred.Cevap
  2. B
    Link a central Direct Connect Gateway directly with the Virtual Private Gateway (VGW) of all 2525 VPCs to establish the primary connection, and set up a Site-to-Site VPN connection to each VGW as a backup. Rely on BGP routing to prefer the Direct Connect path over the VPN connection for all hybrid and inter-VPC traffic.
  3. C
    Provision a single AWS Transit Gateway in the primary Region and attach all 2525 VPCs across both Regions directly to this Transit Gateway. Link a central Direct Connect Gateway with the Transit Gateway for the primary connection, and configure a Site-to-Site VPN connection to the Transit Gateway as a backup. Use BGP routing to manage failover between the paths.
  4. D
    Establish a full mesh of VPC Peering connections among all 2525 VPCs to handle inter-VPC traffic. Link a central Direct Connect Gateway associated with a Virtual Private Gateway (VGW) in each VPC for primary hybrid connectivity, and configure a backup Site-to-Site VPN connection to each VPC's VGW. Configure BGP path attributes to prefer the Direct Connect connections.

Cevap

Provision a Transit Gateway in each Region, attach the local VPCs to their respective Transit Gateway, and peer the two Transit Gateways. Link a central Direct Connect Gateway with both Transit Gateways to terminate the primary Direct Connect connection, and establish a Site-to-Site VPN connection to each Transit Gateway as a backup. Advertise on-premises routes via BGP over both paths, prepending the AS path on the VPN to ensure the Direct Connect path is preferred.
The correct architecture uses local Transit Gateways in each Region, peered together to support inter-Region VPC communication. For hybrid connectivity, a central Direct Connect Gateway is linked with both Transit Gateways, and a backup Site-to-Site VPN is configured on each Transit Gateway. By prepending the AS path on the VPN connection, BGP routing naturally prefers the shorter AS path of the Direct Connect connection for outbound and inbound traffic, providing automated failover.

Adım Adım Çözüm

1
Deploy regional Transit Gateways and attach local VPCs.
Local VPC communication is established within each Region.
Transit Gateway attachments are regional and cannot span across Regions.
2
Establish a Transit Gateway peering connection between the two Transit Gateways.
Inter-Region VPC-to-VPC routing is enabled.
To allow cross-Region traffic between the 1515 VPCs in us-west-2 and the 1010 VPCs in us-east-1.
3
Link a central Direct Connect Gateway to both Transit Gateways and create backup Site-to-Site VPN connections to each Transit Gateway.
Dual-path hybrid connectivity is established with both Regions.
Direct Connect Gateway supports multi-region associations with Transit Gateways, enabling centralized hybrid connectivity.
4
Advertise on-premises routes via BGP on both connections, and prepend the AS path on the VPN path.
The Direct Connect connection becomes the preferred primary route, with the VPN acting as an automatic failover.
AS path prepending increases the length of the VPN route, making BGP prefer the shorter path over Direct Connect.

Anahtar Kavram

Multi-region hybrid network design with Transit Gateway peering, Direct Connect Gateway, and BGP failover.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru