Examkin

Soru

Zorluk: ZorHybrid and Multi-Account Network Connectivity Design

A multinational enterprise is designing a hybrid network architecture to connect two corporate offices in London and Paris to a multi-account AWS environment. The AWS infrastructure consists of 40 spoke VPCs distributed across the eu-west-1 (Ireland) and eu-west-3 (Paris) Regions. The architecture must satisfy the following requirements:
- High availability: All VPCs in both Regions must have redundant hybrid connectivity to both offices.
- Path preference: Primary traffic must use AWS Direct Connect. An IPsec VPN over the public internet must serve as a failover path.
- Traffic localization: Under normal operations, traffic from the London office to eu-west-1 must flow through the London Direct Connect connection, and traffic from the Paris office to eu-west-3 must flow through the Paris Direct Connect connection. Cross-region hybrid routing should only occur during a link failure.
- Minimal administrative overhead for routing.

Which TWO options should the solutions architect select to meet these requirements?

  1. A
    Deploy a single Direct Connect Gateway to centralize all hybrid connectivity. Terminate both the Transit Virtual Interfaces (Transit VIFs) and the IPsec VPN tunnels directly on this Direct Connect Gateway, and associate it with regional Transit Gateways in each region.
  2. Deploy an AWS Transit Gateway in both regions to interconnect local spoke VPCs, and peer the two Transit Gateways. Associate both Transit Gateways with a single Direct Connect Gateway connected to Transit Virtual Interfaces (Transit VIFs) at both offices, and terminate the backup Site-to-Site VPN connections directly on the Transit Gateways.Cevap
  3. C
    Configure full-mesh VPC Peering connections across all 40 spoke VPCs to route inter-VPC traffic. Connect the spoke VPCs to the customer gateway routers using regional Transit Gateways and set up static route tables in each VPC pointing to the on-premises offices.
  4. On the customer gateway routers, advertise local office CIDR blocks to the local Direct Connect connection with no AS path prepending, and advertise them to the remote Direct Connect connection with AS path prepending. Set a lower BGP local preference on the customer gateways for prefixes received via the VPN tunnels.Cevap
  5. E
    In the Transit Gateway route tables, configure static routes for the on-premises networks pointing to the Transit VIFs as the primary path, and configure static routes pointing to the VPN attachments with a higher administrative distance to act as the backup path.

Cevap

Deploy an AWS Transit Gateway in both regions peered together, associate both with a single Direct Connect Gateway, terminate the backup Site-to-Site VPNs directly on the Transit Gateways, and configure BGP routing on the customer gateways to enforce path preference and traffic localization using AS path prepending and local preference.
To build a highly available, multi-region hybrid network with minimum administrative overhead, regional Transit Gateways must be deployed and peered. The Transit Gateways are associated with a single Direct Connect Gateway using Transit VIFs to handle primary traffic. Since the Direct Connect Gateway cannot terminate VPN connections, the backup Site-to-Site VPN connections are terminated directly on the regional Transit Gateways. Egress traffic localization is achieved by using BGP AS path prepending, which makes the local Direct Connect connection appear as the shortest path to AWS. Ingress traffic path preference is established by configuring a lower BGP local preference on the customer gateways for prefixes received over VPN, ensuring the routers prefer the Direct Connect connection.

Adım Adım Çözüm

1
Deploy regional Transit Gateways in eu-west-1 and eu-west-3, peer them to enable inter-VPC routing, and attach the local spoke VPCs to their respective regional Transit Gateway.
Establishes scalable, low-overhead hub-and-spoke VPC networking in both regions.
Allows all 40 spoke VPCs to communicate across accounts and regions without the administrative complexity of full-mesh VPC peering.
2
Create a central Direct Connect Gateway and associate it with both regional Transit Gateways. Create Transit VIFs from London and Paris Direct Connect connections and attach them to the Direct Connect Gateway.
Enables primary hybrid network connectivity from both corporate offices to all AWS VPCs.
Direct Connect Gateway enables multi-region transitive routing between on-premises environments and Transit Gateways.
3
Establish Site-to-Site VPN connections from the customer gateways at both locations to the Transit Gateways in both regions.
Provides backup paths that bypass the Direct Connect infrastructure.
Direct Connect Gateway does not terminate VPN tunnels; hence, the backup VPN tunnels must terminate directly on the Transit Gateways.
4
Configure BGP path attributes on the customer gateways to advertise local networks to the local region's DX connection with a shorter AS path and remote DX with AS path prepending, while configuring a lower local preference for VPN routes.
Ensures primary traffic prefers Direct Connect, backups use VPN, and cross-region routing only occurs during link failures.
Ensures traffic localization and automatic failover by influencing BGP path selection for both ingress and egress routing.

Anahtar Kavram

Multi-region hybrid connectivity using AWS Transit Gateway, Direct Connect Gateway, and Site-to-Site VPN failover with BGP path selection controls.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru