A multinational enterprise is designing a hybrid network connectivity architecture to connect its on-premises data center (IP range ) to its AWS multi-account environment. The AWS environment consists of dozens of VPCs distributed across and . The company requires a highly available network design that satisfies the following conditions:
* Primary connectivity must use a AWS Direct Connect connection terminated at a location associated with .
* Backup connectivity must use AWS Site-to-Site VPN connections over the public internet.
* All outbound traffic from both AWS regions to the on-premises data center must prefer the Direct Connect connection under normal conditions, and automatically fail over to the local region's VPN connection if the Direct Connect path becomes unavailable.
* Inbound traffic from the on-premises data center to AWS must prefer the Direct Connect path under normal conditions.
* Administrative overhead and manual route table updates must be minimized.
Which configuration should a solutions architect recommend to meet these requirements?
- Establish an AWS Transit Gateway (TGW) in each region and attach the local spoke VPCs. Connect the Direct Connect connection to a Direct Connect Gateway (DXGW) using a Transit Virtual Interface (Transit VIF), and associate the DXGW with the TGW in both regions. Establish BGP-enabled Site-to-Site VPN connections directly to each TGW. Configure the customer gateway to advertise over both the Direct Connect and VPN connections. In the TGW route tables, enable route propagation for both the DXGW and VPN attachments. On the customer gateway, configure BGP local preference to prefer routes received over the Direct Connect connection.Cevap
- BEstablish an AWS Transit Gateway (TGW) in each region and attach the local spoke VPCs. Connect the Direct Connect connection to a Direct Connect Gateway (DXGW) using a Transit Virtual Interface (Transit VIF), and associate the DXGW with the TGW in both regions. Establish BGP-enabled Site-to-Site VPN connections directly to each TGW. Configure static routes for in the TGW route tables pointing to the DXGW attachment, and duplicate static routes with a higher metric pointing to the VPN attachments to enable automatic failover.
- CDeploy Virtual Private Gateways (VGWs) in all spoke VPCs in both regions and attach them directly to a Direct Connect Gateway (DXGW) via Private Virtual Interfaces (Private VIFs) for primary connectivity. Establish a software-defined VPN mesh between the on-premises customer gateway and EC2 instances running software routers in each VPC for backup. Use BGP on the customer gateway to route transitive traffic between the VPCs in different regions through the DXGW.
- DEstablish an AWS Transit Gateway (TGW) in and attach all spoke VPCs in both regions to it. Deploy a single NAT Gateway in a central egress VPC in and establish the Direct Connect connection using a Public Virtual Interface (Public VIF). Set up a single Site-to-Site VPN connection from the customer gateway to the TGW in as a backup. Configure the on-premises customer gateway to route all traffic to AWS through the NAT Gateway's public IP address.