An enterprise is designing a hybrid network architecture to connect its multi-account AWS environment with an on-premises data center. The company has deployed a central Transit Gateway in a shared services account to interconnect multiple spoke VPCs. The network design must utilize a 10 Gbps AWS Direct Connect connection as the primary path, with an IPsec VPN over the internet serving as an automated backup. The solution must support dynamic routing, automatically failover during a Direct Connect outage, and minimize ongoing administrative overhead. Which two configuration steps should the solutions architect perform to establish this hybrid connectivity? (Select two.)
- Create a Transit Virtual Interface (VIF) on the Direct Connect connection, associate it with a Direct Connect gateway, and attach the Direct Connect gateway to the central Transit Gateway.Cevap
- Create a Site-to-Site VPN attachment on the central Transit Gateway, enable BGP dynamic routing, and advertise the on-premises routes via the VPN with a longer AS path than the Direct Connect path.Cevap
- CCreate a Private Virtual Interface (VIF) on the Direct Connect connection, associate it with a Direct Connect gateway, and associate the Direct Connect gateway directly with the Virtual Private Gateway (VGW) in each spoke VPC.
- DConfigure a Route 53 Private Hosted Zone (PHZ) in the shared services account to resolve internal domain names, but do not associate it with the spoke VPCs in the consumer accounts to isolate DNS queries.
- EDeploy a single NAT Gateway in a shared services VPC to route all outbound internet traffic from the spoke VPCs across all Availability Zones.
Cevap
The correct configurations are to establish primary connectivity by creating a Transit Virtual Interface (VIF) on the Direct Connect connection, associating it with a Direct Connect gateway, and attaching it to the Transit Gateway; and to configure backup connectivity by creating a Site-to-Site VPN attachment on the Transit Gateway with BGP dynamic routing and a longer AS path.
Establishing hybrid connectivity with Transit Gateway requires creating a Transit VIF on the AWS Direct Connect connection and associating it with a Direct Connect gateway attached to the Transit Gateway. This allows all attached VPCs to route traffic to the on-premises network. For failover, attaching an IPsec Site-to-Site VPN directly to the Transit Gateway using BGP dynamic routing with a longer AS path ensures the Direct Connect path is preferred under normal conditions while automating failover if the primary path becomes unavailable.
Adım Adım Çözüm
Anahtar Kavram
Hybrid network connectivity with AWS Transit Gateway, Direct Connect Gateway, and Site-to-Site VPN backup using BGP routing preferences.