A company is designing a hybrid network architecture for its multi-account AWS environment in the `us-east-1` Region. The setup includes spoke VPCs that must connect to an on-premises data center. The design requires a primary AWS Direct Connect connection and a backup IPsec VPN connection over the internet, both supporting dynamic routing and automatic failover. Additionally, all spoke VPCs must route their outbound internet traffic through a centralized egress VPC. Which configuration meets these requirements while ensuring high availability and minimizing administrative overhead?
- ADeploy a central AWS Transit Gateway (TGW) associated with a Direct Connect Gateway (DXGW) and an IPsec VPN attachment. For name resolution of hybrid resources, create a Route 53 Private Hosted Zone (PHZ) in a shared services VPC and associate it only with that VPC, relying on TGW routing to allow other spoke VPCs to resolve DNS queries.
- BAssociate a Direct Connect Gateway (DXGW) directly with the Virtual Private Gateways (VGWs) of all spoke VPCs. Configure a central Transit Gateway to host the backup IPsec VPN connection and the centralized egress VPC. Route outbound internet traffic and backup on-premises traffic through the Transit Gateway using VPC peering from each spoke VPC.
- Deploy a central AWS Transit Gateway (TGW). Create a Direct Connect Gateway (DXGW) with a transit virtual interface and associate it with the TGW. Create an IPsec VPN attachment on the TGW. Create a centralized egress VPC with redundant NAT Gateways deployed across multiple Availability Zones, and attach it to the TGW. Configure the spoke VPC route tables to direct all traffic to the TGW, and configure the TGW route tables to route egress traffic to the egress VPC and on-premises traffic to both the DXGW and VPN attachments, using BGP dynamic routing to prefer the Direct Connect path.Cevap
- DDeploy a central AWS Transit Gateway (TGW) associated with a Direct Connect Gateway (DXGW) and an IPsec VPN attachment. Create a centralized egress VPC with a single NAT Gateway in one Availability Zone to consolidate all outbound internet traffic. Configure the TGW to route all traffic from the spoke VPCs to the egress VPC, and use BGP to manage failover between the Direct Connect and VPN paths.
Cevap
Deploy a central AWS Transit Gateway, connect it to the on-premises data center via a Direct Connect Gateway with a transit virtual interface and an IPsec VPN attachment, and use a centralized egress VPC with redundant NAT Gateways across multiple Availability Zones. Configure dynamic BGP routing to automatically failover from Direct Connect to VPN.
The correct architecture leverages AWS Transit Gateway to simplify multi-account connectivity. By attaching both the Direct Connect Gateway (using a transit VIF) and the IPsec VPN to the Transit Gateway and advertising the same BGP routes, the Transit Gateway automatically selects the Direct Connect path as primary and the VPN as backup. Centralizing egress through a multi-AZ NAT Gateway pool in an egress VPC attached to the Transit Gateway ensures high availability and cost-effective outbound traffic routing.
Adım Adım Çözüm
Anahtar Kavram
AWS Transit Gateway acts as a regional hub to simplify multi-account hybrid routing and centralize egress traffic. When identical prefixes are advertised over both a Direct Connect Gateway and an IPsec VPN, the Transit Gateway automatically prefers the Direct Connect path, enabling seamless, automatic failover.