An enterprise is migrating its legacy database and application servers from an on-premises data center to AWS using AWS Application Migration Service (MGN). The on-premises network is connected to a staging VPC in AWS via an AWS Direct Connect connection attached to an AWS Transit Gateway. Immediately after installing the AWS Replication Agent on the on-premises servers, the migration console shows the replication status as stalled. The on-premises servers cannot establish communication with the replication servers in the staging VPC or the MGN control plane. Which TWO of the following actions must the solutions architect take to resolve this issue and start replication? (Select TWO)
- Configure the security group of the staging area in the staging VPC to allow inbound traffic on TCP port 1500 from the on-premises CIDR block, and ensure the on-premises firewall allows outbound traffic on TCP port 1500 to the staging VPC CIDR block.Cevap
- Ensure that the on-premises servers can resolve and access the AWS Application Migration Service regional endpoints over HTTPS port 443, updating the on-premises firewall to allow outbound port 443 traffic if necessary.Cevap
- CModify the target VPC security group to allow inbound traffic on TCP port 1500, and configure the on-premises agents to use a custom port for data replication to bypass the on-premises firewall.
- DConfigure a Direct Connect gateway to handle transitive routing between the target VPC and the staging VPC without using the Transit Gateway, and update the on-premises firewall to permit all traffic over UDP port 1500.
Cevap
To resolve the stalled replication, the solutions architect must allow inbound TCP port 1500 on the staging area security groups from the on-premises network, allow outbound TCP port 1500 traffic on the on-premises firewall, and verify that the on-premises servers can connect to the regional MGN control plane endpoints over HTTPS port 443.
The AWS Replication Agent relies on two network paths to start replication: HTTPS (port 443) outbound to the MGN regional control plane service endpoints to authenticate and pull configurations, and TCP port 1500 to push block-level data to the replication servers in the staging VPC. Allowing inbound TCP port 1500 on the staging area security group from the on-premises network and enabling outbound port 443 on the on-premises firewall resolves both communication failures.
Adım Adım Çözüm
Anahtar Kavram
AWS Application Migration Service (MGN) network configuration requirements for replication and control plane connectivity.