Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A logistics company is designing a hybrid network architecture to connect its on-premises data center to its AWS environment. The environment consists of 12 spoke VPCs across two AWS Regions: us-east-1 and us-west-2. The company requires a highly available, private connection with a backup path. A 10 Gbps AWS Direct Connect (DX) connection has been established. To minimize costs while ensuring high availability, the company will use an IPsec VPN over the internet as a backup. The architecture must support dynamic routing and automatic failover. Which of the following configurations are required to meet these requirements? (Select TWO.)

  1. Configure an AWS Transit Gateway in each Region, and associate both Transit Gateways with a single AWS Direct Connect Gateway using transit virtual interfaces.Cevap
  2. Establish BGP sessions for both the Direct Connect and VPN connections, and prepend the autonomous system (AS) path on the VPN connection to ensure AWS routes traffic via Direct Connect under normal operations.Cevap
  3. C
    Configure Virtual Private Gateways (VGWs) in all spoke VPCs, and associate them directly with the AWS Direct Connect Gateway to enable dynamic, transitive VPC-to-VPC routing.
  4. D
    Deploy a single NAT Gateway in a centralized services VPC to handle all outbound traffic to the on-premises network, routing it over the backup VPN path across both Regions.

Cevap

Configure an AWS Transit Gateway in each Region associated with a single AWS Direct Connect Gateway using transit virtual interfaces, and prepend the AS path on the VPN BGP session to ensure Direct Connect is preferred.
The correct configurations involve deploying an AWS Transit Gateway in each Region and associating them with a single AWS Direct Connect Gateway using transit virtual interfaces. This establishes the primary high-throughput path. For the backup path, dynamic routing via BGP is established over both Direct Connect and VPN. By prepending the AS path on the VPN connection, AWS is instructed to prefer the Direct Connect path because it has a shorter AS path, ensuring failover occurs automatically only when the Direct Connect path is unavailable.

Adım Adım Çözüm

1
Establish the primary connectivity model using AWS Transit Gateways and a Direct Connect Gateway.
Transit Gateways in us-east-1 and us-west-2 are associated with a single Direct Connect Gateway using transit virtual interfaces.
This supports multi-account, multi-region transit routing and allows the 12 spoke VPCs to communicate with each other and the on-premises data center.
2
Configure the backup IPsec VPN connection and enable dynamic routing using BGP.
Dynamic routing paths exist via both the Direct Connect Gateway and the IPsec VPN.
To allow automatic failover without manual routing table interventions.
3
Apply AS-path prepending on the VPN BGP session from the customer gateway.
The BGP route advertised over the VPN has a longer AS path than the route advertised over the Direct Connect connection.
This forces AWS to prefer the Direct Connect path for outbound traffic to the on-premises network under normal operating conditions.

Anahtar Kavram

Hybrid network connectivity design with Transit Gateway, Direct Connect, and VPN failover using BGP routing policies.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru