A company has established an AWS Site-to-Site VPN connection between their on-premises network () and a VPC () using a Virtual Private Gateway. The VPN tunnel status is active. A SysOps administrator deploys a database server on an Amazon EC2 instance in a private subnet (). The database server needs to communicate with an application server running on-premises (). However, network tests show that the database server cannot reach the on-premises server. Which action should the administrator take to resolve this connectivity issue?
- AAdd a route to targeting the Internet Gateway in the private subnet's route table.
- BCreate an Amazon S3 VPC Gateway Endpoint and associate it with the private subnet's route table.
- Enable route propagation for the virtual private gateway on the route table associated with the private subnet.Cevap
- DUpdate the private subnet's Network ACL to allow outbound traffic to the on-premises network, while blocking all inbound traffic from the on-premises network.
Cevap
Enable route propagation for the virtual private gateway on the route table associated with the private subnet.
Enabling route propagation dynamically adds the VPN routes to the subnet's route table, directing on-premises destined traffic to the virtual private gateway.
Adım Adım Çözüm
Anahtar Kavram
For instances in a VPC to communicate with an on-premises network via a Virtual Private Gateway (VGW), the route table associated with their subnets must contain routes directing the on-premises CIDR block to the VGW. This can be configured statically or dynamically using route propagation.