Examkin

Soru

Zorluk: OrtaAWS VPN, Direct Connect, and Transit Gateway Management

An organization is establishing a redundant hybrid network connection by deploying an AWS Site-to-Site VPN to act as a backup for a 1 Gbps1\text{ Gbps} AWS Direct Connect connection. Both the Direct Connect connection (via a Direct Connect Gateway) and the VPN connection terminate on an AWS Transit Gateway. The on-premises router advertises the local network prefix 192.168.0.0/16192.168.0.0/16 via BGP over both paths. The organization wants to ensure that the Direct Connect path is preferred for all traffic sent from AWS to the on-premises network, and that failover to the VPN path is automatic.

Which configuration steps should the SysOps Administrator perform to achieve this design? (Select TWO.)

  1. Confirm that the on-premises network prefix is propagated to the Transit Gateway route table from both the Direct Connect Gateway and the VPN attachments.Cevap
  2. B
    Configure the Transit Gateway route table with a static route for 192.168.0.0/16192.168.0.0/16 pointing to the Direct Connect Gateway attachment.
  3. C
    Associate the Direct Connect Gateway attachment and the VPN attachment with separate Transit Gateway route tables that do not share route information.
  4. Trust the default Transit Gateway route evaluation order, which automatically prefers propagated Direct Connect Gateway routes over propagated Site-to-Site VPN routes for identical prefixes.Cevap
  5. E
    Advertise a smaller Multi-Exit Discriminator (MED) value from the on-premises router over the VPN connection than over the Direct Connect connection.

Cevap

Confirm that the on-premises network prefix is propagated to the Transit Gateway route table from both the Direct Connect Gateway and the VPN attachments, and trust the default Transit Gateway route evaluation order, which automatically prefers propagated Direct Connect Gateway routes over propagated Site-to-Site VPN routes for identical prefixes.
To achieve automatic failover while preferring the Direct Connect path, both paths must propagate their routes to the same Transit Gateway route table. Under this configuration, the Transit Gateway automatically applies its default route evaluation preference for identical prefixes. Propagated routes from Direct Connect Gateway attachments are preferred over propagated routes from Site-to-Site VPN attachments. Therefore, the Direct Connect connection will be preferred under normal conditions, and failover to the VPN will occur automatically if the Direct Connect path is withdrawn.

Adım Adım Çözüm

1
Ensure that route propagation is enabled for both the Direct Connect Gateway attachment and the VPN attachment in the target Transit Gateway route table.
The Transit Gateway dynamically learns the 192.168.0.0/16192.168.0.0/16 route from both paths, enabling dynamic failover capabilities.
Both paths must be registered in the route table so that the backup path can be used automatically if the primary path is withdrawn.
2
Allow the Transit Gateway to select the path based on its default route evaluation order without adding static routes.
The Transit Gateway automatically directs traffic over the Direct Connect Gateway attachment when it is active, and switches to the VPN attachment if the Direct Connect route is lost.
AWS Transit Gateway evaluates propagated routes by preferring Direct Connect Gateway attachments over Site-to-Site VPN attachments when prefixes are identical.

Anahtar Kavram

AWS Transit Gateway Route Evaluation Preference
Bu soruyu puanla

Konular

AWS VPN, Direct Connect, and Transit Gateway Management

Bu konudan daha fazla soru