An enterprise uses an AWS Transit Gateway to connect multiple VPCs to their on-premises ne… — AWS Certified SysOps Administrator - Associate

An enterprise uses an AWS Transit Gateway to connect multiple VPCs to their on-premises network. The primary path is a $10\text{ Gbps}$ AWS Direct Connect connection via a Transit VIF associated with a Direct Connect gateway attached to the Transit Gateway. A Site-to-Site VPN connection is established directly to the Transit Gateway as a backup path. Both paths advertise the corporate network range of $172.16.0.0/12$ using BGP.

During a failover test, a SysOps administrator disables the BGP session on the Direct Connect connection. However, traffic destined for the corporate network is dropped instead of failing over to the backup Site-to-Site VPN. Inspection of the Transit Gateway route table reveals a manually configured static route for $172.16.0.0/12$ pointing to the Direct Connect gateway attachment.

Which two actions must the SysOps administrator take to resolve this issue and ensure automatic failover to the VPN connection? (Select TWO.)

Enable route propagation for both the Direct Connect gateway attachment and the Site-to-Site VPN attachment in the Transit Gateway route table.Cevap
Delete the static route for $172.16.0.0/12$ from the Transit Gateway route table.Cevap
C
Configure AS Path prepending on the Site-to-Site VPN connection inside the Transit Gateway route table to deprioritize the VPN path.
D
Create a new public virtual interface (VIF) on the Direct Connect connection and associate it directly with the Transit Gateway.
E
Configure a virtual private gateway (VGW) in each VPC and add static routes pointing to the VGW for the on-premises range.

Cevap

Enable route propagation for both the Direct Connect gateway attachment and the Site-to-Site VPN attachment in the Transit Gateway route table, and delete the static route for the on-premises range from the Transit Gateway route table.

The correct options are deleting the manual static route and enabling route propagation for both attachments. In AWS Transit Gateway, static routes always take precedence over propagated routes. When a static route exists, traffic is sent to the target attachment regardless of the state of the underlying BGP session, resulting in blackholed traffic if the link is down. Deleting the static route allows dynamic routing to take over. Once the static route is removed, enabling route propagation ensures that both paths are dynamically learned. AWS Transit Gateway automatically prefers Direct Connect gateway attachments over Site-to-Site VPN attachments when both advertise the same prefix, meaning the Direct Connect path will be used under normal conditions, and traffic will fail over to the VPN path only if the Direct Connect BGP session goes down.

Adım Adım Çözüm

Analyze the routing precedence in the Transit Gateway route table.

Identify that the manual static route for

172.16.0.0/12

takes precedence over any dynamically propagated routes, preventing traffic from failing over when the Direct Connect BGP session goes down.

Static routes always override propagated routes in AWS Transit Gateway routing tables.

Remove the static routing constraint.

Delete the static route for

172.16.0.0/12

pointing to the Direct Connect gateway attachment.

Removing the static route allows dynamic routing protocols (BGP) to dictate path selection.

Configure dynamic route propagation.

Enable route propagation for both the Direct Connect gateway attachment and the Site-to-Site VPN attachment in the Transit Gateway route table.

Enabling propagation allows the TGW to dynamically add and remove the routes based on BGP status. Under normal conditions, TGW automatically prefers Direct Connect gateway attachments over Site-to-Site VPN attachments for identical prefixes.

Anahtar Kavram

AWS Transit Gateway Routing Precedence and Dynamic Failover

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru