ANS-C01 Question 135
Select 2You are designing a hybrid cloud environment for a company that needs to establish connectivity between their on-premises data center and an Amazon VPC. The on-premises network uses BGP for dynamic routing. The company wants to ensure high availability and automatic failover for their VPN connection to AWS. Which of the following configurations should you implement to meet the requirements?
- A
Set up a Site-to-Site VPN connection with two tunnels and enable BGP for routing.
- B
Use static routes instead of BGP to simplify routing configuration.
- C
Configure two Customer Gateway devices in the on-premises network, each using a separate VPN connection to AWS.
- D
Enable Equal-Cost Multi-Path (ECMP) routing for the VPN connections in the VPC.
- E
Use AWS Direct Connect as the only method of connectivity and disable the VPN.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure high availability and automatic failover, the configuration must leverage multiple VPN tunnels and dynamic routing using BGP. BGP allows for automatic route updates and failover when a tunnel goes down, while enabling ECMP further enhances availability by distributing traffic across multiple paths. Static routes and reliance solely on Direct Connect do not provide the required level of redundancy and failover.
- A. Correct.
This is correct. Using two VPN tunnels with BGP ensures high availability and automatic failover. BGP dynamically updates routes in case of tunnel failure, meeting the requirement for automatic failover.
- B. Incorrect.
This is incorrect. Static routes do not support automatic failover or dynamic updates, which are essential for the high availability requirement.
- C. Incorrect.
This is incorrect. While having two Customer Gateway devices may add redundancy on the on-premises side, it does not address the need for automatic failover and dynamic routing updates.
- D. Correct.
This is correct. Enabling ECMP allows traffic to be split across multiple VPN tunnels, improving fault tolerance and providing high availability.
- E. Incorrect.
This is incorrect. While AWS Direct Connect provides a dedicated connection, relying solely on it without a VPN backup does not meet the high availability requirement in case of Direct Connect failure.