ANS-C01 Question 335
Single answerYour company has a hybrid network setup with an on-premises data center connected to AWS via AWS Direct Connect. You need to ensure that failover to a backup VPN connection occurs only when the Direct Connect link becomes unavailable. What is the best way to achieve this?
- A
Configure BGP on both the Direct Connect and VPN connections, and set a lower local preference on the VPN connection.
- B
Use static routes for both the Direct Connect and VPN connections, with the VPN route having a higher metric.
- C
Configure BGP on both the Direct Connect and VPN connections, and set a higher AS_PATH length on the VPN connection.
- D
Use AWS Transit Gateway to manage the failover between Direct Connect and the VPN connection.
Show answer and explanation
Correct answer: C
Explanation
In a hybrid network setup, BGP is commonly used to dynamically manage routes between on-premises data centers and AWS. By setting a higher AS_PATH length on the VPN connection, BGP will prioritize the Direct Connect link as the primary route. If the Direct Connect link fails, the VPN connection will automatically take over, ensuring seamless failover. This method leverages BGP's inherent route prioritization and failover capabilities.
- A. Incorrect.
Setting a lower local preference on the VPN connection would not guarantee failover since local preference is used to prioritize routes within an Autonomous System, not between different links.
- B. Incorrect.
Using static routes with a higher metric on the VPN connection is not scalable and does not take advantage of BGP's dynamic route management capabilities.
- C. Correct.
Configuring BGP with a higher AS_PATH length on the VPN connection ensures that the VPN connection is considered a less preferred path. This way, failover to the VPN will only occur when the Direct Connect link becomes unavailable.
- D. Incorrect.
While AWS Transit Gateway can help manage hybrid connectivity, it does not inherently manage failover between Direct Connect and VPN connections without additional configuration. Additionally, this approach does not specifically address the routing preferences required for failover.