300-420 Question 182
Select 2An organization is designing a site-to-site VPN to securely connect its on-premises network to a hybrid cloud environment. The design must support high availability, redundant VPN connections, and seamless integration with the cloud provider's native VPN gateway. Which design considerations should the organization prioritize?
- A
Use Dynamic Multipoint VPN (DMVPN) to establish redundant tunnels to the cloud provider's VPN gateway.
- B
Ensure support for route-based VPNs that leverage Border Gateway Protocol (BGP) for dynamic routing.
- C
Configure IPsec with pre-shared keys only for simplicity and faster deployment.
- D
Design the VPN with multiple connections to different Availability Zones (AZs) within the cloud provider's infrastructure.
- E
Avoid using NAT traversal to simplify connectivity between the on-premises and cloud environments.
Show answer and explanation
Correct answers: B, D
Explanation
In hybrid cloud site-to-site VPN designs, route-based VPNs with BGP provide dynamic routing capabilities, which are essential for high availability and failover. Additionally, designing redundant connections to multiple cloud provider Availability Zones (AZs) ensures resilience and minimizes the impact of any single point of failure. These considerations align with best practices for secure and robust connectivity in hybrid environments.
- A. Incorrect.
Dynamic Multipoint VPN (DMVPN) is commonly used for scalable and redundant site-to-site connectivity in traditional on-premises environments, but it is not natively supported by most cloud providers' VPN gateways.
- B. Correct.
Route-based VPNs with BGP are essential for dynamic routing and high availability, especially in hybrid environments where the cloud provider supports dynamic route advertisement.
- C. Incorrect.
While IPsec with pre-shared keys is an option, it does not support the scalability and flexibility required for high availability in a hybrid cloud design. Certificates or stronger authentication methods are preferred.
- D. Correct.
Using multiple connections to different Availability Zones (AZs) ensures high availability and redundancy in the cloud provider's infrastructure, which is critical for hybrid cloud designs.
- E. Incorrect.
NAT traversal is essential for establishing VPN tunnels when devices are behind NAT, and its avoidance can cause connectivity issues in many environments.