ANS-C01 · Question #213
A company has an AWS Site-to-Site VPN connection between AWS and its branch office. A network engineer is troubleshooting connectivity issues that the connection is experiencing. The VPN connection…
The correct answer is A. Determine a supernet for the branch office. In the transit gateway route table, add an aggregate. The problem is that static routes in the Transit Gateway route table are outdated due to branch office subnet expansion. The goal is to update routing with minimal administrative overhead for future changes.
Question
A company has an AWS Site-to-Site VPN connection between AWS and its branch office. A network engineer is troubleshooting connectivity issues that the connection is experiencing. The VPN connection terminates at a transit gateway and is statically routed. In the transit gateway route table, there are several static route entries that target specific subnets at the branch office. The network engineer determines that the root cause of the issues was the expansion of underlying subnet ranges in the branch office during routine maintenance. Which solution will solve this problem with the LEAST administrative overhead for future expansion efforts?
Options
- ADetermine a supernet for the branch office. In the transit gateway route table, add an aggregate
- BCreate an AWS Direct Connect gateway and a transit VIF. Associate the Direct Connect gateway
- CCreate a dynamically routed VPN connection on the transit gateway. Connect the dynamically
- DCreate a prefix list that contains the new subnets and the old subnets for the branch office.
How the community answered
(22 responses)- A73% (16)
- B5% (1)
- C9% (2)
- D14% (3)
Why each option
The problem is that static routes in the Transit Gateway route table are outdated due to branch office subnet expansion. The goal is to update routing with minimal administrative overhead for future changes.
Determining a supernet (aggregate CIDR block) for the branch office and configuring this single aggregate static route in the transit gateway route table will simplify routing. This approach ensures that future expansions of subnets within that supernet range in the branch office will not require changes to the transit gateway route table, thus minimizing administrative overhead.
AWS Direct Connect is a dedicated network connection, which is a different service and a more significant infrastructure change than updating VPN routes, increasing complexity and cost.
Creating a dynamically routed VPN connection (using BGP) is a valid solution, but it involves reconfiguring the existing VPN connection and possibly the on-premises router, which is more administrative overhead than simply adjusting a static route to an aggregate.
Creating a prefix list for *each* new subnet and old subnet still requires manual updates whenever subnets change or expand, which does not minimize administrative overhead for future expansions.
Concept tested: AWS Site-to-Site VPN static routing aggregation
Source: https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-route-tables.html
Community Discussion
No community discussion yet for this question.