QuestionQ265
Network DesignA company plans to migrate to AWS by using an AWS Transit Gateway hub-and-spoke architecture. Its current on-premises Multiprotocol Label Switching (MPLS) network has strict controls that enforce network segmentation through MPLS VPNs. The company has provisioned two 10 Gbps AWS Direct Connect connections to deliver resilient, high-speed, low-latency connectivity to AWS.
A security engineer must apply network-segmentation principles in AWS so that virtual routing and forwarding (VRF) is logically isolated for each of the company’s software development environments. The number of MPLS VPNs will grow in the future. The on-premises MPLS VPNs will have overlapping address space. The AWS network design must support overlapping address space for the VPNs.
Which solution satisfies these requirements with the LEAST operational overhead?
- A Deploy a software-defined WAN (SD-WAN) head-end virtual appliance and an SD-WAN controller into a Transit Gateway Connect VPC. Configure the company's edge routers to be managed by the new SD-WAN controller and to use SD-WAN to segment the traffic into the defined segments for each of the company's development environments.
- B Configure IPsec VPNs on the company edge routers for each MPLS VPN for each of the company's development environments. Attach each IPsec VPN tunnel to a discrete MPLS VPN. Configure AWS Site-to-Site VPN connections that terminate at a transit gateway for each MPLS VPN. Configure a transit gateway route table that matches the MPLS VPN for each Transit Gateway VPN attachment.
- C Create a transit VPC that terminates at the AWS Site-to-Site VRF-aware IPsec VPN. Configure IPsec VPN connections to each VPC for each of the company's development environment VRFs.
- D Configure a Transit Gateway Connect attachment for each MPLS VPN between the company's edge routers and Transit Gateway. Configure a transit gateway route table that matches the MPLS VPN for each of the company's development environments.
Community Discussion