Connect an on-premises network to a VPC with Site-to-Site VPN.
Switch to an alternate path dynamically if one tunnel fails.
Which configuration is most appropriate?
Use both VPN tunnels and dynamic routing with BGP for route exchange and failover.
Detailed explanation
S3 replication does not create network routes.
S3 replication does not create network routes.
A single failed tunnel leaves no alternate path.
A single failed tunnel leaves no alternate path.
DNS routing is not VPN tunnel route exchange.
DNS routing is not VPN tunnel route exchange.
Redundant tunnels and BGP route exchange provide an alternate path when one tunnel fails.
Redundant tunnels and BGP route exchange provide an alternate path when one tunnel fails.
Check official documentation
Compare the following points with the official documentation.
AWS Site-to-Site VPN dynamic routing BGPの公式説明を確認する。
What to confirm
DNSフェイルオーバーとVPN経路交換の違いを説明できる。
Key points
- Site-to-Site VPN
- BGP
- Redundant tunnel
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Dynamic failover
BGP can change the preferred route as tunnel reachability changes.
Tunnel versus DNS
VPN route exchange changes packet paths directly; DNS records only influence name resolution.