Question
A company has multiple AWS accounts. Each account contains one or more VPCs. A new security guideline requires the inspection of all traffic between VPCs.
The company has deployed a transit gateway that provides connectivity between all VPCs. The company also has deployed a shared services VPC with Amazon EC2 instances that include IDS services for stateful inspection. The EC2 instances are deployed across three Availability Zones. The company has set up VPC associations and routing on the transit gateway. The company has migrated a few test VPCs to the new solution for traffic inspection.
Soon after the configuration of routing, the company receives reports of intermittent connections for traffic that crosses Availability Zones.
What should a network engineer do to resolve this issue?
- A. Modify the transit gateway VPC attachment on the shared services VPC by enabling cross-Availability Zone load balancing.
- B. Modify the transit gateway VPC attachment on the shared services VPC by enabling appliance mode support. Correct
- C. Modify the transit gateway by selecting VPN equal-cost multi-path (ECMP) routing support.
- D. Modify the transit gateway by selecting multicast support.
Explanation
B is correct. By default a transit gateway sends traffic to the attachment network interface in the same Availability Zone as the source, so the forward and return paths of a flow that crosses Availability Zones can reach different IDS instances. A stateful appliance that sees only one direction drops the traffic, which causes the intermittent connections. Enabling appliance mode support on the shared services VPC attachment makes the transit gateway pick one network interface (one Availability Zone) for the life of the flow, so both directions pass through the same appliance. A is wrong because transit gateway attachments have no cross-zone load balancing setting. VPN ECMP (C) and multicast (D) do not affect symmetric routing of VPC traffic.
