A customer has established an AWS Direct Connect connection to AWS.
The link is up and routes are being advertised from the customer's end.
However, the customer cannot connect from EC2 instances inside its VPC to servers residing in its data center.
Click on the arrows to vote for the correct answer
A. B. C. D. E.Answers - B & E.
Option A is incorrect because adding an option of VPN is unnecessary.
Option B is CORRECT because VGW is the other side of the connection (on the AWS side) and the route propagation needs to be enabled for the Direct Connect to work.
Option C is incorrect because there is no such configuration in the Virtual Private Gateway.
Option D is incorrect because there is no “route” command available on the instances in the VPC.Option E is correct because to advertise prefixes to Amazon, for Prefixes you want to advertise, enter the IPv4 CIDR destination addresses (separated by commas) to which traffic should be routed over the virtual interface.
( under Additional Settings )
https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.htmlThe scenario described in the question suggests that the customer has established a Direct Connect (DX) connection between their on-premises data center and AWS. However, even though the DX link is up and routes are being advertised from the customer's end, EC2 instances inside the VPC are unable to connect to servers in the customer's data center. To resolve this issue, we need to identify the correct solution from the options provided.
Option A suggests adding a route to the route table with an IPsec VPN connection as the target. This option is not suitable in the given scenario because the customer has established a Direct Connect connection, and adding an IPsec VPN connection would not be necessary.
Option B suggests enabling route propagation to the Virtual Private Gateway (VGW). This option may help in resolving the issue because VGW is the logical representation of the customer gateway that connects their VPC with their on-premises network. By enabling route propagation, the routes advertised by the customer's on-premises router can be propagated to the VGW and subsequently to the VPC route tables. Therefore, this option is a potential solution to the issue described in the question.
Option C suggests opening port 80 in the security group of the Virtual Private Gateway (VGW). However, VGW does not have a security group associated with it, so this option is not applicable in the given scenario.
Option D suggests modifying the route table of all instances using the "route" command. While this option may work, it is not a scalable solution, and it would require manual intervention each time a new instance is launched in the VPC. Therefore, this option is not recommended.
Option E suggests entering the IPv4 destination addresses for routing the traffic over VGW. This option is not suitable because the customer is already advertising routes from their on-premises network over the Direct Connect connection, and the goal is to enable EC2 instances in the VPC to access resources in the on-premises network.
In summary, the correct answer to the given question is Option B, which suggests enabling route propagation to the Virtual Private Gateway (VGW). By doing so, the routes advertised by the customer's on-premises router can be propagated to the VGW and subsequently to the VPC route tables, enabling EC2 instances in the VPC to access resources in the on-premises network.