Question

A company runs an SD-WAN virtual appliance on an EC2 instance inside a VPC that is attached to a Transit Gateway. The networking team wants the appliance to exchange dynamic routes with the Transit Gateway and achieve higher throughput than a standard IPsec VPN attachment, without terminating IPsec on the Transit Gateway itself. Which approach meets these requirements?

Accepted Answer

Create a Transit Gateway Connect attachment over the existing VPC attachment, using GRE tunnels and BGP for dynamic routing to the SD-WAN appliance.

Answer

Create a Site-to-Site VPN attachment on the Transit Gateway with BGP enabled and ECMP across two tunnels to the appliance.

Answer

Create a Transit Gateway peering attachment between the appliance's VPC and the Transit Gateway to enable BGP route exchange.

Answer

Enable route propagation from the VPC attachment and attach a customer gateway pointing at the appliance's private IP.