Question

A retail company hosts its inventory microservices on Cisco Catalyst SD-WAN branch routers that must reach an application published in a partner's AWS VPC. The partner exposes the application only through an AWS PrivateLink endpoint service and will not accept traffic over the public internet. The company already terminates its cloud gateway in a hub VPC using a Cisco Cloud OnRamp for Multicloud deployment. Which approach lets the branches consume the partner's application while keeping the traffic off the public internet?

Accepted Answer

Create an interface VPC endpoint in the hub VPC that connects to the partner's endpoint service, and advertise the endpoint's private IP into the SD-WAN fabric

Answer

Assign the partner application an Elastic IP and have branches reach it over an internet-based IPsec overlay to the AWS Internet Gateway

Answer

Configure a NAT gateway in the hub VPC so branch traffic is source-translated to the partner's public API endpoint

Answer

Establish VPC peering directly between each branch site's local network and the partner VPC to access the endpoint service