Resolving Inter-Region Asymmetric Routing with Transit Gateway Appliance Mode

Design a routing strategy and connectivity architecture between on-premises networks and the AWS Cloud. Monitor and analyze network traffic to troubleshoot and optimize connectivity patterns.

Answer Correct answer: D — Enable Appliance Mode on both the transit gateway attachments for the inspection VPC to force symmetric routing.

A US-based company is expanding its business to Europe. A network engineer needs to extend the company's network infrastructure by setting up a new hub and spoke architecture in the eu-west-1 Region. The network engineer uses a transit gateway peering connection to connect the new resources in eu-west-1 to an existing environment in the us-east-1 Region. The hub and spoke architecture in each AWS Region includes an inspection VPC that uses AWS Network Firewall to centralize traffic inspection for each Region. To reduce costs, the network engineer decides to inspect inter-Region traffic by using the inspection VPC in the Region that originates the traffic. The network engineer configures the transit gateway route tables accordingly for each Region. When the network engineer tests the new architecture, communication within each Region works as expected. However, the network engineer finds that inter-Region communication is not working. The network engineer must resolve the inter-Region communication issue. Which solution will meet this requirement?

Configure Open Shortest Path First (OSPF) routing on the transit gateway peering connection to propagate the VPC CIDR blocks from each Region to the remote peer.
Use AWS Resource Access Manager (AWS RAM) to share access between the transit gateways. Enable the Allow sharing with anyone setting.
Prevent asymmetric routing in the inspection VPCs by ensuring that both requests and responses are inspected by the same inspection VPC
Enable Appliance mode on both the transit gateway attachments for the inspection VPC. Correct Answer

Community Insight

The core concept tested is AWS Transit Gateway appliance mode, which forces return traffic to traverse the same inspection appliance as outbound traffic, resolving the asymmetry that breaks stateful firewalls like Network Firewall.

This question addresses inter-Region communication failures in a hub-and-spoke architecture due to asymmetric routing through inspection VPCs. The correct solution involves enabling appliance mode on transit gateway attachments to ensure bidirectional traffic symmetry.

Many learners incorrectly select Option C, focusing on the conceptual problem of asymmetric routing without recognizing that Appliance Mode (Option D) is the specific technical mechanism required to fix it at the Transit Gateway level.

Community Discussion (4 comments)

K0nAn 👍 2 Selected: C

Should be C, as appliance mode is important but intra-region traffic works. It means, it is already there. We need to check routing to avoid asymmetric routing

ashk123456 👍 3 Selected: D

In a hub-and-spoke architecture using AWS Transit Gateway, when traffic is routed to an inspection VPC (which contains AWS Network Firewall), the traffic path must remain symmetric—meaning that both request and response traffic must pass through the same inspection VPC. By default, AWS Transit Gateway performs packet routing optimally, which can sometimes lead to asymmetric routing issues when using an inspection VPC.

woorkim 👍 4

D is correct! A (Configure OSPF routing): AWS Transit Gateway does not support dynamic routing protocols like OSPF. Instead, it uses static routes or BGP for route propagation in Direct Connect scenarios. B (Use AWS RAM to share access): AWS RAM is used to share transit gateways across accounts, not for enabling inter-Region communication or fixing routing issues. C (Prevent asymmetric routing in the inspection VPCs): While preventing asymmetric routing is important, the root cause here is the lack of appliance mode. Simply ensuring symmetry without enabling appliance mode will not resolve the issue.

kowal_001 👍 4 Selected: D

Enable Appliance Mode on the transit gateway attachments for both inspection VPCs in the us-east-1 and eu-west-1 Regions. This ensures that bidirectional traffic passes through the same inspection VPC, resolving the asymmetric routing issue and enabling inter-Region communication.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Correct answer: D — Enabling Appliance Mode ensures symmetric routing for stateful services. Enabling Appliance Mode on the Transit Gateway attachments attached to the inspection VPCs forces all return traffic to be routed back through the same attachment from which the original request originated. This resolves the asymmetric routing issue caused by the optimization of routes across Regions, ensuring that traffic inspected by AWS Network Firewall in the originating Region can be successfully returned via the same path.

Why the Other Options Are Wrong

Option A is incorrect because Transit Gateways do not support dynamic routing protocols like OSPF; they rely on static route propagation or BGP over Direct Connect. Option B is incorrect because AWS RAM is used for sharing resources across accounts, not for fixing routing logic or connectivity issues within a single account's multi-Region setup. Option C describes the desired outcome (preventing asymmetric routing) but does not provide the configuration step required to achieve it; Appliance Mode is the specific setting needed to enforce this behavior.

Community Comment Notes

Community consensus strongly favors Option D, with multiple users noting that Appliance Mode is essential for maintaining traffic symmetry in inspection VPCs. One user highlighted that while intra-region traffic works, the inter-region failure points directly to the need for enforced return paths. Another comment clarified that Appliance Mode is the technical implementation of preventing asymmetric routing, distinguishing it from the general goal described in Option C.

Exam Strategy

When dealing with inspection VPCs and Transit Gateways, always consider Appliance Mode if you suspect asymmetric routing is breaking stateful connections. Remember that dynamic routing (OSPF/BGP) is not natively supported by TGW attachments in the same way as VPCs.

Frequently Asked Questions

Why doesn't Option C solve the problem?

Option C describes the goal (preventing asymmetric routing), but Option D provides the specific configuration (Appliance Mode) required to achieve that goal on an AWS Transit Gateway.

Can I use OSPF to fix this routing issue?

No, AWS Transit Gateway attachments do not support dynamic routing protocols like OSPF. Route propagation must be handled via static routes or BGP over Direct Connect.

More ANS-C01 FAQ →

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide