How to make one AWS Direct Connect connection primary and the other failover-only?

A company has two data centers that are interconnected with multiple redundant links from different suppliers. The company Uses IP addresses that are within the 172.16,0.0/16 CIDR block. The company is running iBGP between the two data centers by using a private Autonomous System Number (ASN) and IGP. The company is moving toward a hybrid setup in which the company will initially use one VPC in the AWS Cloud. An AWS Direct Connect connection runs from the first data center to a Direct Connect gateway by using a private VIF. On the connection, the company advertises a summarized route for the 172.16.0.0/16 network. The company is planning to set up a second summarized route from the second data center to a different Direct Connect location. The company needs to implement a solution to route traffic to and from AWS through the first Direct Connect connection. The solution must use the second Direct Connect connection for failover purposes only. Which solution will meet these requirements?

Prepend the private ASN on the BGP announcements to AWS from the second data center. Add a second VIF in the first Direct Connect connection. Advertise the same network without any prepends from the first data center. Implement the same setup for the BGP announcement from AWS to the two data centers.
Tag the BGP announcements with the local preference BGP community tags. Set the tag to high preference for the first data center. Set the tag to low preference for the second data center. Source Reference Answer
Configure the Direct Connect gateway to prefer routing through the Direct Connect connection with the first data center. Configure the second data center’s router to have a lower local preference for the direct AWS BGP advertisements than for the advertisement from the first data center.
Configure the focal AWS Region BGP community tag on the BGP route that is advertised from the fist data center. Configure AS_PATH prepends on the BGP announcements from the second data center.

Community Votes

45%

35%

20%

45% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your understanding of AWS-specific BGP mechanisms for private VIFs versus public VIFs; the common trap is thinking that regional AWS BGP community tags or AS_PATH prepending alone can handle both traffic directions.

The correct solution is to use AWS Direct Connect BGP community tags, assigning a high-preference tag to the primary data center's advertised prefix and a low-preference tag to the secondary prefix, so the second connection is used only for failover. The community consensus favors B, with many candidates incorrectly selecting D due to confusion between private-VIF preference communities and public-VIF regional BGP communities.

The most common wrong answer is D, which combines a regional AWS BGP community tag with AS_PATH prepends. Candidates pick it because it uses both a community tag and prepends, but the regional community tags apply to public virtual interfaces, not private VIFs, and AS_PATH prepending only affects AWS's outbound path selection, not on-premises-to-AWS traffic.

Community Discussion (8 comments)

46f094c 👍 2 Selected: B

B is the only one taking into consideration out (aws-dtc with prepend from the DTC) and in traffic (dtc-aws with local pref in the second DTC pointing to the primary). A: prepend is only be user from DTC to AWS, but not from AWS to DTC C: can't configure preference in a DXG D: talks about regions but there no region in the question, plus they are used for diferent purposes. Filtering/manupulation at the DTC, propagation at AWS

woorkim 👍 1

B is correct! To support failover across multiple AWS Direct Connect connections (active/passive), apply a community tag with a higher preference to the prefixes for the primary or active virtual interface and a lower preference to the prefixes for the backup or passive virtual interface. For example, set the BGP community tags for your primary or active virtual interfaces to 7224:7300 (high preference) and 7224:7100 (low preference) for your passive virtual interfaces. Local preference BGP community tags are evaluated before any AS_PATH attribute, and are evaluated in order from lowest to highest preference (where highest preference is preferred).

meseerie 👍 4 Selected: D

After reading the following answers seems to be D https://docs.aws.amazon.com/directconnect/latest/UserGuide/routing-and-bgp.html

siheom 👍 1 Selected: A

VOTE A

VerRi 👍 3 Selected: A

A. updating AS_PATH for both 1st and 2nd data centres, making 2nd data centre less preferable. When 1st is down, they will switch to 2nd. B. local preference in BGP is used to control outbound traffic. The question says "to route traffic to and from AWS" so it does not cover the inbound C.DXG does not handle this level of config D. It suggests using both community tags and AS_PATH prepends, but for the same reason as B

luisgu 👍 3 Selected: B

local region BGP communities do not apply in this case; only for public VIFs

cas_tori 👍 3 Selected: D

this is D

aragon_saa 👍 4 Selected: B

Answer is B

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Direct Connect path selection requires controlling two directions

When two Direct Connect connections advertise the same 172.16.0.0/16 prefix, both AWS and your on-premises routers must decide which path to use. Traffic from AWS to your data centers is controlled by the BGP attributes of the routes you advertise to AWS. Traffic from your data centers to AWS is controlled by the BGP attributes of the VPC routes that AWS advertises to you. An active/backup design must make the first connection preferred in both directions.

Why B is correct

Option B is the only one that uses the AWS-supported private VIF BGP preference communities. You tag the prefix advertised from the first data center with a higher-preference BGP community and the same prefix advertised from the second data center with a lower-preference BGP community. AWS treats these community tags as a local-preference-like value when choosing the path for traffic returning to your on-premises network. Combined with standard BGP local-preference settings on your own routers, this achieves the required primary/failover behavior. Community voting strongly agrees: B received 45 votes, while D received 35 and A received 20. Comments such as the one from user 46f094c also point out that B accounts for both AWS-to-on-premises and on-premises-to-AWS traffic when paired with local preference.

Why A, C, and D are wrong

A proposes AS_PATH prepending from the second data center to AWS and adding a second VIF in the first connection. AS_PATH prepending affects AWS's route selection, but the second half of the option says to implement the same setup for BGP announcements from AWS to the data centers. AWS does not allow you to prepend AS_PATH on the routes it advertises over a Direct Connect private VIF; you must influence inbound traffic with local preference on your own routers. Adding a second VIF in the first connection is unnecessary and does not solve the failover requirement.

C suggests configuring the Direct Connect gateway to prefer one connection. A Direct Connect gateway is a BGP router; you cannot force it to prefer a specific VIF through configuration. It selects routes based on BGP attributes received from each VIF. Also, setting a lower local preference on the second data center's router for AWS advertisements only addresses on-premises outbound routing, not AWS outbound routing.

D is the most popular wrong choice. The regional AWS BGP community tags (for example, local-region communities) apply to public virtual interfaces, not to private VIFs. This scenario uses a private VIF attached to a Direct Connect gateway, so those regional communities are not applicable. While AS_PATH prepending from the second data center would make its route less attractive to AWS, the wrong community mechanism and the missing on-premises inbound control make D invalid. Several users, such as luisgu, correctly note that local-region BGP communities are only for public VIFs and do not apply here.

Final recommendation

To meet the requirement, apply the high-preference BGP community tag to the first data center's advertised prefix and the low-preference tag to the second data center's advertised prefix. Also configure local preference on your on-premises routers so that the VPC prefix received from the first Direct Connect location is preferred. This dual approach ensures traffic flows both to and from AWS through the first connection, with the second connection reserved for failover.

Official Reference

Exam Strategy

Separate the two traffic directions when analyzing any Direct Connect BGP question: AWS outbound is governed by attributes of routes you advertise to AWS, while on-premises outbound is governed by attributes of routes you receive from AWS. Then look for the option that uses the correct AWS private-VIF BGP community mechanism rather than relying only on AS_PATH prepending or public-VIF regional communities.

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide