A company is planning to deploy many software-defined WAN (SD-WAN) sites. The company is using AWS Transit Gateway and has deployed a transit gateway…

The core requirement is to achieve at least 5 Gbps of throughput between an SD-WAN virtual appliance in a VPC and an AWS Transit Gateway. Standard IPsec VPN connections to a Transit Gateway are limited to 1.25 Gbps per tunnel. To meet the 5 Gbps requirement, a Transit Gateway Connect attachment is necessary.

A Transit Gateway Connect attachment builds a tunnel (using GRE or VXLAN) over a standard VPC attachment, allowing it to leverage the higher bandwidth of the underlying VPC connection. A single Connect peer supports up to 5 Gbps. The solution correctly describes the required steps: attaching the VPC to the Transit Gateway, creating a Connect attachment, and then configuring a Connect peer with BGP for dynamic routing. VXLAN is a common encapsulation protocol used by modern SD-WAN solutions, making it the most appropriate choice.

A. An IPsec VPN connection is limited to 1.25 Gbps. Two connections would only provide a maximum of 2.5 Gbps, which does not meet the 5 Gbps requirement.

B. While GRE is a supported protocol for Transit Gateway Connect, VXLAN is a more common and feature-rich encapsulation protocol specifically used by many modern SD-WAN solutions, making it a better fit.

C. This option also relies on IPsec VPN connections, which are insufficient for the required 5 Gbps throughput, providing only a maximum of 2.5 Gbps with two tunnels.

1. AWS Documentation: Transit Gateway Connect attachments: "A Connect attachment supports a single Connect peer (a single GRE tunnel). The maximum bandwidth for a Connect peer is 5 Gbps." This confirms that a Connect attachment is the correct mechanism to achieve the required throughput. The document also states, "You can use a Connect attachment to extend your SD-WAN infrastructure into AWS."

Source: AWS Documentation > Amazon VPC > User Guide > Transit gateways > Transit Gateway Connect attachments.

2. AWS Documentation: Create a Connect peer: "For Protocol, choose GRE or VXLAN." This confirms that both GRE and VXLAN are supported protocols for the tunnel encapsulation. VXLAN is a common standard for SD-WAN overlays.

Source: AWS Documentation > Amazon VPC > User Guide > Transit gateways > Transit Gateway Connect attachments > Create a Connect peer.

3. AWS Documentation: Site-to-Site VPN quotas: "Tunnels for a transit gateway... Throughput per VPN tunnel: Up to 1.25 Gbps." This official quota confirms that options A and C, which rely on IPsec VPNs, cannot meet the 5 Gbps requirement.

Source: AWS Documentation > AWS Site-to-Site VPN > User Guide > Site-to-Site VPN quotas.