Symmetric Routing and Failover with Direct Connect and VPN Backup
A company is deploying a hybrid network with AWS Direct Connect and a VPN backup. The Direct Connect virtual interface is configured for private VIF with BGP. The VPN uses IPsec tunnels over the internet. What is the best practice to ensure symmetric routing and failover?
Quick Answer
The answer is to use the same BGP ASN for both Direct Connect and VPN, and set a higher MED on the VPN routes. This configuration ensures symmetric routing by making AWS treat both connections as a single BGP session, allowing you to control active/passive failover through the Multi-Exit Discriminator attribute, where the higher MED on the VPN path makes it the backup. On the ANS-C01 exam, this question tests your understanding of BGP path selection and hybrid network design, specifically how to maintain traffic symmetry when combining a private VIF with a VPN backup—a common trap is assuming different ASNs are needed for separate connections, which would cause asymmetric routing. Remember the key memory tip: same ASN, higher MED on the backup; this keeps traffic flowing symmetrically and ensures failover works predictably.
⚠ Common exam trap
Test-takers frequently assume different ASNs are required for path preference, but AWS mandates the same ASN for private VIF and VPN to prevent BGP loop detection, and MED is the correct mechanism to influence inbound traffic preference.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.
Using the same BGP ASN for both Direct Connect and VPN, and setting a higher MED on the VPN routes, ensures symmetric routing by making the Direct Connect path more preferred. AWS uses the BGP AS_PATH length as a tie-breaker; with the same ASN, the paths are equal in AS_PATH length, so MED is evaluated. A higher MED on the VPN routes causes AWS to prefer the Direct Connect path, and if Direct Connect fails, the VPN routes (with higher MED) become active, providing failover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure ASN prepending on the VPN BGP advertisements to make them less preferred.
Why it's wrong here
ASN prepending is one method, but not the best practice for symmetric routing; it's used to influence path selection.
- ✗
Use different BGP ASNs for Direct Connect and VPN to allow AWS to prefer the Direct Connect path.
Why it's wrong here
Different ASNs can cause asymmetric routing and are not recommended for failover.
- ✗
Disable BGP on the Direct Connect private VIF and use static routes to force traffic through Direct Connect.
Why it's wrong here
Private VIF requires BGP; static routes are not supported on private VIF.
- ✓
Use the same BGP ASN for both Direct Connect and VPN, and set a higher MED (Multi-Exit Discriminator) on the VPN routes.
Why this is correct
Same ASN ensures AWS sees both as same neighbor, and MED controls preference.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a hybrid network using AWS Direct Connect and VPN backup. The company wants to ensure that traffic always uses Direct Connect when it is available. Which TWO configurations should be implemented? (Choose TWO.)
medium- ✓ A.Use AS_PATH prepending on the VPN BGP session to make the VPN path less preferred.
- ✓ B.Advertise more specific prefixes over Direct Connect and less specific prefixes over VPN.
- C.Disable BGP on the VPN connection to force traffic to Direct Connect.
- D.Set a lower MED value on the Direct Connect BGP session.
- E.Advertise the same prefixes over both connections with the same AS_PATH length.
Why A: AS_PATH prepending on the VPN BGP session increases the AS_PATH length for routes advertised over the VPN, making them less preferred compared to the same routes learned over Direct Connect with a shorter AS_PATH. BGP selects the path with the shortest AS_PATH length, so traffic will use Direct Connect when it is available. This is a standard technique for influencing outbound traffic path selection in a hybrid network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.