A company wants to attach a third-party SD-WAN appliance to a transit gateway using GRE and BGP, with more throughput than a Site-to-Site VPN tunnel provides. Which attachment type should it use?
Show answer and explanation
Answer: B
Transit Gateway Connect is purpose-built for this case: it runs a GRE tunnel to the SD-WAN appliance with BGP peering for dynamic route exchange, and each Connect attachment supports up to 5 Gbps, well above a single IPsec VPN tunnel. It also carries the appliance's routing decisions into the transit gateway so branch and VPC routes are learned automatically rather than configured by hand.
Why the other options are wrong
- A. Client VPN is for individual remote users and cannot act as a site-to-site SD-WAN attachment.
- C. A VPC attachment connects a VPC to the transit gateway and does not provide the GRE and BGP tunnel the SD-WAN appliance expects.
- D. A Direct Connect gateway serves private or transit virtual interfaces over a dedicated circuit, not GRE-based SD-WAN peering.
Exam tip. Connect attachments equal GRE plus BGP and are the high-bandwidth path for SD-WAN into a transit gateway.