What changes are required to enable communication with the external vendor?

By:
In: SAP-C01
Tagged:
With: 1 Comment
A company is adding a new approved external vendor that only supports IPv6 connectivity.The company’s backend systems sit in the private subnet of anAmazon VPC.The company uses a NAT gateway to allow these systems to communicate with external vendors over IPv4.Company policy requires systems that communicate with external vendors to use a security group that limits access to only approved external vendors.The virtual private cloud (VPC) uses the default network ACL.The Systems Operator successfully assigns IPv6 addresses to each of the backend systems.The Systems Operator also updates the outbound security group to include the IPv6 CIDR of the external vendor (destination).The systems within the VPC are able to ping one another successfully over IPv6.However, these systems are unable to communicate with the external vendor.

What changes are required to enable communication with the external vendor?

Create an IPv6 NAT instance. Add a route for destination 0.0.0.0/0 pointing to the NAT instance.

Enable IPv6 on the NAT gateway. Add a route for destination ::/0 pointing to the NAT gateway.

Enable IPv6 on the internet gateway. Add a route for destination 0.0.0.0/0 pointing to the IGW.

Create an egress-only internet gateway. Add a route for destination ::/0 pointing to the gateway.

Explanations:

An IPv6 NAT instance is not required. NAT instances are primarily used for IPv4. Adding a route for 0.0.0.0/0 is irrelevant for IPv6 communications.

NAT gateways do not support IPv6. Therefore, enabling IPv6 on a NAT gateway and adding a route for ::/0 is not applicable.

While enabling IPv6 on an internet gateway is necessary for IPv6 traffic, adding a route for 0.0.0.0/0 is intended for IPv4, not IPv6.

An egress-only internet gateway allows outbound IPv6 traffic while preventing unsolicited inbound traffic. Adding a route for ::/0 pointing to the egress-only internet gateway is necessary for enabling outbound communication to the external vendor over IPv6.

2025-10-05

1 Comment

  1. Jeffrey
    Author

    I assess that the answer is:
    Create an egress-only internet gateway. Add a route for destination ::/0 pointing to the gateway.

Leave a Reply to Jeffrey Cancel reply

Your email address will not be published. Required fields are marked *

two − 1 =