An organization has an Azure subscription containing two peered virtual networks: `VNet-Co… — Microsoft Azure Administrator (AZ-104)

An organization has an Azure subscription containing two peered virtual networks: `VNet-Corp` (address space $10.150.0.0/16$ ) and `VNet-External` (address space $10.160.0.0/16$ ).

`VNet-Corp` contains three subnets:
- `Subnet-Transit` ( $10.150.1.0/24$ )
- `Subnet-App` ( $10.150.2.0/24$ )
- `Subnet-DB` ( $10.150.3.0/24$ )

A Network Virtual Appliance (NVA) with the private IP address $10.150.1.4$ is deployed in `Subnet-Transit`. IP forwarding is enabled on its network interface.

A route table named `RT-App` is associated with `Subnet-App`. The route table contains the following user-defined routes (UDRs):
- Route 1: Destination $10.150.0.0/16$ , Next hop type: `Virtual appliance`, Next hop: $10.150.1.4$
- Route 2: Destination $10.150.3.0/24$ , Next hop type: `Virtual network`
- Route 3: Destination $0.0.0.0/0$ , Next hop type: `Virtual appliance`, Next hop: $10.150.1.4$

A virtual machine in `Subnet-App` attempts to send traffic to the following destinations:
- Destination 1: $10.150.3.22$ (a database server in `Subnet-DB`)
- Destination 2: $10.160.5.5$ (a server in `VNet-External`)

Which next hops will Azure use to route the traffic to Destination 1 and Destination 2?

Destination 1: Virtual network; Destination 2: VNet peeringAnswer
B
Destination 1: Virtual appliance; Destination 2: Virtual appliance
C
Destination 1: Virtual network; Destination 2: Virtual appliance
D
Destination 1: Virtual appliance; Destination 2: VNet peering

Answer

Destination 1: Virtual network; Destination 2: VNet peering

For Destination 1 (10.150.3.22), Route 2 (10.150.3.0/24) has the longest matching prefix (/24), so its next hop type of Virtual network is used. For Destination 2 (10.160.5.5), the peered VNet system route (10.160.0.0/16) has a longer prefix match than the default route (0.0.0.0/0) in Route 3, so the system route wins and its next hop type of VNet peering is used.

Step-by-Step Solution

Analyze matching routes for Destination 1 (10.150.3.22)

Matching prefixes are 10.150.0.0/16 (UDR Route 1), 10.150.3.0/24 (UDR Route 2), and 0.0.0.0/0 (UDR Route 3).

To determine which route is used, we must identify all routes whose destination prefixes encompass the target IP.

Apply Longest Prefix Match (LPM) for Destination 1

The prefix 10.150.3.0/24 (/24) is longer than 10.150.0.0/16 (/16) and 0.0.0.0/0 (/0). The associated next hop is 'Virtual network'.

Azure selects the most specific route based on the longest prefix match algorithm.

Analyze matching routes for Destination 2 (10.160.5.5)

Matching prefixes are the peering system route 10.160.0.0/16 and UDR Route 3 (0.0.0.0/0).

When VNets are peered, Azure automatically adds a system route for the peered VNet's address space. We must evaluate UDRs against this system route.

Apply Longest Prefix Match (LPM) for Destination 2

The prefix 10.160.0.0/16 (/16) is longer than 0.0.0.0/0 (/0). The associated next hop is 'VNet peering'.

Since the peered VNet system route has a longer prefix than the UDR default route, the system route is selected, bypassing the NVA.

Key Concept

Route Selection Precedence and Longest Prefix Match (LPM) in Azure

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics