You plan to deploy an Azure Firewall to secure outbound traffic from a subnet named Subnet-App in a virtual network named VNet-Prod. You need to configure the networking environment to allow the firewall deployment and force all outbound internet traffic from Subnet-App through the firewall. Which of the following configuration actions must you perform? (Select TWO.)
- Create a dedicated subnet named AzureFirewallSubnet in VNet-Prod with an address prefix of at least /26.Answer
- Create a route table associated with Subnet-App and add a route for 0.0.0.0/0 with the next hop type set to Virtual appliance pointing to the firewall's private IP address.Answer
- CCreate a route table associated with Subnet-App and add a route for 0.0.0.0/0 with the next hop type set to Virtual network gateway pointing to the firewall's private IP address.
- DConfigure virtual network peering between VNet-Prod and a hub network containing the firewall, enabling gateway transit to automatically route internet traffic.
Answer
Deploy the firewall in a dedicated subnet named AzureFirewallSubnet with a prefix of /26 or larger, and route the traffic from the application subnet using a User-Defined Route (UDR) with the next hop type set to Virtual appliance pointing to the firewall's private IP address.
Deploying Azure Firewall successfully requires a dedicated subnet named AzureFirewallSubnet with a prefix of at least /26. To direct the traffic from the workload subnet to the firewall, you must define a custom route for 0.0.0.0/0 within a route table, using the 'Virtual appliance' next hop type pointing to the firewall's private IP, and associate this route table with the workload subnet.
Step-by-Step Solution
Key Concept
Azure Firewall deployment subnet prerequisites and user-defined routing configurations