Your company has an Azure virtual network named `VNet-Finance` (10.150.0.0/16). The virtua… — Microsoft Azure Administrator (AZ-104)

Your company has an Azure virtual network named `VNet-Finance` ( $10.150.0.0/16$ ). The virtual network contains the following three subnets:

* `WebSubnet` ( $10.150.1.0/24$ )
* `SecureDMZ` ( $10.150.10.0/24$ )
* `AppSubnet` ( $10.150.2.0/24$ )

You deploy a Network Virtual Appliance (NVA) named `NVA-1` to `SecureDMZ`. `NVA-1` is assigned the private IP address $10.150.10.4$ .

You need to ensure that all traffic sent from `WebSubnet` to `AppSubnet` is routed through `NVA-1` for inspection.

Which two actions should you perform? (Select two.)

Create a route table, add a route for destination $10.150.2.0/24$ with a next hop type of Virtual Appliance and a next hop IP address of $10.150.10.4$ , and associate the route table with WebSubnet.Answer
Enable IP forwarding on the network interface (NIC) of NVA-1.Answer
C
Create a route table, add a route for destination $10.150.2.0/24$ with a next hop type of Virtual Network Gateway and a next hop IP address of $10.150.10.4$ , and associate the route table with SecureDMZ.
D
Create a route table, add a route for destination $10.150.2.0/24$ with a next hop type of Virtual Appliance and a next hop IP address of $10.150.10.4$ , and associate the route table with AppSubnet.

Answer

Create a route table, add a route for destination

10.150.2.0/24

with a next hop type of Virtual Appliance and next hop IP address of

10.150.10.4

, associate it with WebSubnet, and enable IP forwarding on the network interface of NVA-1.

To route traffic from the web tier to the app tier through a firewall or NVA, you must define a User-Defined Route (UDR) specifying the destination subnet IP range (

10.150.2.0/24

) and designating the Next Hop Type as a Virtual Appliance pointing to the NVA's IP (

10.150.10.4

). This route table must be associated with the source subnet (WebSubnet) where the traffic originates. Additionally, the NVA's network interface (NIC) in Azure must have IP forwarding enabled so that it does not drop packets destined for other IP addresses.

Step-by-Step Solution

Define the user-defined route (UDR) to redirect the outbound traffic.

A route table is created with a route for destination

10.150.2.0/24

(AppSubnet) pointing to the next hop type of Virtual Appliance with the IP address

10.150.10.4

This overrides the default system route that routes traffic directly between subnets within the same virtual network.

Associate the route table with the source subnet.

The route table is associated with WebSubnet.

UDRs only apply to traffic originating from the subnet with which the route table is associated.

Configure the Network Virtual Appliance's interface to permit transit traffic.

IP forwarding is enabled on the Azure network interface (NIC) of NVA-1.

By default, Azure network interfaces drop traffic that is not destined for or originating from the IP address assigned to the NIC. Enabling IP forwarding allows the NVA to receive and forward transit traffic.

Key Concept

Configuring custom routing through a Network Virtual Appliance (NVA) requires creating a route table, defining a route with a Next Hop Type of 'Virtual Appliance' pointing to the NVA's IP, associating the route table with the source subnet, and enabling IP forwarding on the NVA's network interface.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics