Your company has an Azure environment with three virtual networks: `VNet-Hub` (172.16.0.0/… — Microsoft Azure Administrator (AZ-104)

Your company has an Azure environment with three virtual networks: `VNet-Hub` ( $172.16.0.0/16$ ), `VNet-SpokeA` ( $172.17.0.0/16$ ), and `VNet-SpokeB` ( $172.18.0.0/16$ ). Both spoke virtual networks are peered directly with `VNet-Hub`.

In `VNet-Hub`, a Network Virtual Appliance (NVA) named `NVA-1` is deployed in a subnet named `Subnet-DMZ` ( $172.16.1.0/24$ ). The NVA has a private IP address of $172.16.1.4$ assigned to its network interface `nic1`.

You need to ensure that all network traffic originating from `Subnet-App` ( $172.17.1.0/24$ ) in `VNet-SpokeA` and destined for `Subnet-DB` ( $172.18.1.0/24$ ) in `VNet-SpokeB` is routed through `NVA-1`.

Which two actions should you perform? (Each correct answer presents part of the solution.)

Enable IP forwarding on the network interface `nic1` of `NVA-1`.Answer
Associate a custom route table with `Subnet-App` and add a route with the destination prefix $172.18.1.0/24$ , a next hop type of Virtual appliance, and a next hop IP address of $172.16.1.4$ .Answer
C
Associate a custom route table with `Subnet-App` and add a route with the destination prefix $172.18.1.0/24$ , a next hop type of Virtual network gateway, and a next hop IP address of $172.16.1.4$ .
D
Enable gateway transit on the virtual network peering connection between `VNet-Hub` and `VNet-SpokeA`.
E
Associate a custom route table with `Subnet-DMZ` and add a route with the destination prefix $172.18.1.0/24$ , a next hop type of Virtual appliance, and a next hop IP address of $172.16.1.4$ .

Answer

To route traffic from the application subnet to the database subnet through the network virtual appliance, you must enable IP forwarding on the network interface of the appliance, and associate a route table with the application subnet that contains a route to the database subnet with a next hop type of Virtual appliance and the IP address of the appliance.

To route traffic through a Network Virtual Appliance (NVA), two conditions must be met: first, the NVA's network interface must be configured to allow IP forwarding, otherwise it will discard packets not addressed to its own MAC/IP address. Second, a route table must be associated with the source subnet containing a user-defined route that specifies the destination subnet, the next hop type of 'Virtual appliance', and the NVA's private IP address.

Step-by-Step Solution

Enable IP forwarding on the network interface.

IP forwarding is enabled on the network interface of the appliance.

By default, Azure virtual machine network interfaces drop traffic that is not destined for their own IP address. Enabling IP forwarding allows the network interface to forward traffic destined for other IP addresses.

Create a route table and configure the user-defined route.

A route is added with destination prefix

172.18.1.0/24

, next hop type 'Virtual appliance', and next hop IP address

172.16.1.4

This route overrides the default system routing and directs the outbound traffic from the source subnet to the firewall appliance.

Associate the route table with the source subnet.

The route table is associated with the application subnet.

UDRs must be applied to the subnet containing the source resources so that outbound traffic originating from those resources matches the route table rules.

Key Concept

Configuring custom routing through a Network Virtual Appliance (NVA) in Azure requires both a User-Defined Route (UDR) pointing to the NVA's IP address with a next hop type of 'Virtual appliance' and enabling IP forwarding on the NVA's network interface.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics