You have an Azure subscription containing a virtual network named `VNet1` (172.20.0.0/16).… — Microsoft Azure Administrator (AZ-104)

You have an Azure subscription containing a virtual network named `VNet1` ( $172.20.0.0/16$ ). `VNet1` contains the following three subnets:
* `Subnet-Web` ( $172.20.1.0/24$ )
* `Subnet-App` ( $172.20.2.0/24$ )
* `Subnet-Transit` ( $172.20.10.0/24$ )

You deploy a Network Virtual Appliance (NVA) named `NVA1` to `Subnet-Transit`. The primary network interface of `NVA1` is named `nic-nva` and has a private IP address of $172.20.10.4$ .

You need to implement a routing solution that meets the following requirements:
1. All outbound internet-bound traffic from `Subnet-Web` must be routed through `NVA1`.
2. All internal traffic from `Subnet-Web` destined for database servers in `Subnet-App` must bypass `NVA1` and route directly.
3. `NVA1` must be able to forward transit packets.

Which two configurations should you perform to meet these requirements? (Select two.)

Enable IP forwarding on the network interface nic-nva.Answer
Associate a route table with Subnet-Web that contains a route for 0.0.0.0/0 with a next hop type of Virtual appliance and a next hop IP address of 172.20.10.4.Answer
C
Associate a route table with Subnet-Web that contains a route for 172.20.2.0/24 with a next hop type of Virtual appliance and a next hop IP address of 172.20.10.4.
D
Associate a route table with Subnet-Web that contains a route for 0.0.0.0/0 with a next hop type of Virtual network gateway.
E
Associate a route table with Subnet-Transit that contains a route for 0.0.0.0/0 with a next hop type of Virtual appliance and a next hop IP address of 172.20.10.4.

Answer

To route internet traffic from the web subnet through the NVA while bypassing it for database traffic, you must enable IP forwarding on the network interface of the NVA, and associate a route table with the web subnet that directs traffic destined for the internet to the appliance's IP address. Internal traffic will naturally bypass the NVA because the local virtual network system route has a longer prefix match than the default route.

The correct configuration requires two steps: enabling IP forwarding on the primary network interface of the NVA to permit the VM to forward packets it does not own, and associating a route table with the web subnet containing a route for the internet (

0.0.0.0/0

) pointing to the NVA's IP. Due to the Longest Prefix Match (LPM) rule, traffic destined for the application subnet (

172.20.2.0/24

) matches the virtual network system route (

172.20.0.0/16

) rather than the custom default route (

0.0.0.0/0

), successfully bypassing the NVA without needing additional local routes.

Step-by-Step Solution

Enable IP forwarding on the Network Virtual Appliance (NVA) network interface.

The network interface nic-nva is updated to allow IP forwarding.

By default, Azure security checks drop packets where the destination IP does not match the interface IP. Enabling IP forwarding allows the NVA to act as a router and forward transit traffic.

Create a route table and add a default route for internet-bound traffic.

A route with prefix

0.0.0.0/0

is created with a next hop type of Virtual appliance and a next hop IP of

172.20.10.4

This route intercepts default internet traffic (

0.0.0.0/0

) and redirects it to the firewall NVA.

Associate the route table with the source subnet.

The route table is associated with Subnet-Web.

UDRs must be associated with the subnet containing the source virtual machines to affect their outbound routing decisions.

Analyze route selection for internal database traffic.

Traffic destined for Subnet-App (

172.20.2.0/24

) uses the default system route for VNet1 (

172.20.0.0/16

Because of Longest Prefix Match (LPM), the system route prefix of

172.20.0.0/16

is preferred over the UDR prefix of

0.0.0.0/0

for any destination within the virtual network. Thus, internal traffic automatically bypasses the NVA.

Key Concept

Azure Route Selection rules, specifically Longest Prefix Match (LPM) and the requirement of IP forwarding on NVAs for packet transit.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics