An administrator is configuring connectivity for a hybrid Azure environment. The environment contains the following resources:
* VNet-Hub (): Contains a virtual network gateway named GW-Hub in GatewaySubnet (), and a virtual machine named VM-Hub in Subnet-Hub ().
* VNet-Spoke (): Contains a virtual machine named VM-Spoke in Subnet-Spoke ().
* GW-Hub is connected to an on-premises network () via a Site-to-Site VPN connection.
A virtual network peering connection is established between VNet-Hub and VNet-Spoke.
Which configuration must the administrator apply to the peering links to allow VM-Spoke to communicate with the on-premises network?
- AEnable 'Use remote gateways' on the VNet-Hub peering link, and enable 'Allow gateway transit' on the VNet-Spoke peering link.
- Enable 'Allow gateway transit' on the VNet-Hub peering link, and enable 'Use remote gateways' on the VNet-Spoke peering link.Answer
- CEnable 'Allow forwarded traffic' on both peering links, and create a User-Defined Route in VNet-Spoke with a next hop of Virtual Network Gateway.
- DEnable 'Allow gateway transit' on both peering links, and configure a local VPN connection directly on VM-Spoke.
Answer
Enable 'Allow gateway transit' on the VNet-Hub peering link, and enable 'Use remote gateways' on the VNet-Spoke peering link.
The correct configuration is to enable 'Allow gateway transit' on the VNet-Hub peering link and 'Use remote gateways' on the VNet-Spoke peering link. In Azure, the virtual network containing the VPN gateway must allow gateway transit so that its gateway can be shared with peered spokes. Conversely, the spoke virtual network must be configured to use remote gateways to route traffic destined for on-premises through the hub's gateway and automatically receive the propagated routes.
Step-by-Step Solution
Key Concept
Virtual Network Gateway Transit in Peered VNets