An organization has three virtual networks (VNets) in the Northern Europe region: * **VNet… — Microsoft Azure Administrator (AZ-104)

An organization has three virtual networks (VNets) in the Northern Europe region:

* VNet-Hub ( $10.200.0.0/16$ ): Contains a Virtual Network Gateway deployed in GatewaySubnet, and a Network Virtual Appliance (NVA) named NVA-1 ( $10.200.1.4$ ) deployed in Subnet-Hub. NVA-1 has IP forwarding enabled in the operating system.
* VNet-App ( $10.210.0.0/16$ ): Contains a virtual machine named VM-App deployed in Subnet-App.
* VNet-DB ( $10.220.0.0/16$ ): Contains a virtual machine named VM-DB deployed in Subnet-DB.

The virtual network peering connections are configured as follows:

* Peering-Hub-To-App (from VNet-Hub to VNet-App): 'Allow gateway transit' is enabled, and 'Allow forwarded traffic' is disabled.
* Peering-App-To-Hub (from VNet-App to VNet-Hub): 'Use remote gateways' is enabled, and 'Allow forwarded traffic' is disabled.
* Peering-Hub-To-DB (from VNet-Hub to VNet-DB): 'Allow gateway transit' is disabled, and 'Allow forwarded traffic' is enabled.
* Peering-DB-To-Hub (from VNet-DB to VNet-Hub): 'Use remote gateways' is disabled, and 'Allow forwarded traffic' is enabled.

You associate the following User-Defined Routes (UDRs):

* Table-App (associated with Subnet-App): A route for destination ` $10.220.0.0/16$ ` with next hop type Virtual Appliance and next hop IP address ` $10.200.1.4$ `.
* Table-DB (associated with Subnet-DB): A route for destination ` $10.210.0.0/16$ ` with next hop type Virtual Appliance and next hop IP address ` $10.200.1.4$ `.

You verify that VM-App can connect to on-premises networks through the gateway in VNet-Hub, but VM-App and VM-DB cannot communicate with each other.

Which configuration change should you implement to allow VM-App and VM-DB to establish communication?

Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App.Answer
B
Enable 'Allow gateway transit' on the peering connection from VNet-Hub to VNet-DB.
C
Enable 'Use remote gateways' on the peering connection from VNet-DB to VNet-Hub.
D
Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-DB.

Answer

Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App.

The correct answer is to enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App. By default, peered virtual networks only accept traffic that originates from the address space of the peered network. Because traffic between the spokes is routed through an NVA in the hub, the packets entering VNet-App have a source IP from VNet-DB, which is outside the VNet-Hub address space. This makes it 'forwarded traffic'. Since 'Allow forwarded traffic' is disabled on the peering between VNet-Hub and VNet-App, these packets are dropped. Enabling this setting allows the forwarded traffic to reach its destination.

Step-by-Step Solution

Analyze the network path for spoke-to-spoke traffic.

Traffic from VM-App (

10.210.0.0/16

) destined for VM-DB (

10.220.0.0/16

) is routed to the NVA (

10.200.1.4

) in VNet-Hub, which then forwards the traffic to VNet-DB.

This establishes that the traffic from VNet-App is received by VNet-Hub, and the NVA attempts to forward it to VNet-DB. Similarly, return traffic from VM-DB is routed to the NVA in VNet-Hub, which then attempts to forward it to VNet-App.

Determine the type of traffic entering VNet-App from VNet-Hub.

Since the source IP of the return traffic (

10.220.x.y

) does not belong to VNet-Hub (

10.200.0.0/16

), it is treated as forwarded traffic when it transits the peering from VNet-Hub to VNet-App.

To identify which configuration setting is blocking the traffic flow.

Inspect the 'Allow forwarded traffic' settings on the peering connections.

The peering between VNet-Hub and VNet-DB already has 'Allow forwarded traffic' enabled. However, the peering between VNet-Hub and VNet-App has 'Allow forwarded traffic' disabled.

Because 'Allow forwarded traffic' is disabled on the VNet-Hub to VNet-App peering, any packets forwarded by the NVA that originate from VNet-DB are dropped at the entrance to VNet-App.

Select the correct configuration change to enable traffic flow.

Enable 'Allow forwarded traffic' on the peering connections between VNet-Hub and VNet-App.

This allows the forwarded packets from the NVA (originating from VNet-DB) to successfully reach VNet-App, completing the bidirectional communication channel.

Key Concept

Virtual Network Peering Forwarded Traffic

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic