An Azure administrator is configuring virtual network routing. The environment contains a … — Microsoft Azure Administrator (AZ-104)

An Azure administrator is configuring virtual network routing. The environment contains a virtual network named `VNet-Frontier` ( $10.80.0.0/16$ ) with three subnets:
- `Subnet-Web` ( $10.80.1.0/24$ )
- `Subnet-App` ( $10.80.2.0/24$ )
- `Subnet-Security` ( $10.80.100.0/24$ )

A Network Virtual Appliance (NVA) named `NVA-01` is deployed in `Subnet-Security` and is assigned the private IP address $10.80.100.4$ . You need to ensure that all traffic from `Subnet-Web` to `Subnet-App` is routed through `NVA-01`. All other traffic from `Subnet-Web` must route normally using the default system routes.

Which two actions should you perform to meet the requirements? (Select TWO.)

Associate a route table to Subnet-Web that contains a route for $10.80.2.0/24$ with a next hop type of Virtual appliance and next hop IP address $10.80.100.4$ .Answer
Enable IP forwarding on the network interface of NVA-01.Answer
C
Associate a route table to Subnet-Web that contains a route for $10.80.2.0/24$ with a next hop type of Virtual network gateway and next hop IP address $10.80.100.4$ .
D
Enable IP forwarding on Subnet-Web and Subnet-App.
E
Associate a route table to Subnet-Security that contains a route for $10.80.1.0/24$ with a next hop type of Virtual appliance.

Answer

Associate a route table to the web subnet containing a route for the app subnet's address range (

10.80.2.0/24

) with a next hop type of Virtual appliance pointing to the NVA's IP address (

10.80.100.4

), and enable IP forwarding on the network interface of the NVA.

To send traffic from one subnet through an NVA, a route table must be associated with the source subnet (the web subnet) containing a route for the target destination (the app subnet) with the next hop type configured as 'Virtual appliance' and the NVA's private IP as the next hop address. Additionally, the NVA's virtual network interface in Azure must have IP forwarding enabled so it does not drop the transit traffic.

Step-by-Step Solution

Create a route table in Azure and add a custom route.

A route is configured with a destination prefix of

10.80.2.0/24

, next hop type 'Virtual appliance', and next hop IP address

10.80.100.4

This configuration overrides Azure's default system route (which would send traffic directly between subnets) and redirects it to the NVA.

Associate the route table to Subnet-Web.

The custom routing rules are applied to all traffic originating from Subnet-Web.

UDRs must be associated with the source subnet to intercept and route its outbound traffic.

Enable IP forwarding on the network interface (NIC) of the NVA VM.

The network interface is configured to receive and forward traffic that is not addressed to the NVA itself.

By default, Azure drops traffic sent to a NIC that doesn't match its own IP address. Enabling IP forwarding allows the NVA to route transit traffic.

Key Concept

Routing traffic through a Network Virtual Appliance (NVA) requires creating a UDR pointing to the NVA's IP address with the 'Virtual appliance' next hop type, associating it with the source subnet, and enabling IP forwarding on the NVA's network interface.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics