You are configuring outbound internet access for virtual machines in a subnet named `Subnet-Workload`. You deploy an Azure Firewall to the same virtual network in a subnet named `AzureFirewallSubnet`. You need to ensure that all egress traffic to the internet from `Subnet-Workload` is routed through and filtered by the Azure Firewall.
Which two actions should you perform? (Select two.)
- Assign a custom route table to Subnet-Workload containing a default route with the next hop set to the firewall's private IP and a next hop type of Virtual Appliance.Answer
- Configure a rule collection within the Azure Firewall policy to explicitly permit the required outbound traffic flows.Answer
- CAssign a custom route table to Subnet-Workload containing a default route with the next hop set to the firewall's private IP and a next hop type of Virtual Network Gateway.
- DDeploy a network security group (NSG) to Subnet-Workload and define a high-priority rule that redirects outbound traffic to the private IP of the Azure Firewall.
Answer
Assign a custom route table to Subnet-Workload containing a default route with the next hop set to the firewall's private IP and a next hop type of Virtual Appliance, and configure a rule collection within the Azure Firewall policy to explicitly permit the required outbound traffic flows.
To route and inspect outbound internet traffic using Azure Firewall, you must perform two main configurations: routing and filtering. First, traffic from the workload subnet must be routed to the firewall's private IP. This is achieved by assigning a route table to the workload subnet containing a default route with a next hop type of Virtual Appliance. Second, because Azure Firewall blocks all traffic by default, you must configure a rule collection in the firewall policy to allow the outbound traffic.
Step-by-Step Solution
Key Concept
Azure Firewall routing and rule configuration