A company implements security policies that require all egress internet traffic from a database subnet named `DB-Subnet` to be inspected by a firewall. You deploy an Azure Firewall to the same virtual network in a subnet named `AzureFirewallSubnet`. The private IP address of the firewall is . You need to direct all outbound internet traffic from the databases to the firewall. Which configuration should you apply to the route table associated with `DB-Subnet`?
- A route for destination with a next hop type of Virtual appliance and a next hop address of Answer
- BA route for destination with a next hop type of Virtual network gateway and a next hop address of
- CA route for destination with a next hop type of Virtual appliance and a next hop address set to the public IP address of the Azure Firewall
- DA route for destination with a next hop type of Virtual appliance and a next hop address of associated with the AzureFirewallSubnet
Answer
A route for destination with a next hop type of Virtual appliance and a next hop address of
To route all outbound internet traffic from a workload subnet through an Azure Firewall, you must define a default route () in a user-defined route table. The next hop type must be set to Virtual appliance, and the next hop IP address must match the firewall's private IP address (). This route table must then be associated with the workload subnet.
Step-by-Step Solution
Key Concept
Routing traffic through Azure Firewall using User-Defined Routes (UDRs)