Examkin

Question

Difficulty: MediumConfigure Virtual Network Peering

To route spoke-to-spoke traffic through a firewall, a network engineer deploys three Azure virtual networks:

* VNet-Transit (172.16.0.0/16172.16.0.0/16) contains a Network Virtual Appliance (NVA) in its subnet to act as a router.
* VNet-App (172.30.0.0/16172.30.0.0/16) contains application virtual machines.
* VNet-Data (192.168.50.0/24192.168.50.0/24) contains database virtual machines.

The engineer establishes peering between VNet-App and VNet-Transit, and between VNet-Data and VNet-Transit. No direct peering exists between VNet-App and VNet-Data.

Route tables containing user-defined routes (UDRs) are applied to the subnets in VNet-App and VNet-Data to direct traffic destined for the other spoke to the NVA's private IP address.

To ensure that the virtual machines in VNet-App and VNet-Data can successfully communicate, which configuration is required on the virtual network peering links?

  1. Enable 'Allow forwarded traffic' on the peering connections within VNet-App and VNet-Data pointing to VNet-Transit.Answer
  2. B
    Enable 'Allow gateway transit' on the peering connections within VNet-Transit and select 'Use remote gateways' on VNet-App and VNet-Data.
  3. C
    Enable 'Allow forwarded traffic' only on the peering connections within VNet-Transit pointing to VNet-App and VNet-Data.
  4. D
    Configure the next hop type as 'Virtual Network Gateway' in the route tables assigned to the subnets in VNet-App and VNet-Data.

Answer

Enable 'Allow forwarded traffic' on the peering connections within VNet-App and VNet-Data pointing to VNet-Transit.
The correct option is to enable 'Allow forwarded traffic' on the peering connections within VNet-App and VNet-Data pointing to VNet-Transit. Because the NVA in VNet-Transit forwards packets that originate from outside VNet-Transit (e.g., from VNet-App to VNet-Data), the destination virtual networks must be configured to allow forwarded traffic. Otherwise, Azure will drop these packets.

Step-by-Step Solution

1
Analyze the traffic path between the two spokes.
Traffic from VNet-App destined for VNet-Data goes to the NVA in VNet-Transit, which then forwards the packets to VNet-Data. The return path is the reverse.
Understanding the packet flow helps identify where peering settings are evaluated.
2
Identify the nature of the forwarded traffic arriving at the destination virtual networks.
When VNet-Data receives packets from the peering link with VNet-Transit, the packets have a source IP from VNet-App. Since the source IP does not belong to VNet-Transit, Azure classifies this as forwarded traffic.
Azure blocks forwarded traffic by default unless explicitly allowed.
3
Determine the correct peering setting to allow forwarded traffic on the receiving virtual networks.
The 'Allow forwarded traffic' (or allowForwardedTraffic: true) setting must be enabled on VNet-App's peering link to VNet-Transit and VNet-Data's peering link to VNet-Transit.
This allows both spoke virtual networks to accept packets forwarded by the NVA in the hub.

Key Concept

Virtual network peering does not support transitive routing by default. To route traffic between two spokes through a Network Virtual Appliance in a hub VNet, you must use User-Defined Routes and enable the 'Allow forwarded traffic' setting on the peerings in the spoke VNets.
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic