Examkin

Question

Difficulty: HardConfigure Virtual Network Peering

An Azure administrator configures a hub-and-spoke network topology in the East US region with the following virtual networks:

* VNet-Hub (10.200.0.0/1610.200.0.0/16): Contains a Virtual Network Gateway named Hub-GW and a Network Virtual Appliance (NVA).
* VNet-SpokeA (10.201.0.0/1610.201.0.0/16): Contains a virtual machine named VM-A.
* VNet-SpokeB (10.202.0.0/1610.202.0.0/16): Contains a virtual machine named VM-B.

The administrator establishes bidirectional peering between VNet-Hub and VNet-SpokeA (using peering links Link-Hub-to-A and Link-A-to-Hub), and between VNet-Hub and VNet-SpokeB (using peering links Link-Hub-to-B and Link-B-to-Hub).

The configuration must meet the following requirements:
* VM-A must be able to communicate with an on-premises network through Hub-GW.
* VM-B must be able to receive traffic originating from on-premises that is routed and forwarded through the NVA in VNet-Hub.

Which configuration settings must be enabled on the virtual network peering links to satisfy these requirements?

  1. Enable 'Allow gateway transit' on Link-Hub-to-A, enable 'Use remote gateways' on Link-A-to-Hub, and enable 'Allow forwarded traffic' on Link-B-to-Hub.Answer
  2. B
    Enable 'Use remote gateways' on Link-Hub-to-A, enable 'Allow gateway transit' on Link-A-to-Hub, and enable 'Allow gateway transit' on Link-Hub-to-B.
  3. C
    Enable 'Allow gateway transit' on Link-Hub-to-A, enable 'Use remote gateways' on Link-A-to-Hub, and enable 'Allow gateway transit' on Link-Hub-to-B and Link-B-to-Hub.
  4. D
    Enable 'Allow forwarded traffic' on Link-Hub-to-A and Link-Hub-to-B, and enable 'Use remote gateways' on Link-A-to-Hub and Link-B-to-Hub.

Answer

Enable 'Allow gateway transit' on Link-Hub-to-A, enable 'Use remote gateways' on Link-A-to-Hub, and enable 'Allow forwarded traffic' on Link-B-to-Hub.
To allow the virtual machine in the first spoke to use the gateway in the hub virtual network, the peering link on the hub side must allow gateway transit and the link on the spoke side must be configured to use remote gateways. Additionally, to allow the virtual machine in the second spoke to receive traffic forwarded by the NVA in the hub, the peering link on the second spoke must be configured to allow forwarded traffic from the hub.

Step-by-Step Solution

1
Evaluate the gateway requirements for the virtual machine in the first spoke.
The virtual machine needs to use the virtual network gateway in the hub virtual network.
By default, peered virtual networks cannot use each other's gateways unless explicitly configured.
2
Determine the peering link properties for gateway transit.
Set 'Allow gateway transit' to true on the hub link (Link-Hub-to-A) and 'Use remote gateways' to true on the spoke link (Link-A-to-Hub).
This allows the gateway-owning hub virtual network to transit traffic for the spoke, and allows the spoke to utilize the remote gateway resource.
3
Evaluate the routing requirements for the virtual machine in the second spoke.
The virtual machine needs to receive traffic that is forwarded by a Network Virtual Appliance (NVA) in the hub.
Traffic forwarded by an NVA has a source IP outside of the hub virtual network, which Azure filters out by default on peered networks.
4
Determine the peering link properties for forwarded traffic.
Set 'Allow forwarded traffic' to true on the second spoke's peering link (Link-B-to-Hub).
This configures the peering to accept traffic that did not originate from the peered virtual network itself but was forwarded through it.

Key Concept

Virtual Network Peering configuration parameters including gateway transit, remote gateways, and forwarded traffic permissions.
Estimated Time:2m 0s
Rate this question

Topics

Configure Virtual Network Peering

More questions from this topic