A company runs a network architecture in Microsoft Azure. The layout consists of a virtual… — Microsoft Azure Administrator (AZ-104)

A company runs a network architecture in Microsoft Azure. The layout consists of a virtual network named `VNet-Corp` ( $192.168.0.0/16$ ) with three subnets: `Subnet-App` ( $192.168.1.0/24$ ), `Subnet-Db` ( $192.168.2.0/24$ ), and `Subnet-NVA` ( $192.168.100.0/24$ ). A firewall appliance named `NVA1` is placed in `Subnet-NVA` with a private IP address of $192.168.100.4$ .

You must ensure that all network packets originating from the application tier (`Subnet-App`) and destined for the database tier (`Subnet-Db`) are inspected by `NVA1`.

Which two actions should you perform? (Each correct answer presents part of the solution.)

Enable IP forwarding on the network interface of `NVA1`.Answer
Create a route table, add a route for destination $192.168.2.0/24$ with a next hop type of Virtual appliance and IP address $192.168.100.4$ , and associate the route table with `Subnet-App`.Answer
C
Create a route table, add a route for destination $192.168.2.0/24$ with a next hop type of Virtual network gateway and IP address $192.168.100.4$ , and associate the route table with `Subnet-App`.
D
Configure a virtual network peering link directly between `Subnet-App` and `Subnet-Db` and enable gateway transit.

Answer

Enable IP forwarding on the network interface of `NVA1`, and create a route table containing a route for destination

192.168.2.0/24

with a next hop type of Virtual appliance and IP address

192.168.100.4

, then associate the route table with `Subnet-App`.

To route traffic from a subnet through a Network Virtual Appliance (NVA), you must create a route table with a User-Defined Route (UDR) pointing to the NVA's IP address. The next hop type must be set to 'Virtual appliance' to ensure Azure correctly forwards the packets to the NVA's private IP. Additionally, because the NVA will receive traffic destined for a different IP address (the database subnet), you must enable IP forwarding on the NVA's network interface (NIC) so that the operating system inside the NVA can forward the traffic to its final destination rather than dropping it.

Step-by-Step Solution

Identify the target destination range and next-hop NVA IP address.

The target destination subnet is `Subnet-Db` (

192.168.2.0/24

), and the next-hop IP address is the NVA's interface (

192.168.100.4

Creating a User-Defined Route requires identifying the specific destination traffic range to intercept and the precise IP address of the device that will process the traffic.

Configure the custom routing table and route.

A route table is created with a route entry specifying destination

192.168.2.0/24

, next hop type 'Virtual appliance', and next hop IP address

192.168.100.4

. The route table is associated with `Subnet-App`.

This configuration overrides the default Azure system route that normally routes traffic directly between subnets within the same virtual network.

Enable IP forwarding on the network interface of `NVA1` in Azure.

IP forwarding is enabled on the Azure network interface resource associated with `NVA1`.

Azure network interfaces drop packets that have a destination IP address different from the IP address assigned to the interface. Enabling IP forwarding allows the NVA to receive and forward these packets.

Key Concept

Configuring user-defined routes to redirect subnet traffic through a network virtual appliance, requiring both a route table entry and IP forwarding enablement on the appliance's network interface.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics