You manage an Azure environment that contains a virtual network named `VNet1` (10.200.0.0/… — Microsoft Azure Administrator (AZ-104)

You manage an Azure environment that contains a virtual network named `VNet1` ( $10.200.0.0/16$ ). `VNet1` contains three subnets:
* `Subnet-Web` ( $10.200.1.0/24$ )
* `Subnet-App` ( $10.200.2.0/24$ )
* `Subnet-Secure` ( $10.200.3.0/24$ )

An Azure ExpressRoute gateway is connected to `VNet1` and propagates BGP routes from an on-premises network ( $192.168.10.0/24$ ) to all subnets.

You deploy a network virtual appliance (NVA) in `Subnet-Secure` that has the private IP address of $10.200.3.4$ .

You create a custom route table named `RT1` and associate it with `Subnet-Web`. `RT1` has a single user-defined route for $0.0.0.0/0$ with the next hop set to the NVA at $10.200.3.4$ .

You have the following routing requirements for traffic originating from `Subnet-Web`:
* All traffic destined for the internet must be routed through the NVA.
* All traffic destined for `Subnet-App` must route directly, bypassing the NVA.
* All traffic destined for the on-premises network ( $192.168.10.0/24$ ) must be routed through the NVA.

What should you do on `RT1` to meet these requirements?

Disable gateway route propagation on the route table.Answer
B
Add a route for $192.168.10.0/24$ with a next hop type of Virtual network gateway.
C
Disable gateway route propagation on the route table and add a route for $10.200.2.0/24$ with a next hop type of Virtual appliance pointing to $10.200.3.4$ .
D
Add a route for $10.200.2.0/24$ with a next hop type of Virtual network gateway.

Answer

Disable gateway route propagation on the route table.

Disabling gateway route propagation prevents the route table from learning BGP-propagated routes. With the

192.168.10.0/24

route removed from the table, traffic to the on-premises network falls back to the default route (

0.0.0.0/0

) pointing to the NVA. Concurrently, local VNet routing to the application subnet is unaffected because default system routes for the local VNet (

10.200.0.0/16

) cannot be disabled and always take precedence over

0.0.0.0/0

due to Longest Prefix Match (LPM).

Step-by-Step Solution

Analyze the local VNet routing requirement from the web subnet to the application subnet.

The target subnet (

10.200.2.0/24

) is within the local virtual network range (

10.200.0.0/16

). Due to Longest Prefix Match (LPM), the default system route for the local virtual network (

10.200.0.0/16

-> Virtual network) is more specific than the default user-defined route (

0.0.0.0/0

-> NVA). Thus, traffic destined for the application subnet naturally routes directly, bypassing the NVA.

More specific system routes (longer prefix) take precedence over less specific user-defined routes.

Analyze the routing behavior for the on-premises network (

192.168.10.0/24

With gateway route propagation enabled, the route table learns the

192.168.10.0/24

route via BGP, which has a next hop type of Virtual network gateway. Because

192.168.10.0/24

is more specific than the default route (

0.0.0.0/0

), traffic to on-premises will bypass the NVA and go directly to the gateway.

Propagated BGP routes are more specific than a default route (

0.0.0.0/0

Determine the configuration change required to redirect the on-premises traffic to the NVA.

Disabling gateway route propagation prevents the route table from learning the BGP routes. As a result, the route to

192.168.10.0/24

is removed from the route table. Traffic destined for the on-premises network will then match the default route (

0.0.0.0/0

), sending it to the NVA.

Removing the propagated BGP route forces the traffic to fall back to the default UDR pointing to the NVA.

Key Concept

Azure Route Precedence and Route Propagation Control

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics