An administrator is configuring network routing within a single Azure virtual network name… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring network routing within a single Azure virtual network named `VNet-Prod` ( $10.80.0.0/16$ ). The virtual network is segmented into the following three subnets:
* `WebSubnet` ( $10.80.1.0/24$ )
* `DatabaseSubnet` ( $10.80.2.0/24$ )
* `SecuritySubnet` ( $10.80.100.0/24$ )

A firewall virtual machine acting as a Network Virtual Appliance (NVA) is deployed in `SecuritySubnet` and has the private IP address $10.80.100.10$ .

The administrator must redirect all network traffic sent from `WebSubnet` targeting the `DatabaseSubnet` through the firewall virtual machine.

Which of the following actions should the administrator perform to route the traffic? (Select TWO.)

Configure IP forwarding on the network interface (NIC) attached to the firewall virtual machine.Answer
Associate a route table with WebSubnet that defines a route for $10.80.2.0/24$ using a next hop type of Virtual appliance and IP address $10.80.100.10$ .Answer
C
Associate a route table with WebSubnet that defines a route for $10.80.2.0/24$ using a next hop type of Virtual network gateway and IP address $10.80.100.10$ .
D
Associate a route table with DatabaseSubnet that defines a route for $10.80.1.0/24$ using a next hop type of Virtual appliance and IP address $10.80.100.10$ .

Answer

Configure IP forwarding on the network interface (NIC) attached to the firewall virtual machine, and associate a route table with WebSubnet that defines a route for

10.80.2.0/24

using a next hop type of Virtual appliance and IP address

10.80.100.10

To route traffic from the web subnet to the database subnet through the firewall virtual machine, you must create a route table with a user-defined route pointing to the firewall's IP address. This route table must be associated with the subnet containing the source resources (WebSubnet). In the route table, the destination IP prefix must match the target subnet (

10.80.2.0/24

), and the next hop type must be set to Virtual appliance with the firewall's private IP address as the next hop. Additionally, because the firewall virtual machine is receiving and forwarding network traffic that is not destined for its own IP, IP forwarding must be enabled on its network interface (NIC).

Step-by-Step Solution

Identify the source and destination subnets for the traffic redirection flow.

The source subnet is WebSubnet (

10.80.1.0/24

) and the destination subnet is DatabaseSubnet (

10.80.2.0/24

This establishes where the route table needs to be associated and what the destination prefix for the user-defined route must be.

Configure the next hop type and IP address in the user-defined route table.

Create a route targeting

10.80.2.0/24

with a next hop type of Virtual appliance and IP address

10.80.100.10

, then associate the route table with WebSubnet.

A user-defined route overrides the default system route that routes traffic directly between subnets within the virtual network.

Enable IP forwarding on the Network Virtual Appliance (NVA).

Enable IP forwarding on the network interface (NIC) of the firewall virtual machine.

Azure virtual machines by default drop traffic that is not addressed to themselves. IP forwarding allows the NVA's NIC to receive and forward transit traffic.

Key Concept

To route traffic through a Network Virtual Appliance (NVA) in Azure, you must define a custom route with a next hop type of Virtual appliance pointing to the NVA's IP, associate it with the source subnet, and enable IP forwarding on the NVA's network interface.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics