An enterprise designs a hub-and-spoke virtual network topology in Azure. The hub virtual n… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise designs a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-eus-hub` ( $10.100.0.0/16$ ), contains an Azure Route Server in the `RouteServerSubnet` ( $10.100.1.0/24$ ) and a Network Virtual Appliance (NVA) at IP address $10.100.2.4$ in the subnet `snet-eus-nva` ( $10.100.2.0/24$ ). An ExpressRoute Gateway is deployed in the `GatewaySubnet` ( $10.100.0.0/24$ ) and connects to the corporate on-premises network ( $172.16.0.0/12$ ). The spoke virtual network, `vnet-eus-prod` ( $10.101.0.0/16$ ), contains a web tier subnet, `snet-prod-web` ( $10.101.10.0/24$ ), and a database tier subnet, `snet-prod-db` ( $10.101.20.0/24$ ). Virtual network peering is configured between `vnet-eus-hub` and `vnet-eus-prod` with "Allow gateway transit" enabled on the hub and "Use remote virtual network gateways or route server" enabled on the spoke. The Route Server is peered with the NVA. The NVA advertises a default route ( $0.0.0.0/0$ ) via BGP to the Route Server, while the ExpressRoute Gateway propagates the on-premises route ( $172.16.0.0/12$ ) via BGP. You must design a routing solution for the web tier subnet, `snet-prod-web`, that satisfies the following requirements:

- All internet-bound traffic must route through the NVA ( $10.100.2.4$ ) for security inspection.
- All traffic to the on-premises network ( $172.16.0.0/12$ ) must bypass the NVA and route directly to the ExpressRoute Gateway.
- All traffic to the database tier subnet (`snet-prod-db`) must remain local and bypass the NVA.
- All traffic to the hub management subnet, `snet-hub-mgmt` ( $10.100.3.0/24$ ), must bypass the NVA and route directly.
- All traffic to the private endpoints subnet in the hub, `snet-hub-pe` ( $10.100.50.0/24$ ), must route through the NVA.

Which route table configuration should you apply to `snet-prod-web` to meet these requirements with the least administrative effort?

Create a route table with a single User Defined Route (UDR) for $10.100.50.0/24$ with the next hop set to Virtual Appliance and IP address $10.100.2.4$ , and associate it with the subnet.Answer
B
Create a route table with a User Defined Route (UDR) for $10.100.0.0/16$ with the next hop set to Virtual Appliance and IP address $10.100.2.4$ , and a second UDR for $10.100.3.0/24$ with the next hop set to Virtual Network, and associate it with the subnet.
C
Disable gateway route propagation on the route table, and add three manual User Defined Routes (UDRs): $0.0.0.0/0$ with next hop Virtual Appliance $10.100.2.4$ , $172.16.0.0/12$ with next hop Virtual Network Gateway, and $10.100.50.0/24$ with next hop Virtual Appliance $10.100.2.4$ , and associate it with the subnet.
D
Configure the virtual network peering between the hub and spoke to disable gateway transit, and create a route table with a User Defined Route (UDR) for $10.100.50.0/24$ with the next hop set to Virtual Appliance and IP address $10.100.2.4$ , and associate it with the subnet.

Answer

Create a route table with a single User Defined Route (UDR) for

10.100.50.0/24

with the next hop set to Virtual Appliance and IP address

10.100.2.4

, and associate it with the subnet.

The correct configuration is to create a route table with a single User Defined Route (UDR) for the private endpoints subnet (

10.100.50.0/24

) pointing to the NVA at

10.100.2.4

. Because the virtual network peering has gateway transit enabled on the hub and remote gateway usage enabled on the spoke, Azure Route Server dynamically propagates BGP routes to the spoke's subnets. As a result, the default route (

0.0.0.0/0

) from the NVA and the on-premises route (

172.16.0.0/12

) from the ExpressRoute Gateway are automatically populated in the routing table of the web tier subnet. Spoke-to-spoke traffic is handled by the local virtual network system route (

10.101.0.0/16

), and spoke-to-hub management traffic is handled by the peering system route (

10.100.0.0/16

). Therefore, only the private endpoint subnet (

10.100.50.0/24

) requires a UDR to override the peering system route via Longest Prefix Match (LPM).

Step-by-Step Solution

Analyze the dynamic route propagation configuration.

Since Azure Route Server is peered with the NVA and the ExpressRoute Gateway, and the VNet peering has gateway transit enabled, the spoke subnet automatically learns the default route (

0.0.0.0/0

) pointing to the NVA and the on-premises route (

172.16.0.0/12

) pointing to the Gateway.

This eliminates the need to manually configure UDRs for internet and corporate on-premises traffic, satisfying the first two requirements.

Evaluate the system routing for local and peering traffic.

Traffic within the spoke (

10.101.0.0/16

) uses the local system route. Traffic to the hub management subnet (

10.100.3.0/24

) matches the VNet Peering system route (

10.100.0.0/16

). Both routes bypass the NVA.

System routes handle these paths directly, satisfying the third and fourth requirements without manual intervention.

Configure routing for the private endpoints subnet to be inspected by the NVA.

Add a UDR for

10.100.50.0/24

with next hop Virtual Appliance

10.100.2.4

. The next hop IP

10.100.2.4

is resolved using the system's VNet Peering route (

10.100.0.0/16

) because it is more specific than the UDR itself.

This overrides the default peering system route for the private endpoints subnet due to Longest Prefix Match (LPM), while avoiding a recursive routing loop for the NVA's own IP.

Key Concept

Azure Route Server route propagation and User Defined Route (UDR) resolution priority

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic