You are designing the routing for a subnet in an Azure virtual network named `vnet-prod-spoke` (). You need to route all outbound internet traffic from the subnet to a firewall virtual appliance located in a peered virtual network. Traffic within `vnet-prod-spoke` () must continue to route directly between subnets without passing through the firewall. Which route should you add to the User-Defined Route (UDR) table associated with the subnet?
- AA route for with the next hop type set to None, and a route for pointing to the firewall's private IP address.
- BA Network Security Group (NSG) outbound security rule that redirects traffic destined for the Internet service tag to the firewall's private IP address.
- A route for with the next hop type set to Virtual appliance and the next hop IP address set to the firewall's private IP address.Answer
- DA route for and a route for , both with the next hop type set to Virtual appliance and the next hop IP address set to the firewall's private IP address.
Answer
A route for with the next hop type set to Virtual appliance and the next hop IP address set to the firewall's private IP address.
The correct option is to define a route for with the next hop set to the virtual appliance's private IP. Azure routes traffic by evaluating all available routes and selecting the one with the longest prefix match. The system-defined route for the local VNet prefix () is more specific than the user-defined route for . Therefore, any traffic destined within `vnet-prod-spoke` will match the system route and route directly, while all other traffic destined for the internet will fall back to the UDR and be forwarded to the firewall.
Step-by-Step Solution
Key Concept
Azure routing precedence and longest prefix match (LPM)