Your company is designing a hybrid network in Azure using a hub-and-spoke topology. The ar… — Microsoft Azure Solutions Architect (AZ-305)

Your company is designing a hybrid network in Azure using a hub-and-spoke topology. The architecture includes:

* A hub virtual network named `vnet-hub-central` with an address space of $172.16.0.0/16$ .
* A spoke virtual network named `vnet-spoke-app` with an address space of $172.17.0.0/16$ .
* A spoke virtual network named `vnet-spoke-data` with an address space of $172.18.0.0/16$ .
* An Azure ExpressRoute gateway deployed in the `GatewaySubnet` ( $172.16.2.0/24$ ) of `vnet-hub-central` connecting to the on-premises network.
* A third-party network virtual appliance (NVA) deployed in `vnet-hub-central` to inspect all transit traffic.
* An Azure Route Server deployed in the `RouteServerSubnet` ( $172.16.1.0/24$ ) of `vnet-hub-central`.

You need to configure the network to ensure that the spoke virtual networks dynamically exchange routing information with the on-premises network via the NVA, minimizing manual route table maintenance.

Which three actions should you perform? (Each correct answer presents part of the solution.)

Configure BGP peering between the NVA and the Azure Route Server.Answer
Enable the Branch-to-Branch (route exchange) setting on the Azure Route Server.Answer
Configure the virtual network peerings from the hub to the spokes to allow gateway transit, and the peerings from the spokes to the hub to use the remote virtual network's gateway or Route Server.Answer
D
Create User Defined Routes (UDRs) in the spoke subnets with a next hop pointing to the NVA's IP address for the on-premises IP ranges.
E
Create User Defined Routes (UDRs) in the gateway subnet of `vnet-hub-central` that define routes to the spokes with the ExpressRoute gateway as the next hop.
F
Create a User Defined Route (UDR) in the NVA subnet that overrides the default system route for the local virtual network address space ( $172.16.0.0/16$ ).

Answer

To configure dynamic hybrid routing using Azure Route Server and an NVA, you must configure BGP peering between the NVA and the Azure Route Server, enable the Branch-to-Branch route exchange setting on the Route Server, and configure VNet peering transit options ('Use remote virtual network's gateway or Route Server' on spokes, and allow gateway transit on the hub).

The correct configuration relies on dynamic route exchange using Azure Route Server (ARS). Configuring BGP peering between the NVA and ARS allows the NVA to advertise its routes to the Azure SDN. Enabling Branch-to-Branch (route exchange) on the ARS allows the Route Server to propagate BGP routes between the ExpressRoute gateway and the NVA. Finally, configuring the virtual network peering options ensures that the spoke VNets dynamically receive these routes from the hub's Route Server.

Step-by-Step Solution

Configure BGP Peering on the NVA and Route Server.

The NVA and Azure Route Server establish a BGP session.

This allows the NVA to dynamically advertise routes (like on-premises subnets) to the Route Server, which handles route propagation inside the Azure VNets.

Enable Branch-to-Branch on Azure Route Server.

Route Server exchanges routes between the ExpressRoute gateway and the NVA.

This allows the ExpressRoute gateway to learn the routes advertised by the NVA, and the NVA to learn on-premises routes advertised by the ExpressRoute gateway, facilitating transit routing.

Configure Peering Transit Settings.

Spoke virtual networks dynamically receive the propagated routes from the Route Server.

VNet peerings must be configured to allow gateway/Route Server transit so that the spokes can inherit the routes learned by the hub's Route Server.

Key Concept

Azure Route Server simplifies dynamic routing between network virtual appliances (NVAs) and virtual networks by establishing BGP peering, eliminating the need to maintain static User Defined Routes (UDRs) across multiple subnets.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic