An enterprise is designing the network routing topology for an Azure environment. The topo… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing the network routing topology for an Azure environment. The topology includes the following components:
- A hub virtual network named `vnet-hub-cus` ( $10.100.0.0/16$ ) containing an Azure Firewall with the private IP address $10.100.2.4$ and an ExpressRoute virtual network gateway.
- A production spoke virtual network named `vnet-prod-spoke` ( $10.110.0.0/16$ ) with a subnet named `snet-prod-app` ( $10.110.1.0/24$ ).
- A shared services spoke virtual network named `vnet-shared-spoke` ( $10.120.0.0/16$ ) with a subnet named `snet-shared-db` ( $10.120.1.0/24$ ).

The virtual networks `vnet-prod-spoke` and `vnet-shared-spoke` are peered directly with `vnet-hub-cus` but are not peered with each other.

The design must meet the following requirements:
- All traffic between `snet-prod-app` and `snet-shared-db` must be routed through the Azure Firewall for inspection.
- Virtual machines in `snet-prod-app` must be able to communicate with the on-premises network ( $172.16.0.0/12$ ) via the ExpressRoute gateway.
- Traffic between virtual machines within the same subnet (`snet-prod-app`) must remain local and bypass the Azure Firewall.

Which TWO configurations should you implement to meet these requirements?

In the route table associated with the `snet-prod-app` subnet, add a route for $10.120.0.0/16$ with the next hop set to the Virtual Appliance IP address $10.100.2.4$ .Answer
Configure the virtual network peering between `vnet-hub-cus` and `vnet-prod-spoke` to enable gateway transit on the hub virtual network and use the remote virtual network's gateway on the spoke virtual network.Answer
C
In the route table associated with the `snet-prod-app` subnet, add a route for $10.110.0.0/16$ with the next hop set to the Virtual Appliance IP address $10.100.2.4$ .
D
In the route table associated with the `snet-prod-app` subnet, add a route for $10.100.0.0/16$ with the next hop set to the Virtual Appliance IP address $10.100.2.4$ , and disable gateway route propagation.

Answer

To meet the requirements, you must add a User Defined Route (UDR) for the shared services spoke network prefix (

10.120.0.0/16

) pointing to the Azure Firewall's private IP (

10.100.2.4

) as the next hop in the subnet's route table, and configure the peering between the hub and production spoke to enable gateway transit on the hub virtual network while utilizing the remote gateway on the spoke virtual network.

The correct configurations involve implementing a specific User Defined Route (UDR) for the destination spoke virtual network (

10.120.0.0/16

) pointing to the Azure Firewall (

10.100.2.4

) as a Virtual Appliance. This redirects spoke-to-spoke traffic through the firewall. Additionally, configuring the virtual network peering to use the hub's gateway for transit allows BGP route propagation for on-premises routes to reach the spoke subnet, securing transit connectivity to the on-premises network.

Step-by-Step Solution

Analyze virtual network peering requirements for on-premises connectivity.

Determine that spoke virtual networks must utilize the ExpressRoute gateway in the hub virtual network by enabling gateway transit on the hub side of the peering and enabling remote gateway usage on the spoke side of the peering.

This allows the spoke virtual network to dynamically learn routes advertised by the gateway via BGP and send on-premises traffic (

172.16.0.0/12

) through the hub gateway.

Configure routing for spoke-to-spoke traffic while preserving local routing behavior.

Determine that a route for the remote spoke's address prefix (

10.120.0.0/16

) must be added to the route table associated with the production subnet pointing to the Azure Firewall (

10.100.2.4

) as a Virtual Appliance next hop.

Because the local VNet route (

10.110.0.0/16

) is more specific than the UDR or is managed by the default local VNet system route, local traffic remains inside the spoke VNet and bypasses the firewall, while traffic to the other spoke is successfully redirected to the firewall.

Key Concept

Azure Virtual Network peering gateway transit and User-Defined Routes (UDR) precedence over default system routes.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic