An enterprise is designing a hub-and-spoke network topology in Azure to host a secure mult… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke network topology in Azure to host a secure multi-tier application. The architecture consists of:

* A hub virtual network named `vnet-hub-core` ( $10.100.0.0/16$ ) that hosts a central firewall Network Virtual Appliance (NVA) at IP address $10.100.2.4$ .
* A spoke virtual network named `vnet-prod-spoke` ( $10.150.0.0/16$ ) that contains two subnets: `snet-web` ( $10.150.1.0/24$ ) and `snet-db` ( $10.150.2.0/24$ ).
* Virtual network peering established between `vnet-hub-core` and `vnet-prod-spoke` with gateway transit and remote gateway options enabled.

A route table named `rt-web-tier` is associated with `snet-web` and contains a user-defined route (UDR) for $10.150.2.0/24$ with a next hop pointing to the NVA ( $10.100.2.4$ ) to inspect all database-bound traffic. However, when web servers in `snet-web` attempt to establish database connections to VMs in `snet-db`, the connections time out. The database servers are verified as active, and Network Security Groups (NSGs) allow the traffic.

Which of the following routing configurations is the most appropriate solution to resolve the connectivity issue?

A
Modify the route table `rt-web-tier` to replace the $10.150.2.0/24$ route with a broader route for $10.150.0.0/16$ pointing to the NVA ( $10.100.2.4$ ) as the next hop.
B
Add a UDR for $10.150.1.0/24$ with a next hop of Virtual Network Gateway to the `rt-web-tier` route table.
Create a new route table with a UDR for $10.150.1.0/24$ pointing to the NVA ( $10.100.2.4$ ) as the next hop, and associate it with `snet-db`.Answer
D
Disable gateway route propagation on `rt-web-tier` to force the spoke VNet to prioritize the local system routes over the NVA routes.

Answer

Create a new route table with a UDR for

10.150.1.0/24

pointing to the NVA (

10.100.2.4

) as the next hop, and associate it with `snet-db`.

The correct option is to create a new route table with a UDR for the web subnet's IP range pointing to the NVA, and associate it with the database subnet. Because the database subnet does not have a route table, it defaults to the system local route for the virtual network, bypassing the NVA on the return path. This causes asymmetric routing, which leads the stateful NVA to drop the traffic. Enforcing the return path through the NVA resolves the timeout issue.

Step-by-Step Solution

Analyze the outbound path from the web tier to the database tier.

Traffic from `snet-web` (

10.150.1.0/24

) to `snet-db` (

10.150.2.0/24

) matches the UDR for

10.150.2.0/24

in `rt-web-tier` and is successfully forwarded to the NVA (

10.100.2.4

Verify that the outbound packets are correctly routed to the security appliance.

Analyze the return path from the database tier back to the web tier.

Since `snet-db` has no associated route table, return traffic destined for `snet-web` (

10.150.1.0/24

) uses the default system route for the virtual network (

10.150.0.0/16

-> Local) and bypasses the NVA.

Identify the cause of connection timeouts, which is asymmetric routing. Stateful firewalls drop connection tracking packets (like TCP SYN-ACK) if they do not observe the initial handshake request.

Select a solution that ensures symmetric traffic flow through the firewall.

Create a route table containing a UDR for

10.150.1.0/24

pointing to the NVA and associate it with `snet-db`. This forces the return traffic to flow through the NVA, completing the symmetric path.

Ensure that the stateful firewall tracks both directions of the connection, enabling communication to succeed.

Key Concept

Stateful network virtual appliances (NVAs) require symmetric routing to monitor and allow TCP handshakes. When routing traffic between subnets through an NVA, User-Defined Routes must be applied to both the source and destination subnets to prevent return packets from bypassing the NVA via the default local system route.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic