You are designing a routing solution for an Azure environment to meet corporate security compliance. The environment contains a virtual network named `vnet-prod-spoke` with an address space of .
To ensure security inspection, all outbound traffic destined for the internet must be redirected to an on-premises VPN gateway, while virtual machines within `vnet-prod-spoke` must be able to communicate directly with one another.
You create a custom route table and associate it with the subnets in `vnet-prod-spoke`.
Which route configuration should you add to the route table to meet these requirements?
- A route for with a next hop type of Virtual Network Gateway.Answer
- BA route for with a next hop type of Virtual Network Gateway, and a route for with a next hop type of Virtual Network Gateway.
- CA route for with a next hop type of Virtual Network Gateway, leaving internet-bound traffic to default system routing.
- DA route for with a next hop type of Virtual Network Gateway, and a route for with a next hop type of Internet.
Answer
A route for with a next hop type of Virtual Network Gateway.
The correct configuration is a route for with a next hop type of Virtual Network Gateway. Under Azure's routing rules, the longest prefix match determines which route is selected. Since the virtual network's default system route of is more specific than the default route , traffic destined for resources inside the virtual network will be routed locally, while all other traffic (internet-bound) will be forwarded to the Virtual Network Gateway.
Step-by-Step Solution
Key Concept
Azure uses the longest prefix match (LPM) algorithm to select routes. A user-defined route (UDR) for a broad prefix like does not override more specific system routes, such as the local virtual network route.