An enterprise is designing a hub-and-spoke virtual network topology in Azure to support a … — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke virtual network topology in Azure to support a multi-tier application. The topology consists of the following components:
- A hub virtual network named `vnet-hub-eus` ( $10.100.0.0/16$ ) that contains an Azure Firewall at IP address `10.100.1.4` and a Virtual Network Gateway connected to an on-premises environment via ExpressRoute.
- A spoke virtual network named `vnet-prod-spoke` ( $10.101.0.0/16$ ) containing a subnet named `snet-web` ( $10.101.1.0/24$ ).
- A virtual network peering connection between `vnet-hub-eus` and `vnet-prod-spoke` with gateway transit configured to allow the spoke to use the hub's gateway.

The on-premises network advertises specific subnets including `192.168.10.0/24` and `192.168.20.0/24` via BGP. You associate a new route table named `rt-prod-web` with the `snet-web` subnet.

You need to design a routing solution that meets the following requirements:
- All traffic from `snet-web` to the internet and to the on-premises subnets must be routed through the Azure Firewall.
- All traffic within the `vnet-prod-spoke` virtual network must route directly between resources and must not go through the Azure Firewall.
- The solution must minimize administrative overhead and avoid configuring individual routes for each on-premises subnet.

Which two actions should you perform to meet the requirements?

Disable virtual network gateway route propagation on the rt-prod-web route table.Answer
Add a route for 0.0.0.0/0 with the next hop set to Virtual Appliance and the next hop address 10.100.1.4 to the rt-prod-web route table.Answer
C
Disable virtual network gateway route propagation on the route table associated with the Azure Firewall subnet.
D
Add a route for 10.101.0.0/16 with the next hop set to Virtual Appliance and the next hop address 10.100.1.4 to the rt-prod-web route table.

Answer

To meet the requirements, you must disable virtual network gateway route propagation on the route table associated with the spoke subnet, and add a default route (0.0.0.0/0) pointing to the Azure Firewall IP address (10.100.1.4).

Disabling virtual network gateway route propagation on the spoke subnet's route table prevents the specific on-premises routes advertised via BGP from being dynamically injected into the subnet's routing table. Consequently, all traffic destined for the on-premises networks and the internet will match the default route (0.0.0.0/0) pointing to the Azure Firewall. Since the local virtual network prefix (10.101.0.0/16) has a more specific system route, local traffic bypasses the default route and remains routed directly within the virtual network.

Step-by-Step Solution

Identify BGP route propagation impact

By default, BGP-propagated routes from the Virtual Network Gateway (like 192.168.10.0/24 and 192.168.20.0/24) are added to the subnet's routing table. Because these prefixes are more specific than a default route (0.0.0.0/0), traffic destined for these ranges will bypass the Azure Firewall.

Azure routing prefers the longest prefix match (LPM).

Disable route propagation on spoke subnet

Disabling virtual network gateway route propagation on the route table associated with the spoke subnet prevents these specific BGP routes from being populated in the spoke subnet's routing table.

This removes the more specific BGP paths from the local routing table, allowing wider UDRs to intercept the traffic.

Add a default route to Azure Firewall

Define a default route (0.0.0.0/0) pointing to the Azure Firewall (10.100.1.4). Since the BGP routes are no longer present in the subnet's routing table, all traffic destined for the internet and the on-premises subnets will match the default route and be forwarded to the Azure Firewall.

The firewall subnet still has gateway route propagation enabled, so it will successfully forward the inspected traffic to the virtual network gateway.

Verify local VNet routing

The local VNet route (10.101.0.0/16 with next hop 'Virtual Network') remains in the routing table and takes precedence over 0.0.0.0/0 because it is more specific.

This ensures intra-spoke traffic does not route through the firewall, fulfilling the second requirement.

Key Concept

Azure Virtual Network Routing Precedence and Gateway Route Propagation

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic