A company is designing a hub-and-spoke virtual network topology in Azure. The hub virtual … — Microsoft Azure Solutions Architect (AZ-305)

A company is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-prod` ( $172.30.0.0/16$ ), contains an Azure Firewall ( $172.30.0.4$ ) and a Virtual Network Gateway that connects to an on-premises network via ExpressRoute. The spoke virtual network, `vnet-spoke-app` ( $10.80.0.0/16$ ), contains a subnet named `snet-web` ( $10.80.1.0/24$ ) and is peered with `vnet-hub-prod` with gateway transit enabled. The on-premises network advertises the prefix $10.200.0.0/16$ via BGP. To comply with security policies, all traffic from `snet-web` to the on-premises network must be inspected by the Azure Firewall. An architect associates a route table with `snet-web` and adds a User Defined Route (UDR) for $10.0.0.0/8$ pointing to the Azure Firewall. However, during testing, traffic from `snet-web` to the on-premises network bypasses the firewall and is routed directly to the gateway. Which of the following actions should the architect take to resolve this issue?

Disable virtual network gateway route propagation on the route table associated with `snet-web`.Answer
B
Configure a User Defined Route (UDR) for $10.80.0.0/16$ pointing to the Azure Firewall.
C
Add a User Defined Route (UDR) for $10.200.0.0/16$ with the next hop set to the Virtual Network Gateway.
D
Change the next hop type of the $10.0.0.0/8$ User Defined Route (UDR) to Virtual Network Gateway.

Answer

Disable virtual network gateway route propagation on the route table associated with the spoke subnet.

Disabling route propagation on the route table associated with the spoke subnet prevents the Virtual Network Gateway from injecting the on-premises BGP-learned routes (such as the specific

10.200.0.0/16

prefix) into the subnet's routing table. In Azure, User Defined Routes (UDRs) take precedence over system routes and BGP routes only if their prefixes are identical or if the UDR has a longer prefix match. Since the propagated route (

10.200.0.0/16

) is more specific than the UDR (

10.0.0.0/8

), the traffic matches the BGP route and bypasses the firewall. Disabling route propagation removes the

10.200.0.0/16

route, causing the traffic to fall back to the

10.0.0.0/8

UDR, which successfully routes it through the Azure Firewall.

Step-by-Step Solution

Analyze how the routing table for the subnet determines the next hop.

Azure uses Longest Prefix Match (LPM) to choose routes. Currently, the subnet table contains a BGP-propagated route for

10.200.0.0/16

(next hop: Gateway) and a UDR for

10.0.0.0/8

(next hop: Virtual Appliance).

Understanding why the traffic bypasses the firewall is necessary to identify the corrective action.

Evaluate the match priority of the destination IP addresses.

Since

10.200.0.0/16

is a longer prefix match than

10.0.0.0/8

, traffic destined for on-premises matches the BGP-learned route and bypasses the UDR pointing to the firewall.

This identifies that BGP route propagation is introducing a more specific prefix that overrides the security intent of the UDR.

Select the configuration change that removes the specific BGP routes from the spoke subnet.

Disabling gateway route propagation on the route table removes the

10.200.0.0/16

route from the subnet's routing table, forcing the traffic to match the

10.0.0.0/8

UDR and flow to the firewall.

Disabling route propagation allows the broader UDR to take effect for the on-premises range without having to define manual UDRs for every propagated prefix.

Key Concept

Azure routing priority, Longest Prefix Match (LPM), and Gateway Route Propagation

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic