An enterprise is designing a hub-and-spoke network topology in Azure to host a multi-tier … — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke network topology in Azure to host a multi-tier application. The topology consists of the following components:

* A hub virtual network named `vnet-hub-eus` ( $10.100.0.0/16$ ) that hosts a central firewall Network Virtual Appliance (NVA) at the IP address $10.100.1.4$ .
* A spoke virtual network named `vnet-spoke-app` ( $10.200.0.0/16$ ) that contains two subnets: `snet-web` ( $10.200.1.0/24$ ) for web servers and `snet-db` ( $10.200.2.0/24$ ) for database servers.

The virtual networks are peered to allow direct connectivity. You need to design a routing solution that forces all traffic from the web servers in `snet-web` to the database servers in `snet-db` to transit the firewall NVA in the hub for inspection. However, traffic between web servers within the same `snet-web` subnet must remain local and bypass the NVA.

An administrator proposes creating a route table, adding a route for the address prefix $10.200.0.0/16$ with a next hop type of Virtual appliance and IP address $10.100.1.4$ , and associating it with `snet-web`.

What is the primary issue with this proposed design?

A
The custom route is ignored because Azure system-defined local routes always take precedence over user-defined routes with matching address spaces.
B
The route table cannot be associated with the subnet because it contains active Basic SKU Load Balancer resources, which do not support custom routing.
It overrides the local system route for the virtual network, causing intra-subnet traffic within the web subnet to be routed to the NVA.Answer
D
The traffic is blocked because Azure network security groups do not support transit routing through NVAs unless service tags are configured.

Answer

The correct answer is that the proposed route overrides the local system route for the virtual network, causing intra-subnet traffic within the web subnet to be routed to the network virtual appliance (NVA).

The correct answer is correct because User-Defined Routes (UDRs) take precedence over default system-defined routes. By configuring a UDR for the entire VNet prefix (

10.200.0.0/16

), the system route that normally keeps local VNet traffic within the virtual network is overridden. As a result, traffic between hosts on the same subnet is sent to the Network Virtual Appliance (NVA) at

10.100.1.4

, disrupting local communication.

Step-by-Step Solution

Analyze Azure route precedence rules.

Confirm that User-Defined Routes (UDRs) always take precedence over default system routes when the destination prefixes match or are more specific.

This establishes that the custom route table will override the default system routes on the subnet.

Identify the default system route for local traffic.

The spoke virtual network has a system-defined route for

10.200.0.0/16

with the next hop 'Virtual Network' to keep local traffic within the VNet.

This is the baseline route that permits internal communication between systems in different subnets or the same subnet.

Evaluate the impact of the proposed route.

The proposed route targets the broad range

10.200.0.0/16

and points to the NVA (

10.100.1.4

). This directly overrides the 'Virtual Network' system route.

Since the prefixes match, the UDR takes precedence, forcing all VNet-destined traffic to go to the NVA.

Determine how this affects local traffic.

Traffic originating from `snet-web` destined for another IP in the same subnet (e.g.,

10.200.1.10

10.200.1.11

) will match the UDR and be forwarded to the hub NVA, breaking intra-subnet connectivity.

This isolates why the broad address space selection in the UDR is problematic.

Formulate the correct configuration.

Define a more specific UDR targeting only the database subnet (

10.200.2.0/24

) with a next hop pointing to the NVA (

10.100.1.4

By using a more specific prefix for the database subnet, local subnet traffic will continue using the default 'Virtual Network' system route, keeping it local.

Key Concept

Azure route precedence dictates that User-Defined Routes (UDRs) override system-defined routes. Configuring a UDR with an address prefix that encompasses the entire local Virtual Network (VNet) overrides the default local system route, causing all intra-VNet and intra-subnet traffic to be sent to the specified next hop, which breaks local communication.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic