An organization implements an Azure virtual network named `VNet-Production` (10.50.0.0/16)… — Microsoft Azure Administrator (AZ-104)

An organization implements an Azure virtual network named `VNet-Production` ( $10.50.0.0/16$ ). The virtual network contains four subnets:
- `FrontEndSubnet` ( $10.50.1.0/24$ )
- `BackEndSubnet` ( $10.50.2.0/24$ )
- `SecuritySubnet` ( $10.50.3.0/24$ )
- `GatewaySubnet` ( $10.50.0.0/24$ ) which contains a Virtual Network Gateway configured with BGP to propagate routes for an on-premises network ( $172.30.0.0/16$ ).

A virtual machine named `NVA1` is deployed in `SecuritySubnet` and has the private IP address $10.50.3.10$ .

You need to implement custom routing to meet the following requirements:
- All outbound traffic from `FrontEndSubnet` to the internet must be routed through `NVA1`.
- All traffic from `FrontEndSubnet` to `BackEndSubnet` must be routed through `NVA1`.
- Traffic from `FrontEndSubnet` to the on-premises network ( $172.30.0.0/16$ ) must bypass `NVA1` and route directly through the Virtual Network Gateway.

Which two actions should you perform to implement this routing configuration? (Select two.)

Enable IP forwarding on the Azure network interface associated with `NVA1`.Cevap
Create a route table containing a route for $10.50.2.0/24$ with the next hop type Virtual appliance pointing to $10.50.3.10$ , and a route for $0.0.0.0/0$ with the next hop type Virtual appliance pointing to $10.50.3.10$ . Associate this route table with `FrontEndSubnet`.Cevap
C
Create a route table containing a route for $10.50.2.0/24$ with the next hop type Virtual network gateway pointing to $10.50.3.10$ , and a route for $0.0.0.0/0$ with the next hop type Virtual network gateway pointing to $10.50.3.10$ . Associate this route table with `FrontEndSubnet`.
D
Create a route table containing a route for $10.50.2.0/24$ with the next hop type Virtual appliance pointing to $10.50.3.10$ . Associate this route table with `SecuritySubnet` and `BackEndSubnet`.

Cevap

To implement this routing design, you must enable IP forwarding on the Azure network interface associated with the network virtual appliance, and associate a route table to the frontend subnet that routes the backend subnet and default route traffic to the network virtual appliance's IP address.

The correct implementation requires two configurations. First, enabling IP forwarding on the Azure network interface associated with the network virtual appliance is mandatory so that Azure does not drop transit traffic. Second, creating a route table and associating it with the frontend subnet ensures that traffic to the backend subnet and the internet is redirected to the virtual appliance's IP address. By using a default route for the internet traffic, on-premises traffic propagated via BGP is preserved and bypasses the appliance because its prefix length is more specific than the default route, adhering to Longest Prefix Match rules.

Adım Adım Çözüm

Enable IP forwarding on the network virtual appliance.

IP forwarding is enabled on the Azure network interface associated with the virtual machine.

By default, Azure VMs discard packets where the destination IP does not match the VM's assigned IP. Enabling IP forwarding allows the virtual machine's interface to forward transit traffic.

Configure the User-Defined Routes (UDR) for traffic direction.

A route table is defined with a specific route for the backend subnet prefix and a default route for all other traffic, both pointing to the virtual appliance's IP address.

The user-defined route for the backend prefix overrides the local VNet default route. The default route (0.0.0.0/0) redirects all internet traffic through the appliance.

Leverage Longest Prefix Match (LPM) rules for the on-premises bypass.

On-premises routes propagated via BGP are evaluated, and traffic to the on-premises prefix uses the BGP route instead of the default route.

Azure route selection evaluates the longest prefix match. A BGP-learned route (e.g., 172.30.0.0/16) is a longer prefix match than the default route (0.0.0.0/0). Therefore, traffic destined for the on-premises network is routed directly to the Virtual Network Gateway without needing an explicit UDR bypass route.

Associate the route table with the source subnet.

The route table is associated with the frontend subnet.

UDRs only affect traffic originating from the subnets with which the route table is associated.

Anahtar Kavram

Azure Route Selection Precedence, Longest Prefix Match (LPM), and NVA Integration

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular