You are administering an Azure environment containing a virtual network named `VNet-Core` … — Microsoft Azure Administrator (AZ-104)

You are administering an Azure environment containing a virtual network named `VNet-Core` ( $172.16.0.0/16$ ). The virtual network contains three subnets:
- `Subnet-Workload` ( $172.16.10.0/24$ ) containing application servers.
- `Subnet-DB` ( $172.16.20.0/24$ ) containing database servers.
- `Subnet-NVA` ( $172.16.100.0/24$ ) containing a third-party firewall VM named `NVA-Firewall` with a primary network interface named `nva-nic1` and IP address $172.16.100.4$ .

`VNet-Core` is peered with a hub virtual network named `VNet-Hub` ( $10.10.0.0/16$ ) that has gateway transit configured. An ExpressRoute gateway in `VNet-Hub` propagates a BGP route for the on-premises network range $192.168.50.0/24$ to the subnets in `VNet-Core`.

A route table named `RT-Workload` is associated with `Subnet-Workload` and contains the following custom routes:
- Destination: $172.16.20.0/24$ , Next Hop Type: `VirtualAppliance`, Next Hop IP: $172.16.100.4$
- Destination: $0.0.0.0/0$ , Next Hop Type: `VirtualAppliance`, Next Hop IP: $172.16.100.4$

A new corporate security policy specifies that:
1. All outbound internet traffic from `Subnet-Workload` must be inspected by `NVA-Firewall`.
2. Traffic from `Subnet-Workload` to a specific on-premises server at $192.168.50.99$ must be routed through `NVA-Firewall` for compliance auditing.
3. All other traffic from `Subnet-Workload` to the $192.168.50.0/24$ network must bypass `NVA-Firewall` and go directly through the ExpressRoute gateway.
4. Active traffic routing through `NVA-Firewall` must not be dropped at the virtual network interface level.

Which configuration should you implement to satisfy these requirements?

A
Add a route to `RT-Workload` with the destination prefix $192.168.50.99/32$ , the next hop type set to `VirtualNetworkGateway`, and the next hop IP address $172.16.100.4$ . Then, enable IP forwarding on the network interface `nva-nic1`.
B
Add a route to `RT-Workload` with the destination prefix $192.168.50.0/24$ , the next hop type set to `VirtualAppliance`, and the next hop IP address $172.16.100.4$ . Then, enable IP forwarding on the network interfaces of all application servers in `Subnet-Workload`.
Add a route to `RT-Workload` with the destination prefix $192.168.50.99/32$ , the next hop type set to `VirtualAppliance`, and the next hop IP address $172.16.100.4$ . Then, enable IP forwarding on the network interface `nva-nic1`.Cevap
D
Add a route to `RT-Workload` with the destination prefix $192.168.50.99/32$ , the next hop type set to `VirtualAppliance`, and the next hop IP address $172.16.100.4$ . Then, enable IP forwarding at the virtual network level on `VNet-Core`.

Cevap

Add a route to RT-Workload with the destination prefix 192.168.50.99/32, the next hop type set to VirtualAppliance, and the next hop IP address 172.16.100.4. Then, enable IP forwarding on the network interface nva-nic1.

To route traffic for the specific host

192.168.50.99

through the firewall while sending the rest of the

192.168.50.0/24

network directly via the gateway, we must utilize Azure's Longest Prefix Match (LPM) algorithm. A User-Defined Route (UDR) for

192.168.50.99/32

with a next hop of `VirtualAppliance` (

172.16.100.4

) represents the longest prefix match for that specific host, forcing traffic to go through the firewall. For other hosts in the

192.168.50.0/24

subnet, the BGP route (

192.168.50.0/24

) will be a longer prefix match than the default route (

0.0.0.0/0

), causing them to bypass the firewall and route directly through the ExpressRoute gateway. Additionally, to allow the firewall virtual machine to receive and forward traffic not matching its own destination IP, IP forwarding must be enabled on its network interface (`nva-nic1`).

Adım Adım Çözüm

Identify the destination prefix requirements for the specific host vs the rest of the subnet.

The specific host requires the destination

192.168.50.99/32

, while the rest of the subnet uses

192.168.50.0/24

Using a more specific prefix (/32) ensures that traffic to that host is evaluated first by Azure's Longest Prefix Match (LPM) algorithm.

Determine the routing precedence between the UDR and the BGP-propagated route.

For

192.168.50.99

, the UDR

192.168.50.99/32

wins over the BGP route

192.168.50.0/24

. For other hosts in

192.168.50.0/24

, the BGP route wins over the default UDR

0.0.0.0/0

Azure routes traffic based on the longest prefix match. The UDR route overrides the BGP route for the specific host, while the BGP route overrides the default UDR for the rest of the subnet.

Verify next hop type and IP address requirements.

The next hop type must be `VirtualAppliance` and the IP address must be the internal IP of the firewall (

172.16.100.4

A virtual appliance next hop is required to route traffic through a custom firewall, and the IP address must reside in a locally reachable subnet.

Identify where to configure IP forwarding.

Enable IP forwarding on the firewall's network interface (`nva-nic1`).

Azure drop-filters packets where the source or destination IP does not match the IP of the receiving NIC unless IP forwarding is explicitly enabled on that NIC.

Anahtar Kavram

Azure Longest Prefix Match (LPM) and NVA IP Forwarding

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular