An administrator deploys three Azure virtual networks in the East US region: - `VNet-East`… — Microsoft Azure Administrator (AZ-104)

An administrator deploys three Azure virtual networks in the East US region:
- `VNet-East` ( $192.168.1.0/24$ ) with a subnet named `Subnet-East` containing virtual machines.
- `VNet-Hub` ( $192.168.2.0/24$ ) with a subnet named `Subnet-Hub` containing virtual machines and an Azure VPN Gateway.
- `VNet-West` ( $192.168.3.0/24$ ) with a subnet named `Subnet-West` containing virtual machines.

The administrator configures virtual network peering between `VNet-East` and `VNet-Hub` with the following settings:
- On the `VNet-East` to `VNet-Hub` peering: 'Use remote gateways' is enabled and 'Allow forwarded traffic' is enabled.
- On the `VNet-Hub` to `VNet-East` peering: 'Allow gateway transit' is enabled and 'Allow forwarded traffic' is enabled.

No peering or routing is configured directly between `VNet-East` and `VNet-West`. The administrator then configures peering between `VNet-Hub` and `VNet-West` using default settings.

Based on this configuration, is the statement 'Virtual machines in `Subnet-East` can communicate with virtual machines in `Subnet-West` via the VPN Gateway in `VNet-Hub` without any additional routing configuration' true or false?

Cevap: Cevap

Cevap

The statement is false because virtual network peering in Azure is non-transitive, and a VPN Gateway in a hub network does not automatically route traffic between peered spoke networks without additional routing configurations such as User-Defined Routes (UDRs).

The statement is false because virtual network peering in Azure is non-transitive. Traffic from VNet-East cannot transit through VNet-Hub to reach VNet-West unless direct peering is established between VNet-East and VNet-West, or transit routing is configured using User-Defined Routes (UDRs) and a routing appliance (like Azure Firewall or an NVA) in the hub network.

Adım Adım Çözüm

Analyze the peering topology and transitivity rules in Azure.

The topology consists of two separate peering links: one connecting VNet-East to VNet-Hub, and one connecting VNet-Hub to VNet-West. By design, Azure virtual network peering is non-transitive.

To establish whether traffic from one spoke can reach another spoke automatically through a shared hub.

Examine the peering configurations and gateway settings.

Although gateway transit is enabled on the peering link between VNet-East and VNet-Hub, the link between VNet-Hub and VNet-West uses default settings, which disables remote gateway usage. Furthermore, the Azure VPN Gateway does not automatically perform transit routing for spoke-to-spoke traffic.

To verify if the gateway configuration overrides the non-transitive behavior of peering.

Evaluate the connectivity statement.

Without direct peering between VNet-East and VNet-West, or User-Defined Routes (UDRs) and a routing appliance in VNet-Hub to forward the traffic, the VMs in Subnet-East cannot communicate with VMs in Subnet-West. Therefore, the statement is false.

To determine the correct true/false value based on Azure routing and peering constraints.

Anahtar Kavram

Virtual Network Peering transitivity and gateway transit configuration limitations

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru