Examkin

Soru

Zorluk: OrtaConfigure User-Defined Routes and Routing Tables

An Azure environment contains a hub virtual network named `VNet-Hub` (10.100.0.0/1610.100.0.0/16) and a spoke virtual network named `VNet-Spoke` (10.200.0.0/1610.200.0.0/16). The virtual networks are connected using virtual network peering.

`VNet-Hub` contains a network virtual appliance (NVA) named `NVA-FW` with a private IP address of 10.100.1.410.100.1.4.
`VNet-Spoke` contains two subnets:
- `WebSubnet` (10.200.1.0/2410.200.1.0/24)
- `DbSubnet` (10.200.2.0/2410.200.2.0/24)

A route table named `RT-Spoke` is associated with `WebSubnet`. The route table contains the following custom routes:

Route NameDestination PrefixNext Hop TypeNext Hop IP Address
Route-to-DB10.200.2.0/2410.200.2.0/24Virtual appliance10.100.1.410.100.1.4
Route-to-VNet10.200.0.0/1610.200.0.0/16Virtual networkN/A

A virtual machine named `VM-Web` in `WebSubnet` (10.200.1.1010.200.1.10) attempts to establish a connection to a database server in `DbSubnet` (10.200.2.2010.200.2.20).

Which route is selected from `RT-Spoke`, and what configuration is required on `NVA-FW` to allow the traffic to reach the database server?

  1. Route-to-DB is selected; IP forwarding must be enabled on the network interface of `NVA-FW`.Cevap
  2. B
    Route-to-VNet is selected; gateway transit must be enabled on the virtual network peering.
  3. C
    Route-to-DB is selected; the next hop type of Route-to-DB must be changed to Virtual network gateway.
  4. D
    The default system route for the subnet is selected; no additional configuration is required.

Cevap

Route-to-DB is selected; IP forwarding must be enabled on the network interface of `NVA-FW`.
The correct answer states that Route-to-DB is selected and IP forwarding must be enabled on the network interface of `NVA-FW`. This is correct because Route-to-DB (10.200.2.0/2410.200.2.0/24) has the longest prefix match for the destination IP (10.200.2.2010.200.2.20) compared to Route-to-VNet (10.200.0.0/1610.200.0.0/16). Additionally, because the traffic is directed through a Network Virtual Appliance (NVA) that needs to forward packets to another destination, IP forwarding must be enabled on the NVA's NIC in Azure to prevent the platform from dropping the packets.

Adım Adım Çözüm

1
Determine the destination IP address of the network traffic.
The destination IP address is 10.200.2.2010.200.2.20, which belongs to the `DbSubnet` (10.200.2.0/2410.200.2.0/24).
Azure routing evaluates the target destination IP against the prefixes configured in the route table associated with the source subnet.
2
Apply the Longest Prefix Match (LPM) algorithm.
Prefixes 10.200.2.0/2410.200.2.0/24 (length 24) and 10.200.0.0/1610.200.0.0/16 (length 16) match the destination. The /24 prefix is the longest match.
When multiple routes match the destination, Azure prioritizes the route with the most specific prefix (the longest mask).
3
Compare custom UDR precedence against default system routes.
Route-to-DB is a user-defined route (UDR) matching the prefix 10.200.2.0/2410.200.2.0/24. It overrides the default system route for the virtual network.
When UDRs and system routes have the exact same prefix length, the UDR takes precedence and is selected.
4
Configure the virtual appliance network interface.
IP forwarding must be enabled on the virtual machine's network interface (NIC) in Azure.
By default, Azure VMs drop packets that are not addressed to their own IP. Because the NVA acts as a router forwarding packets to 10.200.2.2010.200.2.20, IP forwarding must be enabled to bypass this check.

Anahtar Kavram

Azure Route Selection Rules (Longest Prefix Match, UDR Precedence, and NVA IP Forwarding)
Bu soruyu puanla

Konular

Configure User-Defined Routes and Routing Tables