An administrator is configuring routing in an Azure hub-and-spoke virtual network topology… — Microsoft Azure Administrator (AZ-104)

An administrator is configuring routing in an Azure hub-and-spoke virtual network topology. The hub virtual network contains a VPN gateway and a Network Virtual Appliance (NVA) at IP address $10.10.1.10$ . A spoke virtual network contains a subnet named `Workload-Subnet` ( $10.20.1.0/24$ ).

A route table named `RT-Workload` is associated with `Workload-Subnet`, and gateway route propagation is enabled. The VPN gateway propagates two routes learned via BGP from an on-premises network:
- $172.16.4.0/23$ with the next hop pointing to the VPN gateway
- $172.16.4.0/24$ with the next hop pointing to the VPN gateway

To route traffic through the NVA, the administrator adds the following User-Defined Routes (UDRs) to `RT-Workload`:
- Route A: Prefix $172.16.0.0/16$ , Next Hop: Virtual Appliance ( $10.10.1.10$ )
- Route B: Prefix $172.16.4.0/24$ , Next Hop: Virtual Appliance ( $10.10.1.10$ )

A virtual machine in `Workload-Subnet` attempts to transmit packets to a database server at $172.16.5.9$ and a web server at $172.16.4.22$ .

Which next hops will Azure use to route the traffic, and what configuration is required on the NVA to ensure packets are not dropped?

Database server: VPN gateway; Web server: Virtual Appliance ( $10.10.1.10$ ). Additionally, IP forwarding must be enabled on the NVA's network interface.Cevap
B
Database server: Virtual Appliance ( $10.10.1.10$ ); Web server: Virtual Appliance ( $10.10.1.10$ ). Additionally, IP forwarding must be enabled on the NVA's network interface.
C
Database server: VPN gateway; Web server: VPN gateway. Additionally, IP forwarding must be disabled on the NVA's network interface.
D
Database server: Virtual Appliance ( $10.10.1.10$ ); Web server: VPN gateway. Additionally, IP forwarding must be enabled on the VPN gateway's network interface.

Cevap

The database server traffic is routed to the VPN gateway, and the web server traffic is routed to the Virtual Appliance (

10.10.1.10

). Additionally, IP forwarding must be enabled on the NVA's network interface.

The correct answer identifies that the database server traffic goes to the VPN gateway because the BGP route (

172.16.4.0/23

) has a longer prefix match than the UDR (

172.16.0.0/16

). For the web server, both the UDR (

172.16.4.0/24

) and the BGP route (

172.16.4.0/24

) match with the same prefix length. Since they are identical, the UDR takes precedence, routing the traffic to the Virtual Appliance. Finally, IP forwarding must be enabled on the NVA network interface so that Azure does not drop the forwarded packets.

Adım Adım Çözüm

Analyze the matching routes for the database server IP address (

172.16.5.9

The matching routes are Route A (UDR

172.16.0.0/16

with next hop NVA) and BGP Route 1 (

172.16.4.0/23

with next hop VPN gateway).

The database server's IP address falls within the subnet ranges of both routes.

Determine the winning route for the database server using Azure route selection precedence.

BGP Route 1 (

172.16.4.0/23

) is selected.

Azure evaluates Longest Prefix Match (LPM) first. A prefix length of 23 (

/23

) is longer than 16 (

/16

), so the BGP route wins over the UDR.

Analyze the matching routes for the web server IP address (

172.16.4.22

The matching routes are Route A (UDR

172.16.0.0/16

), Route B (UDR

172.16.4.0/24

), BGP Route 1 (

172.16.4.0/23

), and BGP Route 2 (

172.16.4.0/24

The web server's IP address falls within the subnet ranges of all four routes.

Determine the winning route for the web server using Azure route selection precedence.

Route B (UDR

172.16.4.0/24

) is selected.

The longest prefix length is 24 (

/24

), shared by Route B and BGP Route 2. When prefix lengths are identical, User-Defined Routes (UDRs) take precedence over BGP-propagated routes.

Determine the required NVA interface configuration.

IP forwarding must be enabled on the network interface of the NVA in Azure.

By default, Azure virtual machines only accept packets addressed to their own interface IPs. Enabling IP forwarding allows the NVA to receive and forward transit traffic.

Anahtar Kavram

Azure route selection rules prioritize the Longest Prefix Match (LPM) first. When two matching routes have the same prefix length, User-Defined Routes (UDRs) take precedence over BGP routes, which in turn take precedence over system routes. Additionally, NVAs must have IP forwarding enabled on their Azure network interfaces to route transit traffic.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular