Soru

Zorluk: ZorConfigure User-Defined Routes and Routing Tables

You manage an Azure environment that contains a virtual network named `VNet1` (10.100.0.0/1610.100.0.0/16). `VNet1` contains three subnets named `Subnet-Front` (10.100.1.0/2410.100.1.0/24), `Subnet-Back` (10.100.2.0/2410.100.2.0/24), and `Subnet-Security` (10.100.3.0/2410.100.3.0/24).

A network virtual appliance named `NVA1` is deployed in `Subnet-Security` and is assigned the private IP address 10.100.3.1010.100.3.10.

A virtual machine named `VM-Front` (10.100.1.410.100.1.4) is deployed in `Subnet-Front`. Two virtual machines named `VM-Back1` (10.100.2.5010.100.2.50) and `VM-Back2` (10.100.2.20010.100.2.200) are deployed in `Subnet-Back`.

You create a route table named `RT-Front` and associate it with `Subnet-Front`.

You need to ensure that traffic sent from `VM-Front` to `VM-Back1` is routed through `NVA1` for security inspection, while traffic from `VM-Front` to `VM-Back2` bypasses `NVA1` and is routed directly to `Subnet-Back`.

Which routing configuration and VM setting should you implement?

  1. Configure Route1 in `RT-Front`: Address prefix 10.100.2.0/2410.100.2.0/24, Next hop type: Virtual Appliance, Next hop address: 10.100.3.1010.100.3.10. Configure Route2 in `RT-Front`: Address prefix 10.100.2.128/2510.100.2.128/25, Next hop type: Virtual Network. Enable IP forwarding on the network interface of `NVA1`.Cevap
  2. B
    Configure Route1 in `RT-Front`: Address prefix 10.100.2.0/2410.100.2.0/24, Next hop type: Virtual Network Gateway, Next hop address: 10.100.3.1010.100.3.10. Configure Route2 in `RT-Front`: Address prefix 10.100.2.128/2510.100.2.128/25, Next hop type: Virtual Network. Enable IP forwarding on the network interface of `NVA1`.
  3. C
    Configure Route1 in `RT-Front`: Address prefix 10.100.2.128/2510.100.2.128/25, Next hop type: Virtual Appliance, Next hop address: 10.100.3.1010.100.3.10. Configure Route2 in `RT-Front`: Address prefix 10.100.2.0/2410.100.2.0/24, Next hop type: Virtual Network. Enable IP forwarding on the network interface of `NVA1`.
  4. D
    Configure Route1 in `RT-Front`: Address prefix 10.100.2.0/2410.100.2.0/24, Next hop type: Virtual Appliance, Next hop address: 10.100.3.1010.100.3.10. Configure Route2 in `RT-Front`: Address prefix 10.100.2.128/2510.100.2.128/25, Next hop type: Virtual Network. Enable IP forwarding on the network interfaces of `VM-Back1` and `VM-Back2`.

Cevap

Configure Route1 with prefix 10.100.2.0/2410.100.2.0/24 using next hop type Virtual Appliance (10.100.3.1010.100.3.10), Route2 with prefix 10.100.2.128/2510.100.2.128/25 using next hop type Virtual Network, and enable IP forwarding on the network interface of `NVA1`.
The correct configuration uses the Longest Prefix Match (LPM) principle. For `VM-Back2` (10.100.2.20010.100.2.200), the /25/25 route (10.100.2.128/2510.100.2.128/25) is a longer match than the /24/24 route, directing it directly to the Virtual Network. For `VM-Back1` (10.100.2.5010.100.2.50), only the /24/24 route (10.100.2.0/2410.100.2.0/24) matches, directing its traffic to `NVA1` (10.100.3.1010.100.3.10). Furthermore, since the NVA forwards traffic not addressed to it, IP forwarding must be enabled on its network interface in Azure.

Adım Adım Çözüm

1
Determine the subnet matches for the destination VMs.
VM-Back1 (10.100.2.5010.100.2.50) matches only the 10.100.2.0/2410.100.2.0/24 prefix. VM-Back2 (10.100.2.20010.100.2.200) falls within both the 10.100.2.0/2410.100.2.0/24 and 10.100.2.128/2510.100.2.128/25 prefixes.
Applying CIDR math shows that 10.100.2.128/2510.100.2.128/25 covers IPs from 10.100.2.12810.100.2.128 to 10.100.2.25510.100.2.255, which includes VM-Back2 but excludes VM-Back1.
2
Apply the Longest Prefix Match (LPM) logic to select routes.
VM-Back2 traffic will match Route2 (prefix length 25) over Route1 (prefix length 24) because 25 is a longer subnet mask than 24.
Azure routers prioritize the route with the longest prefix match for any given destination IP.
3
Define next hop types based on requirements.
Set the next hop for Route1 to Virtual Appliance with NVA1's IP (10.100.3.1010.100.3.10), and Route2 to Virtual Network.
This sends VM-Back1 traffic to NVA1 for security inspection and allows VM-Back2 traffic to route directly within the virtual network.
4
Enable IP forwarding on the network virtual appliance.
Configure IP forwarding on the network interface of NVA1.
Azure drops packets by default if the destination IP address does not match the IP of the receiving virtual machine interface. Enabling IP forwarding allows the NVA to receive and forward these transit packets.

Anahtar Kavram

User-defined routes (UDR) override system routes. Routing paths are determined using the Longest Prefix Match (LPM) rule. Traffic forwarded through an NVA requires the next hop type to be Virtual Appliance and IP forwarding to be enabled on the NVA's network interface.
Tahmini Süre:2m 30s
Bu soruyu puanla