An enterprise is designing a hub-and-spoke network topology in Azure to support their appl… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke network topology in Azure to support their application infrastructure. The topology includes the following components:
* A hub virtual network named `vnet-hub-useast` ( $10.100.0.0/16$ ) that hosts a Virtual Network Gateway and an Azure Firewall with the private IP address ` $10.100.1.4$ `.
* A spoke virtual network named `vnet-spoke-app` ( $10.101.0.0/16$ ) that contains two subnets: `snet-web` ( $10.101.1.0/24$ ) and `snet-db` ( $10.101.2.0/24$ ).
* An on-premises network ( $172.16.0.0/12$ ) connected to the hub's Virtual Network Gateway via an ExpressRoute circuit.
* Virtual network peering established between `vnet-hub-useast` and `vnet-spoke-app` with gateway transit enabled.

You are designing a routing solution for the subnets in `vnet-spoke-app` to meet these requirements:
1. All outbound traffic destined for the internet must be inspected by the Azure Firewall.
2. All traffic destined for the on-premises network ( $172.16.0.0/12$ ) must route through the Virtual Network Gateway.
3. Traffic between `snet-web` and `snet-db` must route directly within the spoke virtual network without traversing the hub.
4. The configuration must minimize administrative overhead and avoid using statically defined routes for on-premises address ranges.

Which two configurations should you include in the route table associated with the spoke subnets to meet these requirements?

A route for $0.0.0.0/0$ with a next hop type of Virtual appliance and a next hop IP address of $10.100.1.4$ Cevap
Gateway route propagation enabled on the route tableCevap
C
A route for $10.101.0.0/16$ with a next hop type of Virtual appliance and a next hop IP address of $10.100.1.4$
D
A route for $172.16.0.0/12$ with a next hop type of Virtual network gateway and gateway route propagation disabled

Cevap

Add a user-defined route for

0.0.0.0/0

pointing to the Azure Firewall private IP address as a Virtual Appliance, and keep virtual network gateway route propagation enabled on the route table associated with the spoke subnets.

The correct configurations are defining a default route (

0.0.0.0/0

) pointing to the Azure Firewall IP address as a Virtual Appliance, and keeping gateway route propagation enabled on the route table. The default route redirects internet traffic to the firewall. Since Azure routes traffic based on the longest prefix match (LPM), the dynamically propagated routes from the ExpressRoute gateway (such as

172.16.0.0/12

) are more specific than

0.0.0.0/0

and will take precedence, directing on-premises traffic to the Virtual Network Gateway. Furthermore, because no user-defined route is created for the local VNet range (

10.101.0.0/16

), traffic between subnets within the spoke VNet will follow the default system local route and route directly, meeting all criteria with minimal administrative effort.

Adım Adım Çözüm

Determine the routing mechanism for internet-bound traffic.

Create a User Defined Route (UDR) for

0.0.0.0/0

with the next hop set to the Azure Firewall's private IP address (

10.100.1.4

) as a Virtual Appliance.

This redirects all default traffic (internet) to the firewall for security inspection.

Determine the routing mechanism for on-premises traffic.

Ensure gateway route propagation is enabled on the route table.

This allows the spoke subnets to dynamically learn the

172.16.0.0/12

route from the hub's ExpressRoute gateway, minimizing administrative overhead and avoiding static route configuration.

Verify inter-subnet routing behavior within the spoke VNet.

Ensure no UDR exists for

10.101.0.0/16

pointing to the hub.

This allows the default system route for local traffic to handle communication between `snet-web` and `snet-db` directly within the VNet, preventing traffic from traversing the hub.

Anahtar Kavram

Azure Virtual Network routing priorities, specifically how Longest Prefix Match (LPM) dictates that dynamically learned BGP routes from a Virtual Network Gateway take precedence over user-defined default routes (

0.0.0.0/0

), and how UDRs for a local VNet prefix override default system local routing between subnets.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru