An organization is designing a hub-and-spoke network topology in Azure. The hub virtual ne… — Microsoft Azure Solutions Architect (AZ-305)

An organization is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-shared`, has an address space of $10.100.0.0/16$ and contains an Azure VPN Gateway in `GatewaySubnet` ( $10.100.0.0/24$ ) and a Network Virtual Appliance (NVA) at IP address $10.100.10.4$ . The spoke virtual network, `vnet-spoke-app`, has an address space of $10.101.0.0/16$ . The networks are connected via virtual network peering.

The design must meet the following requirements:
- Spoke virtual machines must route all internet-bound traffic through the NVA in the hub.
- Spoke virtual machines must communicate with an on-premises network ( $172.16.0.0/12$ ) through the VPN Gateway.
- Spoke virtual machines must communicate directly with resources in the hub virtual network ( $10.100.0.0/16$ ) without passing through the NVA.

Which two configurations should you include in the design? (Select two.)

Configure the virtual network peering to allow gateway transit on `vnet-hub-shared` and use the remote virtual network's gateway on `vnet-spoke-app`.Cevap
Create a route table associated with the subnets in `vnet-spoke-app` that contains a route for $0.0.0.0/0$ with the next hop set to the virtual appliance at $10.100.10.4$ .Cevap
C
Create a route table associated with the subnets in `vnet-spoke-app` that contains a route for $10.100.0.0/16$ with the next hop set to the virtual appliance at $10.100.10.4$ .
D
Create a route table associated with the subnets in `vnet-spoke-app` that has gateway route propagation disabled, and add a route for $172.16.0.0/12$ with the next hop set to Virtual Network Gateway.

Cevap

Configure virtual network peering to allow gateway transit on the hub and use remote gateways on the spoke, and create a route table associated with the spoke subnets containing a route for

0.0.0.0/0

with the next hop set to the virtual appliance.

The correct configurations involve setting up virtual network peering to allow gateway transit and use remote gateways, combined with a user-defined default route (

0.0.0.0/0

) pointing to the network virtual appliance (NVA). Gateway transit allows the spoke virtual network to learn on-premises routes via BGP propagation. The default route redirects internet-bound traffic to the NVA. Because the peering system route for the hub (

10.100.0.0/16

) and the propagated BGP routes for the on-premises network (

172.16.0.0/12

) are more specific than the default route, they take precedence under Azure's longest prefix match algorithm, ensuring direct traffic to the hub and correct routing to the VPN gateway.

Adım Adım Çözüm

Configure gateway transit settings on the virtual network peering connections.

The peering connection allows the spoke virtual network to route traffic through the hub's VPN gateway to access on-premises networks.

By default, peering connections do not allow gateway transit. Enabling 'allow gateway transit' on the hub and 'use remote gateways' on the spoke enables BGP route propagation from the gateway to the spoke.

Ensure BGP route propagation is enabled on the spoke's route table and add a default route (

0.0.0.0/0

) to the NVA.

All internet-bound traffic is redirected to the NVA, while on-premises traffic (

172.16.0.0/12

) and local hub traffic (

10.100.0.0/16

) route directly via BGP and peering system routes.

Azure's routing selection algorithm uses Longest Prefix Match (LPM). More specific routes (such as

10.100.0.0/16

for the hub and

172.16.0.0/12

for on-premises) will always take precedence over the default route (

0.0.0.0/0

) to the NVA.

Anahtar Kavram

Azure virtual network routing priority, virtual network peering gateway transit, and the longest prefix match algorithm.

Tahmini Süre:2m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru