You are designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-prod` (), contains an active Virtual Network Gateway connected to your on-premises datacenter. The spoke virtual network, `vnet-spoke-app` (), contains your application workloads. You configure virtual network peering between `vnet-hub-prod` and `vnet-spoke-app`. You need to ensure that the resources in `vnet-spoke-app` can communicate with the on-premises datacenter by using the gateway in `vnet-hub-prod`. Which two configurations should you perform to meet these requirements?
- Configure the virtual network peering on `vnet-hub-prod` to allow gateway transit.Cevap
- Configure the virtual network peering on `vnet-spoke-app` to use the remote virtual network's gateways.Cevap
- CAdd a user-defined route to the route table in `vnet-spoke-app` that overrides the system route for its own local subnet prefix to point directly to the remote gateway.
- DAdd individual security rules in the Network Security Group (NSG) of the spoke subnets for each specific on-premises IP address instead of using the VirtualNetwork service tag.
Cevap
To allow the spoke virtual network to use the virtual network gateway in the hub virtual network, you must configure the peering link on the hub virtual network to allow gateway transit, and configure the peering link on the spoke virtual network to use the remote virtual network's gateways.
To establish connectivity between a spoke virtual network and an on-premises network via a gateway in a peered hub, you must configure both ends of the peering link. First, the hub's peering link must be configured to allow gateway transit. Second, the spoke's peering link must be configured to use the remote virtual network's gateways. This tells Azure to route traffic from the spoke VNet to the hub's gateway.
Adım Adım Çözüm
Anahtar Kavram
Virtual Network Gateway Transit in VNet Peering