An enterprise is designing a secure hub-and-spoke network topology in Azure. The topology … — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a secure hub-and-spoke network topology in Azure. The topology consists of the following components:

* A hub virtual network named `vnet-prod-hub` ( $10.100.0.0/16$ ) containing:
* A subnet named `snet-nva` ( $10.100.1.0/24$ ) that hosts a Network Virtual Appliance (NVA) at IP address $10.100.1.4$ .
* A subnet named `GatewaySubnet` ( $10.100.2.0/24$ ) that hosts an ExpressRoute Virtual Network Gateway.
* A peered spoke virtual network named `vnet-prod-spoke` ( $10.200.0.0/16$ ) containing a subnet named `snet-app` ( $10.200.1.0/24$ ).

The ExpressRoute gateway connects to an on-premises network ( $192.168.0.0/16$ ). Virtual network peering is configured to allow gateway transit.

You need to design a routing solution that meets the following requirements:
1. All traffic from `snet-app` destined for the on-premises network must be inspected by the NVA.
2. All traffic from the on-premises network destined for `snet-app` must be inspected by the NVA.
3. The NVA must be able to forward inspected traffic to its final destination without routing loops or losing connectivity.

Which two configurations should you include in the design?

Associate a route table with the GatewaySubnet that contains a route for 10.200.0.0/16 with the next hop set to Virtual appliance (10.100.1.4).Cevap
Associate a route table with snet-app that contains a route for 192.168.0.0/16 with the next hop set to Virtual appliance (10.100.1.4), and disable BGP route propagation on the route table.Cevap
C
Associate a route table with snet-nva that contains a route for 10.100.0.0/16 with the next hop set to Virtual appliance (10.100.1.4).
D
Disable BGP route propagation on the route table associated with the GatewaySubnet.
E
Associate a route table with snet-app that contains a route for 10.100.0.0/16 with the next hop set to Virtual Network Gateway.

Cevap

The correct configurations are to: 1) Associate a route table with the GatewaySubnet that contains a route for the spoke network space pointing to the NVA as a virtual appliance, and 2) Associate a route table with the spoke subnet containing a route for the on-premises network space pointing to the NVA as a virtual appliance, while disabling BGP route propagation on that route table.

To inspect traffic in both directions, custom routing must be applied to both the spoke subnet and the gateway subnet. Outbound traffic is redirected by associating a route table to the spoke subnet with a UDR for the on-premises network range pointing to the NVA. BGP route propagation must be disabled on the spoke subnet's route table to prevent dynamically advertised routes from on-premises from bypassing the UDR. Inbound traffic is redirected by associating a route table with the GatewaySubnet that contains a UDR for the spoke network range pointing to the NVA, overriding the default system peering route.

Adım Adım Çözüm

Configure outbound routing from the spoke to the NVA.

Associate a route table with the spoke subnet (`snet-app`) containing a UDR for `192.168.0.0/16` pointing to the NVA (`10.100.1.4`) as the next hop.

This ensures that traffic originating from the application tier destined for on-premises is sent to the NVA for inspection instead of using the default system-propagated route.

Ensure BGP routes do not override the outbound UDR.

Disable BGP route propagation on the route table associated with `snet-app`.

By default, Azure system routes learned via BGP (such as specific subnets advertised by the on-premises edge router) take precedence over broader UDRs if they represent a more specific prefix. Disabling route propagation prevents the subnet from dynamically learning these routes, forcing all traffic to follow the custom UDR.

Configure inbound routing from the gateway to the NVA.

Associate a route table with `GatewaySubnet` containing a UDR for `10.200.0.0/16` pointing to the NVA (`10.100.1.4`) as the next hop.

When traffic returns from the on-premises network, the gateway would normally route it directly to the spoke via the default VNet Peering system route. A UDR on the `GatewaySubnet` overrides the default peering path and forces the gateway to send the traffic to the NVA first.

Anahtar Kavram

Azure Custom Routing, Gateway Subnet UDRs, and BGP Route Propagation Controls

Tahmini Süre:2m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru