An enterprise has a hub-and-spoke virtual network topology in the West US 2 region. The hu… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise has a hub-and-spoke virtual network topology in the West US 2 region. The hub virtual network, `vnet-usw2-hub` ( $10.200.0.0/16$ ), contains an Azure Route Server and a pair of active-active network virtual appliances (NVAs) in the subnet `snet-usw2-nva` ( $10.200.1.0/24$ ). The NVAs use BGP to peer with the Azure Route Server. The spoke virtual network, `vnet-usw2-spoke` ( $10.201.0.0/16$ ), contains a subnet named `snet-usw2-app` ( $10.201.1.0/24$ ) and is peered with `vnet-usw2-hub` with gateway transit enabled.

Initially, the NVAs advertise the on-premises range $172.16.0.0/12$ via BGP. To force all on-premises traffic from `snet-usw2-app` through the NVAs, a route table is associated with `snet-usw2-app` containing a user-defined route (UDR) for $172.16.0.0/12$ with the next hop set to the NVAs' internal load balancer IP address ( $10.200.1.100$ ).

A new branch office is added on-premises, and the Virtual Network Gateway in `vnet-usw2-hub` dynamically learns the specific subnet route $172.20.100.0/24$ via ExpressRoute BGP propagation. Azure Route Server propagates this route to `vnet-usw2-spoke`. Security audits show that traffic from `snet-usw2-app` destined for the new branch ( $172.20.100.0/24$ ) is bypassing the NVAs.

You need to ensure that traffic from `snet-usw2-app` to the new branch office is inspected by the NVAs.

What should you do?

A
Disable route propagation on the route table associated with `snet-usw2-app` and create a user-defined route for $0.0.0.0/0$ pointing to the Virtual Appliance IP address of $10.200.1.100$ .
Add a user-defined route for $172.20.100.0/24$ with the next hop set to the Virtual Appliance IP address of $10.200.1.100$ in the route table associated with `snet-usw2-app`.Cevap
C
Enable the branch-to-branch routing setting on `vnet-usw2-hub`'s Azure Route Server.
D
Modify the BGP community string on the NVAs to advertise $172.20.100.0/24$ with a higher Multi-Exit Discriminator (MED) attribute than the ExpressRoute gateway.

Cevap

Add a user-defined route for the specific branch subnet of

172.20.100.0/24

pointing to the NVA internal load balancer (

10.200.1.100

) on the route table associated with `snet-usw2-app`.

Adding a user-defined route for the specific branch subnet of

172.20.100.0/24

pointing to the NVA internal load balancer is correct because Azure routing uses the Longest Prefix Match (LPM) algorithm. The dynamically learned BGP route for

172.20.100.0/24

is more specific than the existing UDR for

172.16.0.0/12

. By creating an explicit UDR for

172.20.100.0/24

, the UDR overrides the BGP route of the same prefix length, directing the traffic to the NVAs.

Adım Adım Çözüm

Analyze the routing table of the subnet `snet-usw2-app`.

Identify that the routing table contains a UDR for

172.16.0.0/12

pointing to

10.200.1.100

, and a propagated BGP route for

172.20.100.0/24

pointing to the ExpressRoute gateway.

To understand why traffic to the new branch is bypassing the NVAs.

Apply the Azure routing priority rules, specifically Longest Prefix Match (LPM).

Determine that the

172.20.100.0/24

prefix is longer and more specific than the

172.16.0.0/12

prefix, meaning the BGP route to the gateway takes precedence over the broader NVA UDR.

To identify the root cause of the routing bypass.

Design a route modification that overrides the propagated BGP route without disrupting other dynamic on-premises routing.

Create a UDR for the specific prefix

172.20.100.0/24

pointing to the NVA internal load balancer (

10.200.1.100

). Since UDRs take precedence over BGP routes of the same prefix length, this forces the traffic through the NVAs.

To ensure that all traffic destined for the new branch office is inspected by the NVAs.

Anahtar Kavram

Azure Routing Precedence and Longest Prefix Match (LPM)

Tahmini Süre:2m 30s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru