An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual netw… — Microsoft Azure Solutions Architect (AZ-305)

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-weur-hub` ( $10.100.0.0/16$ ), contains an ExpressRoute Gateway in `GatewaySubnet`, an Azure Route Server in `RouteServerSubnet` ( $10.100.1.0/24$ ), and a pair of active-passive Network Virtual Appliances (NVAs) in `NvaSubnet` ( $10.100.2.0/24$ ). The spoke virtual network, `vnet-weur-spoke-prod` ( $10.101.0.0/16$ ), is peered directly with the hub.

To implement security inspection, all egress traffic to the internet ( $0.0.0.0/0$ ) from both the spoke and the hub must be routed through the NVA ( $10.100.2.4$ ). The NVA advertises the $0.0.0.0/0$ route to the Azure Route Server via BGP.

Which two configurations must you implement to ensure routing functions correctly without routing loops or unsupported configurations?

Associate a route table to the `NvaSubnet` containing a User Defined Route (UDR) for $0.0.0.0/0$ with a next hop type of `Internet`.Cevap
Configure the virtual network peering on `vnet-weur-spoke-prod` to use the remote virtual network's gateway or route server, and configure the peering on `vnet-weur-hub` to allow gateway transit.Cevap
C
Associate a route table to the `RouteServerSubnet` containing a User Defined Route (UDR) for $0.0.0.0/0$ with the next hop set to the NVA's IP address ( $10.100.2.4$ ).
D
Disable BGP route propagation on the route table associated with the `NvaSubnet` to prevent the NVA from learning the default route advertised by the Route Server.

Cevap

Associate a User Defined Route (UDR) for

0.0.0.0/0

pointing to the next hop type of `Internet` on the `NvaSubnet` route table, and configure the virtual network peering on `vnet-weur-spoke-prod` to use the remote gateway/route server while allowing gateway transit on the `vnet-weur-hub` peering.

When an NVA advertises a default route (

0.0.0.0/0

) via BGP to Azure Route Server, the Route Server propagates this default route to all subnets in the hub VNet and peered spoke VNets. To prevent a routing loop where the NVA forwards traffic back to itself, you must override the BGP route on the NVA's subnet by associating a UDR for

0.0.0.0/0

with a next hop type of `Internet`. Additionally, for the spoke VNet to receive this dynamic default route from the Route Server in the hub VNet, the VNet peering must be configured to support gateway transit (allowing gateway transit on the hub VNet side and using the remote gateway or route server on the spoke VNet side).

Adım Adım Çözüm

Analyze the route propagation behavior of Azure Route Server (ARS).

ARS dynamically advertises BGP routes learned from the NVA (including the default route

0.0.0.0/0

) to all subnets in the hub VNet and peered spoke VNets.

This is standard behavior of ARS to ensure dynamic routing propagation across the topology.

Identify potential routing loops at the NVA.

Since ARS propagates the

0.0.0.0/0

route to the NvaSubnet, the NVA would attempt to forward outgoing internet traffic to itself, causing a loop.

A more specific route or a local User Defined Route (UDR) is required to override the BGP-learned route on the NVA's own interface.

Apply a UDR to the NVA's subnet.

Create a route table with

0.0.0.0/0

pointing to the next hop type `Internet` and associate it with the `NvaSubnet`.

UDRs always take precedence over BGP routes, ensuring the NVA can send clean egress packets directly to Azure's physical internet boundary.

Configure the virtual network peerings for route transit.

Enable 'Use remote virtual network's gateways' on the spoke peering and 'Allow gateway transit' on the hub peering.

Without these peering settings enabled, ARS cannot propagate the dynamically learned routes to the peered spoke VNets, rendering the spoke isolated from the egress design.

Anahtar Kavram

Azure Route Server routing loop prevention and transit peering configuration.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru