An organization deploys an Azure virtual network named `vnet-prod-eastus` with the address… — Microsoft Azure Solutions Architect (AZ-305)

An organization deploys an Azure virtual network named `vnet-prod-eastus` with the address space $10.95.0.0/16$ . The virtual network contains three subnets:
* `snet-web` ( $10.95.1.0/24$ )
* `snet-db` ( $10.95.2.0/24$ )
* `snet-nva` ( $10.95.10.0/24$ ), which hosts a Network Virtual Appliance (NVA) at the IP address $10.95.10.4$ .

The organization intends to inspect all traffic from `snet-web` to `snet-db` using the NVA. An administrator creates a route table named `rt-prod-web`, associates it with `snet-web`, and adds a user-defined route (UDR) with the address prefix $10.95.0.0/16$ and the next hop pointing to the NVA.

After applying the route table, virtual machines in `snet-web` can no longer communicate with each other, and all intra-subnet traffic within `snet-web` fails.

What is the primary cause of this communication failure?

A
The next hop type of Virtual Appliance is not supported for destinations within the same virtual network.
The user-defined route overrides the default virtual network system route for the entire address space, redirecting local intra-subnet traffic to the NVA.Cevap
C
Azure system routes for local virtual network traffic always take precedence over user-defined routes, causing a routing loop.
D
The virtual network automatically creates a default system route of $10.95.1.0/24$ for the subnet that takes precedence over the user-defined route.

Cevap

The user-defined route overrides the default virtual network system route for the entire address space, redirecting local intra-subnet traffic to the NVA.

The correct answer explains that user-defined routes take precedence over default system routes when the destination prefixes match. The system route for local virtual network traffic is

10.95.0.0/16

('Virtual network'). By defining a UDR with the prefix

10.95.0.0/16

pointing to the NVA, all local traffic within the virtual network—including traffic between hosts in the same subnet (`snet-web`)—is redirected to the NVA. If the NVA cannot process or loop back this traffic, intra-subnet communication fails.

Adım Adım Çözüm

Analyze the virtual network layout and system routes.

The virtual network `vnet-prod-eastus` has the prefix

10.95.0.0/16

, which creates a default Azure system route of

10.95.0.0/16

with next hop 'Virtual network'.

Understanding the default system routing behavior is necessary to evaluate how user-defined routes interact with it.

Evaluate the user-defined route (UDR) prefix and destination.

The UDR configures prefix

10.95.0.0/16

with next hop 'Virtual Appliance' (

10.95.10.4

This shows that the UDR prefix exactly matches the default virtual network system route.

Apply Azure route selection precedence rules.

For identical prefixes (

10.95.0.0/16

), the user-defined route (UDR) takes precedence over the system route. Consequently, all traffic within the VNet, including intra-subnet traffic in `snet-web`, is sent to the NVA, breaking local communication if the NVA is not configured to handle it.

Azure determines the next hop by looking for the longest prefix match, and if prefixes are equal, it prioritizes UDR over default system routes.

Anahtar Kavram

Azure route selection and precedence rules between User Defined Routes (UDR) and default system routes.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru