AZ-700 Question 144
Select 2You have deployed an Azure Route Server in a hub virtual network to streamline dynamic routing between your on-premises environment and a network virtual appliance (NVA) in Azure. You configure BGP sessions between the Route Server and the NVA to advertise routes. To achieve sub-second failover during link disruption, you enable Bidirectional Forwarding Detection (BFD) on the NVA. However, in testing, traffic still takes approximately 30 seconds to fail over, indicating that BFD is not functioning as expected. Which two actions should you take to ensure that sub-second failure detection with BFD is successfully implemented?
- A
Explicitly enable BFD on Azure Route Server using a dedicated PowerShell or CLI command.
- B
Configure matching sub-second BFD timers on the NVA to synchronize with Azure Route Server defaults.
- C
Allow BFD traffic (UDP) inbound and outbound on the NVA to ensure packets are not blocked by firewall rules.
- D
Assign a public IP address to Azure Route Server to assist with BFD sub-second detection.
- E
Disable route-based VPN on the NVA so BFD can operate over a policy-based configuration.
Show answer and explanation
Correct answers: B, C
Explanation
Bidirectional Forwarding Detection (BFD) provides sub-second detection of link failures. In Azure, when using Azure Route Server, BFD is automatically negotiated if the NVA is properly configured and does not block BFD packets. The main tasks involve ensuring that the NVA is set up with sub-second BFD timers and that the corresponding UDP ports are open so that BFD packets can be exchanged. This allows Azure Route Server to detect link disruptions quickly and bring down BGP sessions within a fraction of a second, rather than waiting for the typical BGP hold timer. For further details, refer to the Azure Route Server and VPN Gateway BGP documentation regarding BFD behavior and timer configurations.
- A. Incorrect.
Option 1: Incorrect. Azure Route Server automatically supports BFD if the peer (the NVA) initiates it. There is no dedicated 'Enable-Bfd' command in PowerShell or CLI for Azure Route Server. If BFD is configured on the NVA side and not blocked, Azure Route Server will negotiate BFD parameters automatically.
- B. Correct.
Option 2: Correct. For sub-second detection, the NVA must use matching or compatible BFD timers. Having correct timers on the NVA ensures rapid tag-down detection and helps Azure Route Server react quickly.
- C. Correct.
Option 3: Correct. BFD uses specific UDP ports (for example, 3784/4784). If the NVA is blocking or dropping these packets, BFD sessions cannot form or function correctly, causing failover to take the default BGP hold timer (around 30 seconds). Allowing these ports at the firewall level is crucial.
- D. Incorrect.
Option 4: Incorrect. Azure Route Server does not require a public IP address to run BFD sessions with internal peers; it can operate within the virtual network address space. Public IP assignment is not related to sub-second detection.
- E. Incorrect.
Option 5: Incorrect. BFD requires a dynamic routing protocol (like BGP) over a route-based setup rather than a policy-based one. Disabling route-based configuration would actually prevent BGP and BFD from functioning as intended.