AZ-700 Question 53
Select 2You have an Azure virtual network (VNet) connected to your on-premises environment via a Site-to-Site VPN. You need to ensure that all internet-bound traffic from virtual machines in the VNet is forced back to the on-premises firewall for inspection before reaching the public internet. Which two actions should you take to configure forced tunneling in this scenario?
- A
Create a custom route table with a default route (0.0.0.0/0) pointing to the VPN gateway, and associate it with the subnets hosting the virtual machines.
- B
Enable IP forwarding on each Azure VM� network interface to ensure traffic is directed to the on-premises firewall.
- C
Associate the route table containing the default route only with the GatewaySubnet, leaving other subnets to use the default Azure routes.
- D
Define corresponding routes in your on-premises route table for the Azure VNet address space to ensure return traffic is routed through the VPN.
Show answer and explanation
Correct answers: A, D
Explanation
Forced tunneling reroutes internet-bound traffic from Azure VNets to your on-premises firewall for inspection. The core steps are: 1) configure a default route (0.0.0.0/0) on the Azure route table pointing to the VPN gateway so outbound traffic goes on-prem, and 2) ensure the on-premises route tables have routes for the Azure VNet address ranges so that reply traffic can return via the VPN tunnel. Refer to Microsoft documentation on forced tunneling and user-defined routes for best practices (https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-forced-tunneling).
- A. Correct.
Correct. To implement forced tunneling, you create a user-defined route (UDR) with the 0.0.0.0/0 prefix and set the next hop to the VPN gateway. This ensures all outbound traffic goes through the on-premises network for inspection. You then associate the route table with the subnets hosting the virtual machines to apply this routing rule.
- B. Incorrect.
Incorrect. Enabling IP forwarding on the VM� NIC is generally needed for network virtual appliances or scenarios that require the VM to route traffic on behalf of others. Simply forcing VMs� outbound traffic through a Site-to-Site VPN does not require IP forwarding at the VM level.
- C. Incorrect.
Incorrect. Associating the route table only with the GatewaySubnet will not redirect VM traffic to on-premises. The subnets where the VMs actually reside need the custom route for forced tunneling to take effect.
- D. Correct.
Correct. In addition to creating routes in Azure, you must configure routing on-premises to send return traffic back to Azure. Otherwise, the on-premises firewall will not know how to reach the Azure VNet address ranges and traffic will fail to return to the VMs.