AZ-700 Question 86
Single answerYour company wants to establish a site-to-site VPN connection between its on-premises network (10.0.0.0/24) and an Azure VNet (10.0.0.0/16). The address spaces overlap, and neither the on-premises network nor the Azure VNet address space can be easily changed due to existing resource dependencies. What is the recommended approach to successfully create the VPN tunnel in Azure under these constraints?
- A
Deploy an Azure Application Gateway with a public IP to reroute traffic away from the overlapping range
- B
Use Azure Firewall to SNAT all on-premises traffic to a new IP range before sending it to the VNet
- C
Enable NAT in the Azure VPN Gateway by configuring NAT rules for the VPN connection
- D
Set up an ExpressRoute circuit to bypass address overlap and dynamically translate traffic
Show answer and explanation
Correct answer: C
Explanation
When neither side can renumber their IP addresses, Azure VPN Gateway NAT rules provide a practical solution for overlapping address spaces. By creating NAT rules in the connection configuration, traffic from the on-premises 10.0.0.0/24 range is translated into a non-overlapping subnet before traversing the tunnel, enabling successful network-to-network communication. Refer to the official Microsoft documentation on 'NAT for site-to-site VPN in Azure VPN Gateway' for detailed configuration steps.
- A. Incorrect.
Incorrect. Application Gateway primarily manages HTTP/HTTPS traffic for web applications and does not address IP overlap at the network layer. It cannot fix overlapping IP addresses for all traffic types in a site-to-site VPN scenario.
- B. Incorrect.
Incorrect. While Azure Firewall can perform SNAT, it is not the recommended or straightforward method for resolving overlapping networks in a site-to-site VPN. Azure Firewall is designed for more extensive firewalling and security use cases rather than resolving address overlap specifically.
- C. Correct.
Correct. Azure VPN Gateway supports NAT rules on site-to-site connections, allowing you to translate IP addresses and avoid overlaps. By configuring these NAT rules, you can map the on-premises 10.0.0.0/24 network to a new, non-overlapping range before sending traffic to the Azure VNet.
- D. Incorrect.
Incorrect. ExpressRoute is a dedicated private connection and does not automatically solve overlapping IP spaces. You would still face the overlap issue, but potentially on a private circuit rather than over the public internet. It does not provide native address translation in the same way NAT on the VPN Gateway does.