Question

Your company deploys a hub-and-spoke network in Azure. A network virtual appliance (NVA) firewall runs in the hub VNet at private IP 10.0.1.4. You need to ensure that all outbound internet traffic from VMs in the spoke subnet 'AppSubnet' is inspected by the NVA before leaving Azure. What should you configure?

Accepted Answer

Create a route table associated with AppSubnet containing a route with address prefix 0.0.0.0/0, next hop type Virtual appliance, and next hop address 10.0.1.4.

Answer

Create a network security group on AppSubnet that denies all outbound internet traffic except to 10.0.1.4.

Answer

Create a route table associated with AppSubnet containing a route with address prefix 0.0.0.0/0 and next hop type Internet.

Answer

Enable service endpoints for Microsoft.Network on AppSubnet and point them at the NVA.