Exam AZ-700 topic 6 question 1 discussion

In exam Feb, 2023

Correct answers are: - Ultra performance: https://learn.microsoft.com/en-us/azure/expressroute/about-fastpath#gateways - Gateway transit for peering: https://learn.microsoft.com/en-us/azure/expressroute/about-fastpath#virtual-network-vnet-peering

Given answer is correct

https://learn.microsoft.com/en-us/azure/expressroute/about-fastpath#gateways box1: Ultra Performance https://learn.microsoft.com/en-us/azure/expressroute/about-fastpath#limited-general-availability-ga in the NOTE section point 3: FastPath connectivity to a Private endpoint/Link service deployed to a spoke Virtual Network, peered to the Hub Virtual Network (where the ExpressRoute Virtual Network Gateway is deployed), IS NOT SUPPORTED. FastPath only supports connectivity to Private Endpoints/Link services deployed to the Hub Virtual Network. FastPath connectivity to a Private endpoint/Link service deployed to a spoke Virtual Network, peered to the Hub Virtual Network (where the ExpressRoute Virtual Network Gateway is deployed), is not supported. FastPath only supports connectivity to Private Endpoints/Link services deployed to the Hub Virtual Network. box 2: connect vnet2 directly to the ER circuit

Virtual network (VNet) Peering FastPath will send traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway. This feature is available for both IPv4 and IPv6 connectivity.

This is a tricky question on regard of the second option. It's true that FastPath now can send traffic directly to the VM including the peered networks. But , this is talking about if we have only in place express route Direct. For the other options express route, it's not available yet and still it on public review. The case study says that they want to minimize costs..so having an express route direct circuit is not the best idea. However, by adding express route Ultra performance gateway , we can say that we can afford express route direct .. .. cheapest solution would be to add the vm2 traffic directly through the express route circuit... But , once again it's tricky... I will take the Risk and select the option of enabling gateway transit .

https://learn.microsoft.com/en-us/azure/expressroute/about-fastpath so in box 2: peering with transit gateway, leveriging off the fastpath feature in vnet1

FastPath now supports virtual network peering . FastPath will send traffic directly to any VM deployed in a spoke virtual network peered to the virtual network where the ExpressRoute virtual network gateway is deployed. https://azure.microsoft.com/en-ca/updates/general-availability-expressroute-fastpath-support-for-virtual-network-vnet-peering-and-user-defined-routes-udrs-2/

First answer is correct as FastPath only works with Ultra Performance SKU. The second answe must be the dedicated ER: If you have other virtual networks peered with the one that is connected to ExpressRoute, the network traffic from your on-premises network to the other virtual networks (i.e., the so-called "Spoke" VNets) will continue to be sent to the virtual network gateway. The workaround is to connect all the virtual networks to the ExpressRoute circuit directly.

FastPath doesn't work for peered VNets, thus Vnet2 needs a direct connection to the ExpressRoute as well. The data can still flow through Vnet1: Vnet 2 > ExpressRoute > Vnet 1 -> ExpressRoute > ...

but there is a condition that Traffic between Vnet2 and Vnet3 must be routed through Vnet1. i thinkthe gateway transit in vnet1 is correct.

correct