Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Default system routes in Azure let virtual machines communicate with each other within the same virtual network and send internet-bound traffic without any extra setup. These built-in routes work automatically, but they cannot inspect traffic for security or compliance purposes. When an organization needs to enforce deep security inspection—such as sending all traffic through a firewall or malware scanner—it creates user-defined routes (UDRs) to override the defaults. A user-defined route specifies which traffic destinations the rule applies to through an address prefix, and where that traffic should go through a next-hop type. This override ensures every packet follows the security path the organization requires.
To create a custom route table, you define the traffic you want to control and where it should go. The address prefix tells Azure which destination IP ranges the route affects, such as 10.0.0.0/16 for an entire subnet or 0.0.0.0/0 for all internet traffic. The next-hop type determines the destination for matching traffic. Three common next-hop types serve different purposes: VirtualAppliance sends traffic to a network virtual appliance for inspection, VirtualNetworkGateway routes traffic to a VPN or ExpressRoute connection to on-premises networks, and Internet forces egress traffic directly to the public internet. For forced tunneling—which ensures all internet-bound traffic passes through security controls—you create a route with address prefix 0.0.0.0/0 and set the next-hop type to Internet or to your on-premises firewall appliance.
After defining routes in a route table, you assign the route table to one or more subnets to put it into effect. This association overrides Azure's default system routes for that subnet, channeling all matching traffic through your specified next hops. A single route table can apply to multiple subnets, but each subnet can only have one route table assigned at a time. When you assign a route table with a 0.0.0.0/0 route pointing to your security appliance, all internet-bound traffic from that subnet flows through that appliance first, regardless of where the traffic ultimately goes.
To confirm that custom routes are working correctly, use Azure CLI or PowerShell to inspect the effective route table for a virtual machine's network interface. The CLI command az network nic show-effective-route-table --name MyNic --resource-group MyRG displays all routes currently affecting that network interface, showing which next hop applies to each destination prefix. The PowerShell equivalent Get-AzEffectiveRouteTable -NetworkInterfaceName MyNic -ResourceGroupName MyRG provides the same information. These commands help you verify that traffic follows your intended path and that no unexpected system routes are interfering with your design.
When routing traffic through a network virtual appliance (NVA), you must enable IP forwarding on the appliance's network interface card. IP forwarding allows the NVA to accept packets addressed to other destinations and forward them onward. Without this setting enabled, Azure drops any packets sent to the appliance that are not destined for the appliance itself, breaking your user-defined routes and preventing traffic from reaching its intended destination. This setting is a critical dependency that makes NVA-based inspection possible.
Prepare and test your skills
Prepare and test your skills
Default system routes allow virtual machines to communicate within the same virtual network and send internet-bound traffic automatically, but they cannot enforce security inspection. User-defined routes (UDRs) override these defaults to direct traffic through a specific next hop, such as a firewall, to enforce security and compliance requirements.
You create a user-defined route with the address prefix 0.0.0.0/0 and set the next-hop type to your network virtual appliance, then assign the route table containing that route to the subnet. This overrides the default system routes and ensures all internet-bound traffic from that subnet flows through the appliance first.
IP forwarding must be enabled on the NVA's network interface so the appliance can accept packets addressed to other destinations and forward them onward. Without this setting, Azure drops any packets sent to the appliance that are not destined for the appliance itself, which would break the user-defined routes.
StudyCerts
StudyCerts