Spoke subnets still go straight to the Internet and bypass the hub Azure Firewall. What user-defined route should the security engineer attach?
Select an answer to reveal the explanation.
Short Explanation
Spokes are moonwalking past the firewall. Force 0.0.0.0/0 to the firewall’s private IP as Virtual appliance—and don’t UDR the firewall subnet into a loop.
Full Explanation
Forced tunneling uses a user-defined default route (0.0.0.0/0) with next hop Virtual appliance pointing at the hub firewall’s private IP so spoke egress is inspected. The firewall subnet must not receive a default route that sends its own traffic back to itself. A default route to Internet defeats inspection. Next hop None blackholes prefixes rather than steering them through the firewall for controlled egress.