Drop traffic with a route table

subnet-old (10.1.9.0/24, home of vm-old at 10.1.9.4) is being retired, and nothing in subnet-web should send it traffic anymore. Instead of touching every NSG, drop the traffic with a route: create the route table rt-web, add a route for 10.1.9.0/24 with next hop None, and associate it with subnet-web, where vm-web lives.

1. Create the route table.

   az network route-table create -g rg-lab --name rt-webType it
   What's this?

   Creates a route table. Its routes only apply to subnets you attach it to.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

2. Add a route that drops traffic to subnet-old.

   az network route-table route create -g rg-lab --route-table-name rt-web --name drop-old --address-prefix 10.1.9.0/24 --next-hop-type NoneType it
   What's this?

   Adds or changes one route in a route table: traffic for this address range goes to this next hop.

   • -g the resource group the resources live in
   • --route-table-name the route table the route is in
   • --name the name of the thing to look at or change
   • --address-prefix the address range this route is for
   • --next-hop-type where matching traffic goes, such as VirtualAppliance
   • --address-prefix 10.1.9.0/24 the destination this route covers
   • --next-hop-type None drop the traffic

3. Associate the route table with subnet-web.

   az network vnet subnet update -g rg-lab --vnet-name vnet-app --name subnet-web --route-table rt-webType it
   What's this?

   Changes a subnet's settings, such as which NSG or route table is attached to it.

   • -g the resource group the resources live in
   • --vnet-name the virtual network
   • --name the name of the thing to look at or change

4. Look at vm-web's effective routes. Find both routes that contain 10.1.9.4.

   az network nic show-effective-route-table -g rg-lab --name vm-web-nic -o tableType it
   What's this?

   Lists every route that applies to a VM's network interface: system routes, gateway routes and your route tables, and which are active.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

5. Answer the question below.

   Which route wins for 10.1.9.4: the system 10.1.0.0/16 or your 10.1.9.0/24?

   System route

   A route Azure adds for you, such as one for the network's own address space.

   Prefix

   An address range written as start/bits, like 10.1.0.0/16. The number after the slash is how many leading bits are fixed.

   Check