Implement and manage virtual networking
Routing and Connectivity Troubleshooting
CoreConfigure user-defined routes and diagnose DNS, route, and filtering evidence in a repeatable order.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
A connection can fail before a packet is sent, on the selected next hop, at a security boundary, or inside the destination, so administrators need evidence rather than guesswork.
Must Know
- A route table associates with a subnet and contains user-defined routes that map address prefixes to next-hop types.
- Azure selects the most specific matching route, with route-source precedence resolving equally specific candidates.
- Effective routes combine system, user-defined, and propagated routes for a network interface.
- A network virtual appliance route normally requires IP forwarding and an appliance that actually forwards the traffic.
- Troubleshoot in order: name resolution, source and destination addressing, effective route and next hop, security filtering, transport listener, and application response.
Compare and Distinguish
- NSG vs UDR: allow or deny traffic vs select the packet’s next hop.
- Effective security rules vs effective routes: combined filtering decision vs combined path decision for a NIC.
- DNS problem vs route problem vs NSG problem: wrong or missing destination address vs wrong next hop or unreachable path vs traffic denied despite a valid path.
- VNet peering vs routing: establishes connected address reachability vs controls how a subnet sends traffic toward a prefix.
Scenario examples
- Scenario: On-premises traffic from one subnet must traverse a firewall appliance. Think: Associate a route table containing the on-premises prefix and virtual-appliance next hop with that subnet.
- Scenario: A hostname resolves to an old public address while routes and NSGs are correct. Think: Fix DNS before changing the packet path.
- Scenario: Effective routes show the expected appliance but the connection times out. Think: Check appliance forwarding, its interfaces and policy, return route, then downstream filters.
Exam traps
- An allow rule cannot repair a route that sends traffic to the wrong next hop.
- A correct outbound route does not prove the return path is valid.
- Creating a route table has no effect until it is associated with the intended subnet.
Key takeaways
- Diagnose connectivity as resolution, route, filter, listener, and response in sequence.
- Use effective state on the affected NIC rather than reasoning from one route table in isolation.
How it works
- Azure builds a route set for each NIC from platform routes, subnet route tables, peering, and propagated routes, then selects the best match.
- After path selection, applicable security controls and the destination stack determine whether a connection completes.
Objects and administrative surfaces
- Route table — user-defined prefixes, next-hop types, BGP propagation setting, and subnet associations.
- NIC — effective routes and effective security rules for the attached VM path.
- Network Watcher — next-hop, IP flow, topology, packet, and connection diagnostics where supported.
When to use it
- Use a UDR when Azure’s system path must be overridden for a known destination prefix.
- Use effective routes and next-hop diagnostics when observed traffic does not follow the expected topology.
Security and governance implications
- Restrict route-table changes because one broad prefix can redirect or black-hole an entire subnet.
- Document appliance and return-path dependencies so security routing remains intentional.
How to reason about this
- Resolve the name, record source and destination IPs, inspect effective next hop, test the filter decision, confirm listener and guest firewall, then examine application logs.
- If the forward path works but the session fails, repeat the same process for the return path and check asymmetric routing.
More detail
- Create routes for known prefixes, choose a supported next hop, associate the route table at subnet scope, and inspect resulting effective routes.
- Use Network Watcher and resource effective-state views to distinguish routing, filtering, and endpoint failures.
Ready for the quiz?
- Which route wins when two prefixes match the same destination?
- Why can a virtual-appliance route be correct while traffic still stops?
- Which evidence separates a DNS failure from an NSG denial?
Related objectives
- D4.1.S4 — Configure user-defined routes
- D4.1.S5 — Troubleshoot network connectivity