Troubleshoot: spoke VM lost Internet access after the route to the firewall

حل مشكلة: ‏VM في Spoke فقدت الإنترنت بعد الـ Route للـ Firewall

Ticket #5388 — "Since change CHG-0412 (route table rt-spoke-web : 0.0.0.0/0 → firewall) the web VM vm-web01 in vnet-spoke-web cannot download OS updates from azure.archive.ubuntu.com and the deployment agent cannot reach management.azure.com . Security insists that all egress keeps going through fw-hub and that the guard-rail collection deny-all-web must not be removed. Everything else on the Internet must stay blocked." Diagnose, fix with least privilege and prove it.

The 4 tasks you will do

• Task 1 — Diagnose the pathالمهمة 1 — شخّص الطريق
• Task 2 — Reproduce and read the firewall verdictالمهمة 2 — كرّر المشكلة واقرا حكم الـ Firewall
• Task 3 — Fix with least privilegeالمهمة 3 — صلّح بأقل صلاحيات
• Task 4 — Prove the symptom is goneالمهمة 4 — اثبت إن المشكلة اتحلت