You need all internet-bound traffic from Azure VMs to route through an on-premises firewall. Which configuration implements forced tunneling?

Remaining questions and full explanations are VIP-exclusive.