1Z0-1072-25 Question 174
Select 2You are troubleshooting connectivity from an on-premises data center to a private OCI compute instance in a Virtual Cloud Network (VCN). The VCN is attached to a Dynamic Routing Gateway (DRG) for IPSec VPN connectivity. On running a Network Path Analyzer from the DRG to the instance� private IP, you observe that the path fails at the DRG route table step. Which two actions should you take to resolve this issue?
- A
Add a route rule in the DRG route table pointing to the VCN for the private subnet address range.
- B
Create an Internet Gateway on the VCN to enable inbound private traffic from on-premises.
- C
Associate the DRG route table with the correct DRG attachment so intended traffic can be forwarded to the VCN.
- D
Check the route rules in the VCN� public subnet route table for the on-premises CIDR block.
Show answer and explanation
Correct answers: A, C
Explanation
In Oracle Cloud Infrastructure, if Network Path Analyzer reports a route-table failure at the DRG step, it is often due to missing route rules or incorrect DRG route table associations. Ensure that the DRG route table includes a route directing the on-premises CIDR block to the appropriate VCN attachment and that the correct route table is associated with the DRG attachment for your VPN. Refer to OCI documentation on Network Path Analyzer and DRG route configurations for best practices.
- A. Correct.
Correct. When the Network Path Analyzer shows a failure at the DRG route table step, it typically means the DRG route table does not have a proper route to direct traffic to the VCN� private subnet. Adding the correct route rule resolves this.
- B. Incorrect.
Incorrect. An Internet Gateway is for public internet traffic. For private connectivity from on-premises through an IPSec VPN, you do not need an Internet Gateway. Creating one does not fix the private route issue.
- C. Correct.
Correct. Even if the correct route rule is present, it must also be associated with the appropriate DRG attachment. If the DRG uses a default route table or an incorrect association, traffic will not route properly to the VCN.
- D. Incorrect.
Incorrect. Checking the VCN� public subnet route table is irrelevant for private traffic over IPSec VPN. The traffic to the private instance does not go through the public subnet route table.