1Z0-1072-25 Question 92
Select 2Your organization has set up a site-to-site VPN from an on-premises data center (10.0.0.0/16) to an Oracle Cloud Infrastructure VCN with two private subnets (10.0.50.0/24 and 10.0.51.0/24). Although the IPSec connection is shown as 'Available' in the OCI Console, on-premises clients cannot reach instances running in the private subnets. Which two configuration changes must you implement to restore connectivity?
- A
Add a route rule in the VCN route table for traffic destined for 10.0.0.0/16 pointing to the DRG
- B
Attach a Service Gateway to the VCN to allow external routing to on-premises networks
- C
Update on-premises routing to send traffic bound for 10.0.50.0/24 and 10.0.51.0/24 through the IPSec tunnel
- D
Create a NAT Gateway in the VCN to translate on-premises private addresses to the VCN
Show answer and explanation
Correct answers: A, C
Explanation
For successful site-to-site VPN communication, routes in both directions must be properly configured. In OCI, you typically add route rules in your VCN route table directing on-premises traffic to the DRG. On the on-premises side, you must configure routes that send traffic for the VCN subnets through the IPSec tunnels. Refer to Oracle's documentation (OCI Networking → VPN Connect) for detailed best practices on setting up route-based IPSec tunnels and configuring your DRG and on-premises gateways.
- A. Correct.
Correct. You must add a route rule in your VCN route table sending traffic for on-premises subnets (10.0.0.0/16) to the Dynamic Routing Gateway (DRG). Without this rule, packets from the VCN to on-prem are dropped.
- B. Incorrect.
Incorrect. A Service Gateway is used to access Oracle services in the Oracle Services Network (for example, Object Storage) without traversing the internet. It does not facilitate routing to on-premises networks.
- C. Correct.
Correct. On-premises devices (routers/firewalls) must know to forward traffic for the VCN subnets (10.0.50.0/24 and 10.0.51.0/24) through the IPSec tunnel. If not, responses to on-prem requests never make it back to the sender.
- D. Incorrect.
Incorrect. A NAT Gateway allows instances in private subnets to access the internet without assigning public IP addresses. It does not enable communication between on-premises and private subnets over IPSec.