1Z0-1072-25 Question 93
Select 2You have created and attached an IPSec tunnel to your Dynamic Routing Gateway (DRG) in Oracle Cloud Infrastructure to connect your on-premises network via a Site-to-Site VPN. However, your on-premises users report they cannot reach the application servers in your VCN. You confirm that the IPSec tunnel is up, but traffic is not flowing between the on-premises network and the VCN. Which two actions must you take to ensure that traffic is properly routed between the networks?
- A
Add a route rule in your VCN route table pointing the on-premises network CIDR to the DRG.
- B
Use a service gateway in the VCN to handle all traffic from the on-premises network.
- C
Create an egress-only internet gateway to handle inbound VPN connections.
- D
Update the on-premises router to allow traffic from the VCN CIDR and route it back over the IPSec tunnel.
Show answer and explanation
Correct answers: A, D
Explanation
To enable end-to-end connectivity between your on-premises network and your Oracle Cloud Infrastructure VCN over a Site-to-Site VPN, you must configure both sides with proper routes. In OCI, ensure your VCN route table sends on-premises-bound traffic to the Dynamic Routing Gateway. On-premises, your router or firewall must allow and route Oracle-bound traffic through the IPSec tunnel. Refer to Oracle documentation on 'Configuring Site-to-Site VPN' for detailed steps and best practices.
- A. Correct.
Correct. For site-to-site VPN connectivity, you must configure the VCN route table to send traffic destined for the on-premises network through the DRG. Without this route, your traffic will not know how to exit the VCN to reach on-premises subnets.
- B. Incorrect.
Incorrect. A service gateway is used for accessing Oracle services like Object Storage internally; it does not handle traffic to your on-premises network. This does not solve the routing issue.
- C. Incorrect.
Incorrect. An egress-only internet gateway is designed to allow IPv6 traffic out to the internet but block inbound connections. This provides no benefit for on-premises VPN traffic and does not route VPN packets.
- D. Correct.
Correct. On the on-premises router or firewall, you must allow the VCN subnet CIDRs and configure a route back to the VCN over the IPSec tunnel. If traffic is not sent back to OCI, the tunnel will be up but no data will flow.