1Z0-1072-25 Question 94
Select 3You are setting up a site-to-site VPN to connect your on-premises environment to an Oracle Cloud Infrastructure Virtual Cloud Network (VCN) using IPSec tunnels and BGP for dynamic routing. Which three steps must you include in your configuration to ensure successful connectivity?
- A
Assign a private IP address for the DRG� BGP IP address in the VCN subnet.
- B
Configure unique BGP Autonomous System Numbers (ASNs) to avoid conflicts between your on-premises router and the Dynamic Routing Gateway (DRG).
- C
Enable BGP route propagation in the VCN route table associated with your subnets.
- D
Create a NAT Gateway in your VCN for all inbound traffic from your on-premises environment.
- E
Open inbound UDP ports 500 and 4500 in your on-premises firewall to allow IKE and IPSec traffic.
Show answer and explanation
Correct answers: B, C, E
Explanation
When configuring an IPSec site-to-site VPN with BGP on OCI, you must properly set unique BGP ASNs between your on-premises router and the DRG, enable BGP route propagation in the VCN route tables, and open the required firewall ports for IPSec traffic. These steps ensure that dynamic routing is established and maintain a secure, reliable VPN connection. For more details, see Oracle� official documentation on �Configuring Site-to-Site VPN with OCI DRG.�
- A. Incorrect.
Option 1 (Incorrect): OCI automatically assigns the BGP IP addresses for each tunnel when using a DRG with IPSec. You do not manually configure or assign private IP addresses for BGP in this scenario, so this step is not required.
- B. Correct.
Option 2 (Correct): You must ensure that the BGP ASN on your on-premises router is different from the DRG ASN. Overlapping ASNs can cause routing conflicts and prevent successful BGP peering.
- C. Correct.
Option 3 (Correct): When using BGP, you need to enable route propagation on the VCN route tables associated with your subnets so that learned routes automatically propagate from the DRG, ensuring seamless routing between on-premises and cloud resources.
- D. Incorrect.
Option 4 (Incorrect): A NAT Gateway is typically used for outbound internet access from the VCN. It is neither necessary nor recommended for inbound VPN traffic from on-premises. The IPSec tunnels and DRG handle traffic in this scenario.
- E. Correct.
Option 5 (Correct): UDP ports 500 (IKE) and 4500 (IPSec) must be opened on your on-premises firewall to allow the IPSec tunnels to establish and maintain secure connectivity with OCI.