1Z0-1072-25 Question 95
Select 2Your organization has set up an IPSec Site-to-Site VPN between your on-premises data center and an Oracle Cloud Infrastructure (OCI) Virtual Cloud Network (VCN). While the VPN tunnel shows as 'up,' you find that traffic from on-premises hosts is not reaching instances in a private subnet in the VCN. Which two steps must you take in OCI to ensure communication to the private subnet over the VPN?
- A
Add a route in the Dynamic Routing Gateway (DRG) route table to direct on-premises traffic to the IPSec tunnel.
- B
Create or update your VCN security list or Network Security Group (NSG) with rules allowing inbound traffic from the on-premises network.
- C
Enable NAT-Traversal (NAT-T) by modifying the IKE phase configuration on the DRG.
- D
Disable automatic route propagation on the DRG and manually add a static route from the DRG to the VCN subnet.
Show answer and explanation
Correct answers: A, B
Explanation
When configuring a Site-to-Site VPN in OCI, both proper routing and appropriate security rules are essential. First, confirm that a route is added in the DRG route table to forward on-premises-bound traffic to the IPSec tunnel. Second, ensure that your security lists or NSGs allow traffic from the remote (on-premises) subnets. For further details, refer to the official OCI documentation on Site-to-Site VPN setup and DRG route configuration.
- A. Correct.
Correct: You must configure a route in the DRG route table so that traffic destined for the on-premises network is forwarded correctly over the IPSec tunnel. Without this route, traffic will not be directed to your on-premises data center.
- B. Correct.
Correct: OCI security lists or NSGs need rules to allow inbound (and potentially outbound) traffic from your on-premises network. If these rules are missing, traffic can be dropped even if the tunnel is established.
- C. Incorrect.
Incorrect: NAT-T is typically negotiated automatically when the IPSec tunnel is established, and it is not a manual DRG setting in OCI. This would not resolve the basic routing or security list issue.
- D. Incorrect.
Incorrect: Disabling automatic route propagation and configuring a static route to the VCN subnet does not address the core requirement of defining the route for on-premises traffic or ensuring that the correct security rules are in place.