1Z0-1072-25 Question 96
Single answerYour company has established a site-to-site VPN in Oracle Cloud Infrastructure (OCI) connecting your on-premises data center to a Virtual Cloud Network (VCN). The IPSec tunnels display a status of 'UP' in the OCI console, but users in the on-premises data center still cannot access resources hosted in the VCN. You have confirmed that your on-premises router has static routes pointing to the VCN CIDR and that the OCI security rules allow traffic from your on-premises subnet. Which action should you take next to ensure traffic can flow from the VCN to your on-premises environment?
- A
Create a NAT gateway in the VCN to provide public IP addresses for all outbound traffic to on-premises.
- B
Add a route in the Dynamic Routing Gateway (DRG) route table, sending traffic for your on-premises subnet to the IPSec tunnel attachment.
- C
Block all inbound connections from your on-premises IP range at the subnet level to restrict unauthorized traffic.
- D
Stop and restart the IPSec connection in the OCI console to refresh the tunnel keys.
Show answer and explanation
Correct answer: B
Explanation
To ensure traffic flows properly over a site-to-site VPN in OCI, correct routing must be configured at both ends. On the OCI side, you must define a route in the DRG route table that specifically directs VCN traffic for your on-premises subnet to the IPSec tunnel attachment. Even if the tunnel shows as 'UP,' traffic will not pass if no matching route exists in the DRG route table. Refer to Oracle's documentation on 'Configuring DRG Route Tables for Site-to-Site VPN' for more details.
- A. Incorrect.
Creating a NAT gateway is intended for allowing instances in private subnets to access the internet without exposing them directly. It does not solve the route configuration issue for traffic over the IPSec tunnel.
- B. Correct.
This is correct. For the VPN tunnel to pass traffic, the DRG route table must have a route rule directing traffic destined for your on-premises subnet to the IPSec tunnel attachment. Without this route, traffic will not be forwarded to your on-premises environment.
- C. Incorrect.
Blocking inbound connections from your on-premises IP range prevents communication. This action would eliminate the possibility of traffic flow, contradicting the goal of enabling access to resources in your VCN.
- D. Incorrect.
Although restarting the IPSec connection might refresh tunnel keys, it will not address a missing or incorrect routing configuration. Tunnels usually re-key automatically, so a manual restart is rarely required to fix routing issues.