1Z0-1151-25 Question 38
Select 2Your organization has set up an IPSec VPN between Oracle Cloud Infrastructure (OCI) and a remote Microsoft Azure Virtual Network. You have a Virtual Cloud Network (VCN) in OCI with a private subnet for application servers. You need to enable bi-directional communication between those private subnet instances and the Azure Virtual Network through the OCI Dynamic Routing Gateway (DRG). Which two steps are required to route traffic from your private subnet in OCI to Azure over the IPSec VPN?
- A
Add a private subnet route table entry directing Azure-bound traffic to the DRG.
- B
Include a service gateway route rule for the Azure network CIDR in the private subnet route table.
- C
Configure a network security group (NSG) or security list rule allowing outbound and inbound traffic from the Azure CIDR.
- D
Attach the DRG to a Local Peering Gateway (LPG) within the region to enable external routing.
- E
Configure a NAT Gateway for Azure traffic in the private subnet route table.
Show answer and explanation
Correct answers: A, C
Explanation
To enable communication between OCI private subnets and Azure using an IPSec VPN, you must configure your private subnet route table to send the Azure CIDR to the DRG and create allow rules in your security lists or network security groups for both outbound and inbound traffic. Refer to the 'VCN Overview' and 'DRG and IPSec VPN' sections in the Oracle Cloud Infrastructure Networking Documentation for best practices on managing route tables, security rules, and external connectivity.
- A. Correct.
Correct. You must make sure the private subnet has a route to the Azure CIDR pointing to the DRG. This allows traffic to be forwarded correctly out to the IPSec VPN tunnel attaching through the DRG.
- B. Incorrect.
Incorrect. A service gateway is used for connecting to OCI services like Object Storage, not for third-party network connectivity such as Azure. Traffic to remote networks via IPSec VPN must go through the DRG.
- C. Correct.
Correct. Even if the route is properly configured, the traffic would be blocked unless security rules (through security lists or NSGs) allow outbound requests to the Azure CIDR and corresponding inbound responses.
- D. Incorrect.
Incorrect. An LPG (Local Peering Gateway) is used for peering with another VCN in the same region, not for external routing to Azure. External routing requires a DRG plus an IPSec VPN.
- E. Incorrect.
Incorrect. A NAT gateway is for outbound internet-bound traffic from private subnets, not for traffic going through an IPSec VPN tunnel to another cloud environment. The traffic to Azure must route through the DRG.