1Z0-1151-25 Question 41
Select 2You host an internal web application on a private subnet in Oracle Cloud Infrastructure (OCI). Your on-premises data center connects to OCI via an IPSec VPN that terminates on a dynamic routing gateway (DRG). Despite creating the VPN tunnel and configuring security rules on the private subnet, on-premises users cannot access the application. Which two additional configurations must you verify or set up to enable successful connectivity?
- A
Add a route rule in the private subnet's route table directing traffic for the on-premises CIDR to the DRG
- B
Configure an Internet Gateway on the VCN for inbound traffic from on-premises
- C
Create a NAT Gateway in the VCN to allow inbound connections from on-premises
- D
Update the DRG route table to send traffic destined for the private subnet CIDR to the VCN
Show answer and explanation
Correct answers: A, D
Explanation
For IPSec VPN connectivity between a private OCI subnet and on-premises hosts, you need proper routing in both directions. That includes adding a route in the private subnet's route table to send on-premises traffic to the DRG and updating the DRG's route table to return traffic to the private subnet CIDR. These configurations ensure bidirectional traffic flow over the VPN tunnel. Refer to OCI documentation on 'VCN Route Tables' and 'Configuring the DRG Route Table' for detailed steps.
- A. Correct.
Correct. To ensure traffic from the private subnet is routed to the on-premises network, you must add a route rule in the subnet� route table pointing on-prem traffic to the DRG. Without this route, packets destined for on-prem will not leave the VCN properly.
- B. Incorrect.
Incorrect. An Internet Gateway is used for outbound traffic to the public internet. It doesn't enable direct on-premises connectivity via a VPN and is not required for this private application scenario.
- C. Incorrect.
Incorrect. A NAT Gateway is primarily used for outbound connections from private subnets to the internet. It does not facilitate inbound traffic or site-to-site VPN routes. Therefore, it doesn't resolve on-premises connectivity issues.
- D. Correct.
Correct. The DRG route table must have a route to forward return traffic back to the private subnet CIDR block. This ensures that responses to on-premises requests find their way back to the VCN private subnet.