PCNSE · Question #145
Given the following diagram: A VPN connection has been created to allow traffic from the Trust-L3 zone of Site A to reach the Trust-L3 zone of Site B. Each site is using tunnel.1 in the Untrust-L3…
The correct answer is A. Name: Route-to-Site-B. To route traffic from Site A to Site B's internal network over a VPN tunnel, a static route on Site A's firewall must specify Site B's internal network as the destination, tunnel.1 as the interface, and Site B's tunnel interface IP as the next hop.
Question
Given the following diagram:
A VPN connection has been created to allow traffic from the Trust-L3 zone of Site A to reach the Trust-L3 zone of Site B. Each site is using tunnel.1 in the Untrust-L3 zone for the VPN connection. A static route needs to be added to the default virtual router in the Site A firewall to enable traffic from Site A to reach all workstations in Site B. Which static route configuration will satisfy the requirement?
Exhibit
Options
- AName: Route-to-Site-B
- BName: Route-to-Site-B
- CName: Route-to-Site-B
- DName: Route-to-Site-B
How the community answered
(54 responses)- A72% (39)
- B7% (4)
- C6% (3)
- D15% (8)
Why each option
To route traffic from Site A to Site B's internal network over a VPN tunnel, a static route on Site A's firewall must specify Site B's internal network as the destination, `tunnel.1` as the interface, and Site B's tunnel interface IP as the next hop.
To direct traffic from Site A to Site B's network (172.16.2.0/24) via the VPN, the static route must correctly define the destination network, use the `tunnel.1` interface which encapsulates VPN traffic, and specify the next hop as the remote end of the tunnel (Site B's tunnel interface IP, 10.0.0.2 in this context, assuming 10.0.0.1 is Site A's tunnel IP).
Specifying `ethernet1/1` (the untrust physical interface) as the egress interface for VPN traffic is incorrect; VPN traffic is logically forwarded through the `tunnel.1` interface, and a next-hop IP is also required for an IP next-hop route type.
While `tunnel.1` is the correct interface, setting `Next Hop: None` is typically used for directly connected networks or blackhole routes, not for routing traffic through an IPsec tunnel where the peer's tunnel IP serves as the next hop.
Specifying `ethernet1/1` as the interface is incorrect as VPN traffic uses the `tunnel.1` interface, even though `ethernet1/1` might be the underlying physical interface.
Concept tested: Static routing over VPN tunnels
Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/vpns/set-up-an-ipsec-vpn-tunnel/configure-static-routes-for-the-ipsec-tunnel.html
Topics
Community Discussion
No community discussion yet for this question.