When configuring a route-based IPsec site-to-site VPN tunnel on a next-generation firewall using IKE, which three elements must be bound together within the IPsec tunnel configuration?

### Why this is right The IPsec tunnel form requires the tunnel interface, the corresponding IKE gateway, and the IPsec crypto profile. Site A selects `tunnel.1`, its Site_A_to_Site_B gateway, and the default profile, as directed by the lab. ### The concept An IPsec tunnel configuration ties the logical traffic interface to the peer connection and protection settings. The gateway must be the one configured for the remote site. The lab uses the default profile, rather than a newly created custom profile. ### The other options - **B. The internal workstation interface, the Site B workstation as peer, and a new custom profile**: Workstations are not VPN gateways, and the task specifies `tunnel.1` and the default profile. - **C. The Internet-facing interface, the local internal subnet, and no IKE gateway**: The IPsec tunnel needs an IKE gateway and tunnel interface; the physical interface is selected in the gateway configuration. - **D. The `tunnel.1` interface, the Site B static route, and a source network address translation rule**: A route and a translation rule are not substitutes for the required IKE gateway and crypto profile. ### Terms - **IPsec**: Internet Protocol Security. Protects IP traffic. - **IKE**: Internet Key Exchange. Negotiates VPN security associations. ### Remember The IPsec tunnel references an interface, a gateway, and a crypto profile.