Site A W1 cannot ping Site B W1, and the tunnel indicators are not green. Which troubleshooting focus best follows the lab?

### Why this is right The lab specifically recommends checking tunnel status, routes, and security policies when the inter-site ping fails. These checks cover whether the VPN is established, whether traffic is directed into it, and whether the firewall permits the session. ### The concept A failed end-to-end ping can have several causes. A tunnel that is down cannot carry protected traffic; an incorrect route can send traffic elsewhere; and a missing or incorrect security rule can deny it. The lab also provides command-line commands for initializing and displaying IKE and IPsec status and for observing VPN flow. ### The other options - **B. Expose the pre-shared key in a screenshot**: The key must remain masked and revealing it does not diagnose the stated forwarding problem. - **C. Change the destination to Site A's own W1 address**: That tests local reachability, not connectivity to Site B. - **D. Delete the remote-LAN static route because routes are unrelated to VPN traffic**: The route is needed to send remote-LAN traffic through the tunnel. ### Watch out A green tunnel state and a working route are different checks; confirm both along with policy. ### Terms - **IKE**: Internet Key Exchange. Negotiates VPN security associations. - **IPsec**: Internet Protocol Security. Protects IP traffic. - **VPN**: Virtual Private Network. Connects private networks. ### Remember For failed VPN pings, verify tunnel, route, and policy rather than changing the destination arbitrarily.