In a route-based IPsec VPN configuration on a Palo Alto Networks firewall, traffic destined for the remote network must be directed to a logical _____ interface via a static route.

### Why this is right\nThe lab's static route directs the remote subnet through `tunnel.1`, the virtual interface associated with the IPsec tunnel.\n\n### The concept\nA route selects the next path for traffic based on its destination. Creating a tunnel does not necessarily install a route to the remote LAN. Without the correct route, a firewall may not send matching traffic into the VPN even when tunnel negotiation succeeds.\n\n### Terms\n- **IPsec**: Internet Protocol Security, a set of protections for IP traffic.\n- **LAN**: Local Area Network, a network serving devices in a local site.\n\n### Remember\nA tunnel can be up while a missing remote-subnet route still prevents traffic.