In a route-based site-to-site IPsec VPN configuration, which interface serves as the logical egress interface in the routing table for traffic destined for the remote private network?

### Why this is right The virtual tunnel interface is the logical path assigned to traffic that must cross the protected VPN. The Internet-facing interface reaches the remote firewall, but the tunnel interface carries the routed traffic between the sites. ### The concept A site-to-site VPN links two private networks through a protected connection over an Internet-facing network. The tunnel interface gives the firewall a logical interface through which it can route remote-site traffic. A route for the remote LAN points to that interface. The external interface still matters because it provides peer reachability and tunnel negotiation. ### The other options - **A. The Internet-facing interface**: it is used to reach the peer, not as the logical interface for routed private-site traffic. - **C. The host's default gateway interface**: a host sends traffic to its gateway, but the firewall makes the VPN routing decision. - **D. The firewall's management interface**: management access is separate from the data path described here. ### Terms - **VPN**: Virtual Private Network. A protected connection that carries traffic across a less-trusted network. - **LAN**: Local-Area Network. A network serving devices at one site. ### Remember The external interface reaches the peer; the tunnel interface carries the routed traffic.