A virtual `tunnel.1` interface can carry traffic between the internal networks at the two VPN sites.

### Why this is right The tunnel interface is the logical path used for traffic routed between the sites. The firewall uses a separate Internet-facing interface to reach the remote peer. ### The concept A virtual interface represents the VPN path inside the firewall configuration. A route can select this interface for traffic whose destination is the remote LAN. The physical or external interface provides peer reachability, while the tunnel interface carries the protected inter-site traffic. ### Terms - **LAN**: Local Area Network, a network serving a limited site or location. - **VPN**: Virtual Private Network, a protected connection across another network. ### Remember Peer communication uses the external path; routed site-to-site traffic uses the tunnel interface.