An administrator is configuring a route-based site-to-site IPsec VPN on a firewall to connect Site A to Site B. Site B's internal network is 192.168.20.0/24, and the VPN terminates on logical interface `tunnel.1`. Which static route configuration on the Site A firewall correctly directs traffic to Site B across the VPN?

### Why this is right Site B's internal subnet is 172.17.20.0/24. The lab directs Site A to create a route for that destination through `tunnel.1` and select None for the next hop. ### The concept A static route tells a firewall where to send traffic for a destination network. Here the VPN tunnel interface identifies the route's outgoing logical interface. The peer's Internet address belongs in the IKE gateway configuration, not as the next hop for this tunnel route. ### The other options - **B. Destination 172.17.10.0/24, interface `ethernet1/1`, next hop 10.xx.xx.253**: 172.17.10.0/24 is Site A's own LAN; the listed peer address is not the tunnel route's next hop. - **C. Destination 172.16.20.0/24, interface `tunnel.1`, next hop 172.17.20.1**: 172.16.20.0/24 is Site B's workstation subnet in the preparation task, not the remote LAN destination specified for this route. - **D. Destination 172.17.20.0/24, interface `ethernet1/2`, next hop None**: the route must use the tunnel interface, not a physical LAN interface. ### Terms - **LAN**: Local Area Network. A network serving a limited site or location. - **Subnet**: A defined range of Internet Protocol addresses. ### Remember Route the remote LAN prefix through the tunnel interface, not through the Internet-facing interface.