In the Palo Alto Networks site-to-site Virtual Private Network (VPN) lab, what carries traffic between the internal networks?

### Why this is right\nThe lab associates the IPsec tunnel with a virtual `tunnel.1` interface, which carries traffic between the internal networks. The Internet-facing interface contacts the remote peer.\n\n### The concept\nThe VPN peer's public address and the tunnel interface have different roles. The external interface transports VPN negotiation and protected packets across the Internet-facing network. Routes send remote-subnet traffic into the tunnel interface, and policies control permitted traffic between zones.\n\n### The other options\n- **The management interface**: this provides firewall administration, not the inter-site data path.\n- **The public web server interface only**: a web-service interface is not the configured VPN data tunnel.\n- **A client-side tunnel address**: this describes a possible remote-access client setting, not the lab's site-to-site tunnel interface.\n\n### Remember\nThe external interface reaches the peer; the tunnel interface carries protected site traffic.