A VPN tunnel shows as established, but a host cannot reach a host on the remote network. Which configuration item most directly determines whether the firewall sends traffic for that remote subnet into the tunnel?

### Why this is right The static route controls forwarding for destinations on the remote subnet. A negotiated tunnel does not automatically mean that every destination will be sent through it. ### The concept VPN establishment and traffic routing are separate checks. The tunnel can be available while the firewall lacks a route for the remote network. A static route associates the remote subnet with the tunnel interface, directing matching packets through the protected path. Troubleshooting should also check policies and host addressing, but the route is the item that selects this path. ### The other options - **B. The firewall's management password**: it controls administrative access, not packet forwarding. - **C. The local host's display name**: a label does not determine a network route. - **D. The peer's Internet-facing interface label**: the peer address and interface matter to tunnel setup, but the route determines the path for the remote subnet. ### Terms - **VPN**: Virtual Private Network. A protected connection between networks. - **Subnet**: A defined range of Internet Protocol addresses treated as a network. ### Remember A green tunnel is not proof that the remote subnet has a route.