An administrator is troubleshooting a newly configured site-to-site VPN between a PAN-OS firewall and a...

Basic Concept: Policy-based VPN peers require each encryption domain pair to be represented in Proxy ID selectors. Adding a subnet requires adding the matching selector.

Why C is Correct: The most likely cause is that the new local/remote subnet pair is missing from Proxy ID configuration even though route and Security policy are correct.

Why A is Wrong: A static route may be needed for route-based VPN reachability, but the scenario says routing is correct and only the newly added subnet pair fails.

Why B is Wrong: Moving the Security policy would matter if the traffic were matching the wrong rule, but the scenario states that Security policy is already correct.

Why D is Wrong: MTU problems usually affect packet size and fragmentation behavior, not only a newly added policy-based VPN subnet selector.