1) To check if the switch is enabled, you could check logs but using a service 'workspace', action of 'setSetting' and tags.settingTypeName of 'enforce_ip_acl_on_dp'.
2) Your classic compute resources can connect to the Azure Databricks Control Plane over NAT or Private Link - it depends on your deployment.
