156-115.80 · Question #130
Remote VPN clients can initiate connections with internal hosts, but internal hosts are unable to initiate connections with the remote VPN clients, even though the policy is configured to allow it…
The correct answer is D. fw ctl debug -m fw + conn drop packet xlate xltrc nat. Explanation/Reference:
Question
Remote VPN clients can initiate connections with internal hosts, but internal hosts are unable to initiate connections with the remote VPN clients, even though the policy is configured to allow it. You think that this is caused by NAT. What command can you run to see if NAT is occurring on a packet?
Options
- Afw tab -t fwx_alloc -x
- Bfw ctl pstat
- Cfwaccel stats misp
- Dfw ctl debug -m fw + conn drop packet xlate xltrc nat
How the community answered
(27 responses)- A7% (2)
- B4% (1)
- C11% (3)
- D78% (21)
Explanation
Explanation/Reference:
Topics
Community Discussion
4
Nina C.Jun 11, 2026The answer is D, fw ctl debug -m fw + conn drop packet xlate xltrc nat, because those flags tell the fw kernel module to trace translation and NAT events at the packet level, so you can actually see whether NAT is being applied to a specific connection. The other options look at stats or table data, but none of them show you NAT happening on a live packet the way the debug flags do.
Viktor S.Jun 13, 2026Nina's right on the flags, but if you run that debug against a busy firewall without scoping it to a specific src/dst with fw monitor or at least a tight connection filter first, you are going to drown in kernel output and miss the exact NAT decision you were hunting for.
Viktor S.Jun 27, 2026Honestly I kept eyeing A because fwx_alloc screams NAT table to me and I figured dumping it would show allocations in play, but that just shows you connection state entries, it does not trace what is actually happening to a specific packet in flight. D is the right move because you need fw ctl debug with the xlate and nat flags to watch the kernel decision as it processes that exact packet, which is the only way to confirm NAT is actually the culprit and not some routing or policy asymmetry you missed.
Bao N.May 30, 2026So D traces NAT in real time, but do you know what "xlate" actually toggles?