156-215.80 · Question #184
You wish to configure an IKE VPN between two R75 Security Gateways, to protect two networks. The network behind one Gateway is 10.1(5)0.0/16, and network 19(2)168.9.0/24 is behind the peer's…
The correct answer is D. None. When two VPN-connected networks have completely non-overlapping address spaces, no NAT is needed because traffic can route through the tunnel using original addresses without conflict.
Question
You wish to configure an IKE VPN between two R75 Security Gateways, to protect two networks. The network behind one Gateway is 10.1(5)0.0/16, and network 19(2)168.9.0/24 is behind the peer's Gateway. Which type of address translation should you use to ensure the two networks access each other through the VPN tunnel?
Options
- AHide NAT
- BStatic NAT
- CManual NAT
- DNone
How the community answered
(22 responses)- A18% (4)
- B9% (2)
- C5% (1)
- D68% (15)
Why each option
When two VPN-connected networks have completely non-overlapping address spaces, no NAT is needed because traffic can route through the tunnel using original addresses without conflict.
Hide NAT conceals internal hosts behind a single IP address and is used to resolve overlapping address conflicts or provide internet access, neither of which applies here since the networks are distinct.
Static NAT performs one-to-one IP address mapping and is unnecessary because there is no address duplication or conflict between these two non-overlapping subnets.
Manual NAT provides granular administrator-defined translation rules but is unwarranted here since no address conflict exists between the two unique network ranges.
The network 10.150.0.0/16 and 192.168.9.0/24 are entirely distinct, non-overlapping address ranges with no IP conflict between them. When an IKE VPN tunnel is established, traffic is encrypted and forwarded using the original source and destination addresses, and the VPN encryption domains match the actual network subnets without any translation. Applying NAT in this scenario would break the VPN encryption domain matching and disrupt tunnel negotiation.
Concept tested: NAT requirement assessment for non-overlapping VPN encryption domains
Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_VPN_AdminGuide/Topics-VPNG/VPN-and-NAT.htm
Topics
Community Discussion
No community discussion yet for this question.