nerdexam
Check_Point

156-215.80 · Question #397

What is a reason for manual creation of a NAT rule?

The correct answer is D. The public IP-address is different from the gateway's external IP. Manual NAT rules are required when the translated public IP address differs from the gateway's own external interface IP, a scenario automatic NAT cannot handle on its own.

Network Address Translation (NAT)

Question

What is a reason for manual creation of a NAT rule?

Options

  • AIn R80 all Network Address Translation is done automatically and there is no need for manually
  • BNetwork Address Translation of RFC1918-compliant networks is needed to access the Internet.
  • CNetwork Address Translation is desired for some services, but not for others.
  • DThe public IP-address is different from the gateway's external IP

How the community answered

(15 responses)
  • A
    7% (1)
  • C
    13% (2)
  • D
    80% (12)

Why each option

Manual NAT rules are required when the translated public IP address differs from the gateway's own external interface IP, a scenario automatic NAT cannot handle on its own.

AIn R80 all Network Address Translation is done automatically and there is no need for manually

This is false - R80 and later releases still support and require manual NAT rules for complex or edge-case scenarios that automatic NAT cannot cover.

BNetwork Address Translation of RFC1918-compliant networks is needed to access the Internet.

Hiding RFC1918 addresses behind a public IP for Internet access is the primary use case that Check Point's automatic Hide NAT handles without manual rules.

CNetwork Address Translation is desired for some services, but not for others.

While service-specific NAT is a valid use case for manual rules, it is not the most definitive reason listed, and option D describes a scenario automatic NAT structurally cannot resolve.

DThe public IP-address is different from the gateway's external IPCorrect

Check Point's automatic NAT uses the gateway's external interface IP as the translated address by default. When the organization uses a public IP that is different from the gateway's interface address - such as a dedicated NAT pool address or an IP assigned by an upstream provider - automatic NAT cannot determine the correct source IP, and a manual NAT rule must explicitly define both the original and translated addresses.

Concept tested: Check Point manual vs automatic NAT rule use cases

Source: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Firewall_AdminGuide/Topics-FW/Manual-NAT-Rules.htm

Topics

#manual NAT rule#automatic NAT#public IP#NAT rule creation

Community Discussion

No community discussion yet for this question.

Full 156-215.80 Practice