nerdexam
Cisco

200-901 · Question #223

Refer to the exhibit. While developing a Cisco Webex bot, an application reaches the public IP address of the firewall, but traffic is forwarded to the IP address of server 1 instead of the IP address

The correct answer is D. NAT is misconfigured on the firewall.. Traffic is reaching the firewall's public IP but being forwarded to the wrong internal server, which points to a NAT rule misconfiguration on the firewall.

Application Deployment and Security

Question

Refer to the exhibit. While developing a Cisco Webex bot, an application reaches the public IP address of the firewall, but traffic is forwarded to the IP address of server 1 instead of the IP address of server 2. What causes this issue?

Exhibit

200-901 question #223 exhibit

Options

  • AThe proxy server that rewrites traffic is misconfigured.
  • BThe router is sending the traffic to server 1 instead of server 2.
  • CThe switch is forwarding IP traffic to the wrong VLAN.
  • DNAT is misconfigured on the firewall.

How the community answered

(26 responses)
  • A
    15% (4)
  • B
    4% (1)
  • C
    4% (1)
  • D
    77% (20)

Why each option

Traffic is reaching the firewall's public IP but being forwarded to the wrong internal server, which points to a NAT rule misconfiguration on the firewall.

AThe proxy server that rewrites traffic is misconfigured.

A proxy server rewrites application-layer traffic, but forwarding to the wrong internal IP is a network address translation issue at Layer 3, not a proxy rewrite problem.

BThe router is sending the traffic to server 1 instead of server 2.

The router directs traffic toward the firewall's public IP, but mapping that public IP to a specific internal server is controlled by NAT on the firewall, not the router's routing table.

CThe switch is forwarding IP traffic to the wrong VLAN.

VLAN forwarding on a switch operates at Layer 2 and does not determine which internal IP address traffic is sent to; that decision belongs to the firewall's NAT configuration.

DNAT is misconfigured on the firewall.Correct

NAT (Network Address Translation) on the firewall is responsible for mapping the public IP address to the correct internal server IP. If the destination NAT rule is misconfigured, the firewall will forward incoming traffic to the wrong internal host - in this case server 1 instead of server 2. Correcting the DNAT rule to point to server 2's IP address would resolve the misdirection.

Concept tested: Destination NAT misconfiguration on firewall

Source: https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/26704-nat-faq-00.html

Topics

#NAT (Network Address Translation)#Firewall Configuration#Destination NAT#Network Troubleshooting

Community Discussion

No community discussion yet for this question.

Full 200-901 Practice