In the source NAT scenario, the intranet PC (IP is 10.1.1.100) accesses the public network IP 202.11.11.1. The converted IP of the source NAT IP is 201.1.1.2. Which source IP address will be used to…

Question

Options

• A10.1.1.100
• B201.1.1.2
• C127.0.0.1
• D201.11.11.1

• A
  85% (33)
• B
  10% (4)
• C
  3% (1)
• D
  3% (1)

Explanation

In source NAT processing, the firewall evaluates security policies before performing address translation - so the original source IP 10.1.1.100 is what gets matched against the security policy, making A correct. The NAT translation to 201.1.1.2 happens afterward, as a separate step in the packet processing pipeline.

Why the distractors are wrong:

• B (201.1.1.2) is the post-NAT address - it's tempting but wrong because policy matching occurs before translation, not after.
• C (127.0.0.1) is the loopback address and has no role in this scenario whatsoever.
• D (201.11.11.1) is a fabricated address that doesn't correspond to any device in the scenario (the destination is 202.11.11.1, which is different).

Memory tip: Use the phrase "Policy before NAT" - the firewall checks the packet's real identity (original IP) before disguising it. Think of it like a bouncer checking your actual ID before you put on a costume.

No community discussion yet for this question.