PCNSA · Question #189
Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A…
The correct answer is A. Untrust (Any) to DMZ (1.1.1.100), ssh -Allow E. Untrust (Any) to DMZ (1.1.1.100), web-browsing -Allow. The two security policy rules allow external traffic for web-browsing and SSH to reach a common public IP (1.1.1.100) which is then DNAT'd to the respective internal servers based on the application.
Question
Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address. Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic. Which two Security policy rules will accomplish this configuration? (Choose two.)
Exhibit
Options
- AUntrust (Any) to DMZ (1.1.1.100), ssh -Allow
- BUntrust (Any) to Untrust (10.1.1.1), web-browsing -Allow
- CUntrust (Any) to Untrust (10.1.1.1), ssh -Allow
- DUntrust (Any) to DMZ (10.1.1.100, 10.1.1.101), ssh, web-browsing -Allow
- EUntrust (Any) to DMZ (1.1.1.100), web-browsing -Allow
How the community answered
(36 responses)- A75% (27)
- B3% (1)
- C14% (5)
- D8% (3)
Why each option
The two security policy rules allow external traffic for web-browsing and SSH to reach a common public IP (1.1.1.100) which is then DNAT'd to the respective internal servers based on the application.
This rule correctly allows SSH traffic from the Untrust zone to the public IP (1.1.1.100), which is then DNAT'd to Host B (10.1.1.101) for SSH, fulfilling part of the requirement to steer SSH traffic to Host B. The destination zone DMZ indicates the internal server's logical placement.
This rule incorrectly specifies 'Untrust' as the destination zone and refers to an IP (10.1.1.1) not directly involved as the public DNAT IP for web-browsing in the scenario.
This rule incorrectly specifies 'Untrust' as the destination zone and refers to an IP (10.1.1.1) not directly involved as the public DNAT IP for SSH in the scenario.
This rule attempts to use a single destination (10.1.1.100, 10.1.1.101) for both applications, which is not how destination IP is typically specified in a single policy for application-based DNAT steering to different internal IPs from one public IP.
This rule correctly allows web-browsing (HTTP) traffic from the Untrust zone to the public IP (1.1.1.100), which is then DNAT'd to Host A (10.1.1.100) for HTTP, fulfilling the other part of the requirement to steer HTTP traffic to Host A. The destination zone DMZ indicates the internal server's logical placement.
Concept tested: DNAT with application-based policy steering
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/nat/nat-rule-with-security-policy
Topics
Community Discussion
No community discussion yet for this question.