PCNSA · Question #238
An administrator wants to create a No-NAT rule to exempt a flow from the default NAT rule. What is the best way to do this?
The correct answer is B. Create a new NAT rule with the correct parameters and leave the translation type as None. To create a No-NAT rule, an administrator should create a new NAT rule with specific parameters and set the translation type to None. This ensures the traffic flow bypasses any other NAT rules without modification.
Question
An administrator wants to create a No-NAT rule to exempt a flow from the default NAT rule. What is the best way to do this?
Options
- ACreate a Security policy rule to allow the traffic.
- BCreate a new NAT rule with the correct parameters and leave the translation type as None
- CCreate a static NAT rule with an application override.
- DCreate a static NAT rule translating to the destination interface.
How the community answered
(51 responses)- A14% (7)
- B78% (40)
- C6% (3)
- D2% (1)
Why each option
To create a No-NAT rule, an administrator should create a new NAT rule with specific parameters and set the translation type to None. This ensures the traffic flow bypasses any other NAT rules without modification.
A Security policy rule controls whether traffic is allowed or denied but does not affect NAT translation.
Creating a NAT rule with the translation type set to "None" specifically exempts the matching traffic from NAT processing, effectively making it a No-NAT rule. This rule should be placed higher in the NAT policy order than the default NAT rule it is intended to override.
A static NAT rule translates an IP address, which is the opposite of a No-NAT rule; an application override identifies applications but does not handle NAT.
A static NAT rule translates an IP address, and translating to a destination interface is not a valid or relevant way to create a No-NAT rule.
Concept tested: Palo Alto Networks No-NAT configuration
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/nat/configure-nat/configure-no-nat
Topics
Community Discussion
No community discussion yet for this question.