PCNSA · Question #319
An administrator is trying to understand which NAT policy is being matched. In what order does the firewall evaluate NAT policies?
The correct answer is B. From top to bottom. Palo Alto Networks firewalls evaluate NAT policies strictly from top to bottom, matching the first rule that fits the traffic. Unlike some other policy types, there is no prioritization by NAT type (Static, Dynamic IP, or Dynamic IP and Port). This means rule ordering is…
Question
An administrator is trying to understand which NAT policy is being matched. In what order does the firewall evaluate NAT policies?
Options
- ADynamic IP and Port first, then Static, and finally Dynamic IP
- BFrom top to bottom
- CStatic NAT rules first, then lop down
- DStatic NAT rules first, then Dynamic
How the community answered
(29 responses)- A3% (1)
- B90% (26)
- C7% (2)
Explanation
Palo Alto Networks firewalls evaluate NAT policies strictly from top to bottom, matching the first rule that fits the traffic. Unlike some other policy types, there is no prioritization by NAT type (Static, Dynamic IP, or Dynamic IP and Port). This means rule ordering is critical - more specific rules must be placed above more general ones to ensure correct matching. Administrators should design NAT rule order carefully to avoid unintended matches.
Topics
Community Discussion
No community discussion yet for this question.