PCNSE · Question #35
A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information. - Users outside the company are in the…
The correct answer is A. Untrust-L3 for both Source and Destination zone D. Destination IP of 23.54.6.10. For Destination NAT on a Palo Alto Networks firewall, the NAT policy is evaluated before routing occurs. When an external user sends a packet to the web server's public IP (23.54.6.10), that packet arrives on the untrust-L3 interface. At the time the NAT rule is evaluated, the…
Question
A company hosts a publically accessible web server behind a Palo Alto Networks next generation firewall with the following configuration information.
- Users outside the company are in the "Untrust-L3" zone
- The web server physically resides in the "Trust-L3" zone.
- Web server public IP address: 23.54.6.10
- Web server private IP address: 192.168.1.10
Which two items must be NAT policy contain to allow users in the untrust-L3 zone to access the web server? (Choose two)
Exhibit
Options
- AUntrust-L3 for both Source and Destination zone
- BDestination IP of 192.168.1.10
- CUntrust-L3 for Source Zone and Trust-L3 for Destination Zone
- DDestination IP of 23.54.6.10
How the community answered
(37 responses)- A78% (29)
- B8% (3)
- C14% (5)
Explanation
For Destination NAT on a Palo Alto Networks firewall, the NAT policy is evaluated before routing occurs. When an external user sends a packet to the web server's public IP (23.54.6.10), that packet arrives on the untrust-L3 interface. At the time the NAT rule is evaluated, the packet has not yet been routed to Trust-L3 - it is still in the Untrust-L3 zone. Therefore, both the source zone and destination zone in the NAT policy must be 'Untrust-L3' (A), and the destination IP must be the public IP 23.54.6.10 (D). The NAT rule then translates the destination to the private IP 192.168.1.10. Option C (source=Untrust, destination=Trust) is used in Security policies (post-NAT zone), not NAT policies. Option B (destination IP 192.168.1.10) is the post-NAT address, which is what the rule translates to, not what it matches on.
Topics
Community Discussion
No community discussion yet for this question.