The web server is configured to listen for HTTP traffic on port 8080. The clients access the web server using the IP address 1.1.1.100 on TCP Port 80. The destination NAT rule is configured to…

Question

Exhibit

Options

• AA security policy with a source of any from untrust-I3 Zone to a destination of 10.1.1.100 in dmz-
• BA NAT rule with a source of any from untrust-I3 zone to a destination of 10.1.1.100 in dmz-zone
• CA NAT rule with a source of any from untrust-I3 zone to a destination of 1.1.1.100 in untrust-I3
• DA security policy with a source of any from untrust-I3 zone to a destination of 1.1.100 in dmz-I3

• A
  8% (4)
• B
  20% (10)
• C
  72% (36)

Explanation

For Destination NAT in PAN-OS, two rules are required: (1) The NAT rule (C) must match traffic as it arrives pre-NAT: source=any, source zone=untrust-l3, destination=1.1.1.100 (public IP), destination zone=untrust-l3 (because the packet has not yet been routed at NAT evaluation time). The rule then translates the destination to 10.1.1.100:8080. (2) The Security policy (D) matches traffic using the pre-NAT source zone (untrust-l3) but the post-NAT destination IP (10.1.1.100) and the post-NAT destination zone (dmz-l3, determined after routing the translated address). Option A is incorrect because it references 10.1.1.100 with 'dmz-zone' - the zone name is dmz-l3 per the scenario. Option B is incorrect because the NAT rule destination zone must be untrust-l3 (pre-NAT), not dmz-zone.

No community discussion yet for this question.