PCNSE · Question #55
A company has a web server behind a Palo Alto Networks next-generation firewall that it wants to make accessible to the public at 1.1.1.1. The company has decided to configure a destination NAT…
The correct answer is A. Untrust-L3. On the Original Packet tab of a NAT policy rule, you define the pre-NAT traffic characteristics - what the packet looks like before translation. The public IP 1.1.1.1 is assigned to the Untrust-L3 interface, so inbound client traffic destined for 1.1.1.1 arrives in the…
Question
A company has a web server behind a Palo Alto Networks next-generation firewall that it wants to make accessible to the public at 1.1.1.1. The company has decided to configure a destination NAT Policy rule. Given the following zone information:
DMZ zone: DMZ-L3 Public zone: Untrust-L3 Guest zone: Guest-L3 Web server zone: Trust-L3 Public IP address (Untrust-L3): 1.1.1.1 Private IP address (Trust-L3): 192.168.1.50 What should be configured as the destination zone on the Original Packet tab of NAT Policy rule?
Options
- AUntrust-L3
- BDMZ-L3
- CGuest-L3
- DTrust-L3
How the community answered
(47 responses)- A83% (39)
- B2% (1)
- C11% (5)
- D4% (2)
Explanation
On the Original Packet tab of a NAT policy rule, you define the pre-NAT traffic characteristics - what the packet looks like before translation. The public IP 1.1.1.1 is assigned to the Untrust-L3 interface, so inbound client traffic destined for 1.1.1.1 arrives in the Untrust-L3 zone. Therefore, the destination zone on the Original Packet tab must be Untrust-L3. PAN-OS matches NAT rules against the original packet, meaning the destination zone reflects where the pre-NAT destination IP resides, not where the translated (private) IP lives. The translated destination (192.168.1.50 in Trust-L3) is specified on the Translated Packet tab.
Topics
Community Discussion
No community discussion yet for this question.