PCNSE · Question #695
Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external, public NAT IP for that server. Given…
The correct answer is D. Add source Translation to translate original source IP to the firewall eth1/2 interface translation. In a U-turn (hairpin) NAT scenario, clients in the Trust zone access an internal server using its public NAT IP. The firewall performs destination NAT to translate the public IP to the server's real private IP. However, without source NAT, the server receives the client's real…
Question
Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external, public NAT IP for that server. Given the rule below, what change should be made to make sure the NAT works as expected?
Exhibits
Options
- AChange destination NAT zone to Trust_L3.
- BChange destination translation to Dynamic IP (with session distribution) using firewall eth1/2
- CChange Source NAT zone to Untrust_L3.
- DAdd source Translation to translate original source IP to the firewall eth1/2 interface translation.
How the community answered
(19 responses)- A5% (1)
- B11% (2)
- C21% (4)
- D63% (12)
Explanation
In a U-turn (hairpin) NAT scenario, clients in the Trust zone access an internal server using its public NAT IP. The firewall performs destination NAT to translate the public IP to the server's real private IP. However, without source NAT, the server receives the client's real private IP and responds directly back to the client - bypassing the firewall, causing asymmetric routing and broken sessions. Adding source NAT to translate the client's IP to the firewall's inside interface IP (eth1/2) ensures the server sends its reply back through the firewall, completing the session symmetrically.
Topics
Community Discussion
No community discussion yet for this question.