PCNSE · Question #756
A firewall administrator wants to be able to see all NAT sessions that are going through a firewall with source NAT. Which CLI command can the administrator use?
The correct answer is A. show session all filter nat source. To view all active source NAT sessions on a Palo Alto Networks firewall, use the show session all CLI command with the filter nat source option.
Question
A firewall administrator wants to be able to see all NAT sessions that are going through a firewall with source NAT. Which CLI command can the administrator use?
Options
- Ashow session all filter nat source
- Bshow running nat-rule-ippool rule "rule_name"
- Cshow running nat-policy
- Dshow session all filter nat-rule-source
How the community answered
(15 responses)- A93% (14)
- C7% (1)
Why each option
To view all active source NAT sessions on a Palo Alto Networks firewall, use the `show session all` CLI command with the `filter nat source` option.
The `show session all` command displays all current active sessions on the firewall. Adding `filter nat source` narrows this output to specifically show only those sessions that have undergone source network address translation, allowing the administrator to inspect active source NAT mappings.
The `show running nat-rule-ippool rule "rule_name"` command displays the configuration of a specific NAT rule's IP pool, not active sessions.
The `show running nat-policy` command displays the configured NAT policies, not the active NAT sessions.
The `nat-rule-source` is not a valid filter option for the `show session all` command; the correct filter for source NAT is `nat source`.
Concept tested: CLI command for NAT sessions
Source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-cli-reference/show/show-session-all
Topics
Community Discussion
No community discussion yet for this question.