PCNSE · Question #782
A firewall engineer creates a source NAT rule to allow the company's internal private network 10.0.0.0/23 to access the internet. However, for security reasons, one server in that subnet…
The correct answer is C. 1. Create a source NAT rule (NAT-Rule-1) to translate 10.0.0/23 with source address translation. Palo Alto firewalls process NAT rules top-to-bottom and apply the first matching rule. The correct approach is to create a 'no-NAT' rule (NAT-Rule-1) that matches the specific host 10.0.0.10/32 with no source translation configured, and place it above the broader NAT rule for…
Question
A firewall engineer creates a source NAT rule to allow the company's internal private network 10.0.0.0/23 to access the internet. However, for security reasons, one server in that subnet (10.0.0.10/32) should not be allowed to access the internet, and therefore should not be translated with the NAT rule. Which set of steps should the engineer take to accomplish this objective?
Options
- A
- Create a NAT rule (NAT-Rule-1) and set the source address in the original packet to
- B
- Create a NAT rule (NAT-Rule-1) and set the source address in the original packet to
- C
- Create a source NAT rule (NAT-Rule-1) to translate 10.0.0/23 with source address translation
- D
- Create a source NAT rule (NAT-Rule-1) to translate 10.0.0/23 with source address translation
How the community answered
(14 responses)- B14% (2)
- C79% (11)
- D7% (1)
Explanation
Palo Alto firewalls process NAT rules top-to-bottom and apply the first matching rule. The correct approach is to create a 'no-NAT' rule (NAT-Rule-1) that matches the specific host 10.0.0.10/32 with no source translation configured, and place it above the broader NAT rule for 10.0.0.0/23. When the server at 10.0.0.10 generates traffic, it matches the no-NAT rule first, skipping translation. All other hosts in the /23 subnet continue to match the broader rule and get translated normally.
Topics
Community Discussion
No community discussion yet for this question.