nerdexam
Palo_Alto_Networks

PCNSE · Question #793

A new application server 192.168.197.40 has been deployed in the DMZ. There are no public IP addresses available, resulting in the server sharing NAT IP 198.51.100.88 with another DMZ serve that…

The correct answer is D. Sharing a single NAT IP is possible for outbound connectivity not for inbound therefore a new. Sharing a single public IP address for inbound connections (Destination NAT) to multiple distinct internal servers is generally not possible without port translation or an application proxy.

Submitted by ngozi_ng· Apr 18, 2026Configuration Troubleshooting

Question

A new application server 192.168.197.40 has been deployed in the DMZ. There are no public IP addresses available, resulting in the server sharing NAT IP 198.51.100.88 with another DMZ serve that uses IP address 192.168.197.60. Firewall security and NAT rules have been configured. The application team has confirmed that the new server is able to establish a secure connection to an external database with IP address 203.0.113.40. The database team reports that they are unable to establish a secure connection to 198.51.100.88 from 203.0.113.40. However, it confirms a successful ping test to 198.51.100.88. Referring to the NAT configuration and traffic logs provided how can the firewall engineer resolve the situation and ensure inbound and outbound connections work concurrently for both DMZ servers?

Exhibit

PCNSE question #793 exhibit

Options

  • AMove the NAT rule 6 DMZ server 2 above NAT rule 5 DMZ server 1.
  • BReplace the two NAT rules with a single rule that has both DMZ servers as "Source Address"
  • CConfigure separate source NAT and destination NAT rules for the two DMZ servers without using
  • DSharing a single NAT IP is possible for outbound connectivity not for inbound therefore a new

How the community answered

(42 responses)
  • A
    10% (4)
  • B
    5% (2)
  • C
    2% (1)
  • D
    83% (35)

Why each option

Sharing a single public IP address for inbound connections (Destination NAT) to multiple distinct internal servers is generally not possible without port translation or an application proxy.

AMove the NAT rule 6 DMZ server 2 above NAT rule 5 DMZ server 1.

The order of NAT rules primarily affects outbound Source NAT matching, and would not resolve the fundamental ambiguity of inbound Destination NAT to multiple internal servers sharing a public IP.

BReplace the two NAT rules with a single rule that has both DMZ servers as "Source Address"

Combining Source NAT rules would manage outbound traffic but does not address the inbound connectivity problem of distinguishing between two internal servers behind a single public IP for incoming connections.

CConfigure separate source NAT and destination NAT rules for the two DMZ servers without using

Configuring separate Source NAT and Destination NAT rules is standard, but it doesn't overcome the inherent limitation of directing inbound traffic on the same port of a single public IP to two different internal servers without additional port translation or a Layer 7 proxy.

DSharing a single NAT IP is possible for outbound connectivity not for inbound therefore a newCorrect

While a single public IP can be shared for outbound connectivity using Port Address Translation (PAT), traditional firewall Destination NAT requires a unique public IP:Port combination to map to a specific internal server; therefore, a new public IP is needed for concurrent inbound access to both DMZ servers on the same service.

Concept tested: NAT limitations for shared public IPs

Source: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/nat/nat-concepts/how-nat-works

Topics

#NAT#Destination NAT#Source NAT#Shared IP

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PCNSE Practice