PCNSE · Question #87
A network security engineer has a requirement to allow an external server to access an internal web server. The internal web server must also initiate connections with the external server. What can…
The correct answer is C. Create a new Source NAT Policy rule that matches the existing traffic and enable the Bi-. To simplify a NAT policy for both external access to an internal web server and for the internal server to initiate outbound connections, a Source NAT rule with a bi-directional option could theoretically consolidate the configuration.
Question
A network security engineer has a requirement to allow an external server to access an internal web server. The internal web server must also initiate connections with the external server. What can be done to simplify the NAT policy?
Options
- AConfigure ECMP to handle matching NAT traffic
- BConfigure a NAT Policy rule with Dynamic IP and Port
- CCreate a new Source NAT Policy rule that matches the existing traffic and enable the Bi-
- DCreate a new Destination NAT Policy rule that matches the existing traffic and enable the Bi-
How the community answered
(56 responses)- A9% (5)
- B4% (2)
- C70% (39)
- D18% (10)
Why each option
To simplify a NAT policy for both external access to an internal web server and for the internal server to initiate outbound connections, a Source NAT rule with a bi-directional option could theoretically consolidate the configuration.
ECMP (Equal-Cost Multi-Path) is a routing mechanism used for load balancing traffic across multiple paths, and it does not directly simplify NAT policy configuration.
Dynamic IP and Port is a specific type of Source NAT that translates multiple internal IP addresses to a single public IP address using different port numbers, which does not inherently simplify the bi-directional communication requirement.
Assuming the presence of a bi-directional option within a Source NAT rule, enabling it would simplify the NAT policy by consolidating the configuration for both the internal web server's outbound connections and the necessary inbound access from external servers into a single rule, streamlining two-way communication management.
While configuring a Destination NAT rule with a bi-directional option is the standard Palo Alto Networks method to simplify such a scenario, the provided correct answer indicates a Source NAT rule with a bi-directional capability as the desired approach for this question.
Concept tested: NAT policy simplification for bi-directional traffic
Topics
Community Discussion
No community discussion yet for this question.