Exam PCNSE topic 1 question 542 discussion

Actual exam question from Palo Alto Networks's PCNSE

Question #: 542
Topic #: 1

Review the information below. A firewall engineer creates a U-NAT rule to allow users in the trust zone access to a server in the same zone by using an external, public NAT IP for that server.

Given the rule below, what change should be made to make sure the NAT works as expected?

A. Change destination NAT zone to Trust_L3.
B. Change destination translation to Dynamic IP (with session distribution) using firewall eth1/2 address.
C. Change Source NAT zone to Untrust_L3.
D. Add source Translation to translate original source IP to the firewall eth1/2 interface translation.

Show Suggested Answer

Suggested Answer: D 🗳️

by mercysayno765 at June 12, 2023, 1:57 p.m.

Comments

Submit Cancel

Pochex

Highly Voted 1 year, 7 months ago

D is correct, review the example of the U-turn NAT for Hosts and Web Servers in the Same Zone, refer to https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEiCAK

upvoted 6 times

...

NullNull88

Most Recent 5 months ago

Selected Answer: D

This whole setup is absolute bonkers but OK,. They're on the same subnet,..

upvoted 1 times

...

Marshpillowz

11 months, 3 weeks ago

Selected Answer: D

D is correct

upvoted 1 times

...

Andromeda1800

1 year, 1 month ago

Selected Answer: D

U-NAT for the same zone requires source address translation as well.

upvoted 4 times

Andromeda1800

1 year, 1 month ago

To expand my vote, if there wouldn't be source address translation we'd have two issues... 1. reply from server would be directly to the client and not through the firewall which is asymmetry 2. Client would reject server's response since source address of the response would be web server's private ip address and not the public address. Clients usually reject responses from source address which were not destination address in their request.

upvoted 4 times

...