Free Preparation Discussions
MENU
Palo Alto Networks Exam PCNSE Topic 9 Question 97 Discussion
Topic #: 9
A new application server 192.168.197.40 has been deployed in the DMZ. There are no public IP addresses available resulting in the server sharing MAT IP 198 51 100 B8 with another OMZ serve that uses IP address 192 168 19? 60 Firewall security and NAT rules have been configured The application team has confirmed mat the new server is able to establish a secure connection to an external database with IP address 203.0.113.40. The database team reports that they are unable to establish a secure connection to 196 51 100 88 from 203.0.113.40 However it confirm a successful prig test to 198 51 100 88 Referring to the MAT configuration and traffic logs provided how can the firewall engineer resolve the situation and ensure inbound and outbound connections work concurrently for both DMZ servers?
The table displays NAT rules configured on the firewall. The key points are:
Source Zone and Destination Zone define the traffic flow.
Source Address and Destination Address specify the IP addresses involved.
Service indicates the type of traffic (e.g., any, ping).
Source Translation and Destination Translation show the translated IP addresses for NAT.
Issue and Resolution Options
The application server at 192.168.197.40 can establish outbound connections but faces issues with inbound connections due to the shared NAT IP 198.51.100.88. The external database server cannot establish a secure connection back to 192.168.197.40.
Options to Resolve the Issue:
Replace the Two NAT Rules with a Single Rule:
Combining both DMZ servers into one NAT rule might simplify configuration but could cause issues in distinguishing inbound traffic for each server.
Pros: Simplifies rule management.
Cons: Might not address the inbound traffic issue properly.
New Public IP Address:
Obtaining a new public IP address for the new server (192.168.197.40) ensures dedicated inbound and outbound NAT.
Pros: Clear separation of traffic, resolves inbound connectivity issues.
Cons: Requires additional public IP.
Separate Source NAT and Destination NAT Rules:
Configuring distinct NAT rules for source and destination addresses without using the bidirectional option.
Pros: Clear and distinct rules for each direction of traffic.
Cons: More complex to manage, might require more firewall resources.
Move the NAT Rule:
Adjusting the order of NAT rules to prioritize the new server's rule.
Pros: Simple reordering might resolve prioritization conflicts.
Cons: Might not fully resolve the inbound connection issue.
Nell
23 days agoFreida
26 days agoDelbert
3 days agoToi
6 days agoKaitlyn
12 days agoHyun
29 days agoBeckie
30 days agoDenise
1 months agoKyoko
1 months agoGladys
7 days agoIsaac
13 days agoEun
23 days agoRuthann
2 months agoJestine
7 days agoNatalya
12 days agoColby
22 days agoDesire
1 months agoHillary
2 months agoSilva
28 days agoSheron
1 months ago