Free Preparation Discussions
MENU
Palo Alto Networks Exam PCNSE Topic 9 Question 97 Discussion
Topic #: 9
A new application server 192.168.197.40 has been deployed in the DMZ. There are no public IP addresses available resulting in the server sharing MAT IP 198 51 100 B8 with another OMZ serve that uses IP address 192 168 19? 60 Firewall security and NAT rules have been configured The application team has confirmed mat the new server is able to establish a secure connection to an external database with IP address 203.0.113.40. The database team reports that they are unable to establish a secure connection to 196 51 100 88 from 203.0.113.40 However it confirm a successful prig test to 198 51 100 88 Referring to the MAT configuration and traffic logs provided how can the firewall engineer resolve the situation and ensure inbound and outbound connections work concurrently for both DMZ servers?
The table displays NAT rules configured on the firewall. The key points are:
Source Zone and Destination Zone define the traffic flow.
Source Address and Destination Address specify the IP addresses involved.
Service indicates the type of traffic (e.g., any, ping).
Source Translation and Destination Translation show the translated IP addresses for NAT.
Issue and Resolution Options
The application server at 192.168.197.40 can establish outbound connections but faces issues with inbound connections due to the shared NAT IP 198.51.100.88. The external database server cannot establish a secure connection back to 192.168.197.40.
Options to Resolve the Issue:
Replace the Two NAT Rules with a Single Rule:
Combining both DMZ servers into one NAT rule might simplify configuration but could cause issues in distinguishing inbound traffic for each server.
Pros: Simplifies rule management.
Cons: Might not address the inbound traffic issue properly.
New Public IP Address:
Obtaining a new public IP address for the new server (192.168.197.40) ensures dedicated inbound and outbound NAT.
Pros: Clear separation of traffic, resolves inbound connectivity issues.
Cons: Requires additional public IP.
Separate Source NAT and Destination NAT Rules:
Configuring distinct NAT rules for source and destination addresses without using the bidirectional option.
Pros: Clear and distinct rules for each direction of traffic.
Cons: More complex to manage, might require more firewall resources.
Move the NAT Rule:
Adjusting the order of NAT rules to prioritize the new server's rule.
Pros: Simple reordering might resolve prioritization conflicts.
Cons: Might not fully resolve the inbound connection issue.
Nell
2 months agoFreida
2 months agoDelbert
1 months agoToi
1 months agoKaitlyn
2 months agoHyun
2 months agoBeckie
2 months agoDenise
2 months agoKyoko
3 months agoGladys
1 months agoIsaac
2 months agoEun
2 months agoRuthann
3 months agoJestine
1 months agoNatalya
2 months agoColby
2 months agoDesire
2 months agoHillary
3 months agoSilva
2 months agoSheron
2 months ago