Module 7 NAT Policies

Question 1

What are the two NAT types?

Answer 1

Source and Destination NAT.

Question 2

What is Source NAT?

Answer 2

Private (internal) users to access the public internet.

Question 3

What is Destination NAT?

Answer 3

Hosts on public external network, access to private, internal servers.

Question 4

Is NAT directional?

Answer 4

Yes, the forms are directional are are described from the perspective of the NAT device.

Question 5

What is source NAT

Answer 5

NAT to translate outbound traffic, private network to the internet

Question 6

Are private and extranet in the same NAT zone?

Answer 6

Yes, both exist within the private network.

Question 7

What is the difference between static, dynamic and dynamic IP and port( DIPP)

Answer 7

Static is 1 to 1 translation, source port unchanged. Dynamic no port number, 1 to 1 translation to next available address in the range. DIPP allows multiple clients same IP with diff source port.

Question 8

For NAT, what can you specify besides an IP address to be translated?

Answer 8

IP address, a range of IP addresses, a subnet, or a combination.

Question 9

What if the egress interface has a dynamically assigned IP address, always changes?

Answer 9

You can specify the interface in the DIPP rule - this ensures NAT policy updates automatically

Question 10

What is the flow logic with NAT?

Answer 10

Security policy rule enforced after NAT policy rule is evaluated, but before NAT translation is applied.

Question 11

What is the first thing to do when configuring NAT

Answer 11

Create a NAT policy rule

Question 12

What is important to remember when creating a NAT policy rule

Answer 12

Use the fields in the Original Packet tab to define the match criteria, pre-nat IP’s, zones, etc.

Question 13

How does a NAT policy rule match packets?

Answer 13

A NAT policy rule matches the packet based on the original pre-NAT source and destin address and pre-NAT dest zone.

Question 14

What are the problems with dynamic NAT?

Answer 14

Translated pool can be exhausted if the number of internal hosts concurrently creation outbound sessions exceeds the number of IP addresses in the pool.

Question 15

What can help with Dynamic IP NAT exhaustion

Answer 15

Setting Advanced (Dynamic IP/Port Failback) button - uses DIPP if dynamic IP pool runs out.

Question 16

When would DIPP be used?

Answer 16

One or more public IP address from the ISP and not enough public IPs to allocate one address to each internal host.

Question 17

What is DIPP Oversubscription?

Answer 17

Allows the reuse of port number’s by using destination IP addresses as an additional NAT session identifier. Same source port, but we are using the destination address as another session identifier.

Question 18

When would you use Destination NAT?

Answer 18

Destination NAT is used when you as a user want to reach a private server inside the network.

Question 19

What are diff and similarities between source and destination static NAT?

Answer 19

1 to 1 fixed translations, changes dest IP address for destination NAT. Also leaves destination port unchanged, whereas static leaves source port unchanged.

Question 20

What must be added when configuring a Security Policy Rule post NAT rule?

Answer 20

Source, Destination, Application and Action

Question 21

Explain flow logic again?

Answer 21

NAT policy evaluated, Security Policy and then NAT translation occurs

Question 22

How does Dynamic IP address work for destination NAT?

Answer 22

Translate add can be a FQDN, add object, or an address group that uses a FQDN. DHCP server assigns a new add to the host, you will not have to update the FQDN.

Question 23

What should you do when you create a NAT policy rule?

Answer 23

Use the original packet characteristics -

Question 24

Creating NAT policy

Answer 24

Use pre-NAT zones!

Question 25

What are the two destination NAT types?

Answer 25

Port forwarding and Static IP

Question 26

What is destination NAT port forwarding

Answer 26

Destination port numbers - you have multiple servers, email, web-hosting, etc. All servers are configured with the server-trust appear to have the same IP but diff port numbers.

Question 27

What is bi-directional source NAT?

Answer 27

Only available with static NAT, your public facing servers must be able to send and receive packets.