Examkin

Question

Difficulty: HardNAT and PAT Implementation

A network administrator configures a static 1:1 NAT mapping on an enterprise edge router for an internal application server with Inside Local address 192.168.10.50192.168.10.50 to Inside Global address 198.51.100.50198.51.100.50. Additionally, a dynamic Port Address Translation (PAT / Overload) rule is configured to translate all host traffic from 192.168.10.0/24192.168.10.0/24 to the router's public interface address (198.51.100.1198.51.100.1). Remote clients on the internet can successfully initiate connections to the application server using 198.51.100.50198.51.100.50. However, when the internal application server itself initiates outbound requests to a partner API service that enforces IP whitelist security, the partner API rejects the connection. Network captures reveal that outbound packets originating from the server are sent using source IP 198.51.100.1198.51.100.1 with an ephemeral port rather than 198.51.100.50198.51.100.50. Which of the following best explains why this issue occurs?

  1. The router evaluates the dynamic PAT rule prior to the static NAT mapping in its translation table for outbound connections.Answer
  2. B
    Static NAT mappings only perform address translation for inbound sessions and automatically defer outbound traffic processing to PAT.
  3. C
    PAT operates at Layer 2 to rewrite frame source addresses, which overrides Layer 3 static IP address translation definitions for outbound traffic.
  4. D
    Outbound traffic targeting standard web service ports (such as 80 or 443) bypasses static NAT configurations and defaults to port overloading.

Answer

The router evaluates the dynamic PAT rule prior to the static NAT mapping in its translation table for outbound connections.
In router and firewall configurations, NAT rules are processed in a defined order of execution. When an internal server with a static NAT mapping initiates an outbound session, the router checks the source IP against its NAT entries. If a generic PAT/Overload rule matching the server's subnet is evaluated before the static NAT mapping, outbound packets are dynamically translated to the PAT address (198.51.100.1198.51.100.1) with a randomized ephemeral port. Inbound traffic addressed directly to 198.51.100.50198.51.100.50 still succeeds because inbound static NAT entries take direct precedence for incoming destination translation.

Step-by-Step Solution

1
Analyze the bidirectional nature of Static NAT versus dynamic PAT.
Static 1:1 NAT provides bidirectional translation between 192.168.10.50192.168.10.50 (Inside Local) and 198.51.100.50198.51.100.50 (Inside Global). PAT translates multiple internal IPs to a shared public IP using unique Layer 4 port numbers.
Understanding host reachability in both directions helps isolate why inbound connectivity works while outbound traffic gets remapped.
2
Trace the packet flow for outbound traffic originating from 192.168.10.50192.168.10.50.
Outbound packets from the server match the source network 192.168.10.0/24192.168.10.0/24.
When the server initiates a connection outbound, the router checks its NAT rule lookup order to determine how to translate the source IP address.
3
Determine the cause of the unexpected translation address (198.51.100.1198.51.100.1).
The router encounters and executes the dynamic PAT overload rule before evaluating the static NAT entry, resulting in translation to the outside interface IP.
If the rule evaluation order or access control list priority favours the PAT statement for outbound flows, the static 1:1 translation for outbound traffic is bypassed.

Key Concept

NAT/PAT Rule Processing Order and Bidirectional Static NAT Behavior
Estimated Time:2m 0s
Rate this question

Topics

NAT and PAT Implementation

More questions from this topic