Examkin

Question

Difficulty: Very hardNAT and PAT Implementation

An enterprise network engineer is troubleshooting an issue where hosts on a private subnet (10.10.0.0/2410.10.0.0/24) experience intermittent outbound connection failures when accessing external cloud resources. The perimeter firewall is configured to perform Port Address Translation (PAT) using a single public IP address (203.0.113.5203.0.113.5). Diagnostic logs indicate that while active web sessions function normally, new outbound TCP connections fail during peak traffic periods because all available high-numbered ephemeral source ports on the gateway's public address are fully allocated. Which configuration change should the engineer implement on the firewall to resolve this session scaling issue while preserving private internal IP addressing?

  1. Configure a PAT address pool containing multiple public IP addresses to expand the available Layer 4 source port capacity.Answer
  2. B
    Reconfigure the firewall translation rules to use 1:1 Static NAT for all internal hosts using the single public IP address.
  3. C
    Map outbound UDP transport traffic directly to TCP destination port 80 within the active translation table.
  4. D
    Enable Layer 2 MAC address translation on the external gateway interface to bypass Layer 3 IP mapping boundaries.

Answer

Configure a PAT address pool containing multiple public IP addresses to expand the available Layer 4 source port capacity.
Port Address Translation (PAT) enables multiple private IP addresses to share public IP space by overloading unique Layer 4 source port numbers. When high connection volume exhausts all available ephemeral ports on a single public IP address, introducing a pool of public IP addresses allows PAT to dynamically distribute outbound sessions across multiple public IPs, successfully multiplying session capacity.

Step-by-Step Solution

1
Analyze the diagnostic log output to identify the root cause of connection failures.
The firewall is experiencing PAT port exhaustion (all ~64,512 high-numbered ephemeral source ports on public IP 203.0.113.5 are in use).
PAT tracks concurrent sessions by pairing private sockets (IP + source port) with public sockets (Public IP + assigned public source port).
2
Select a translation design strategy that expands translation capacity while maintaining private internal IP addressing.
Configuring an IP address pool for PAT allows the NAT device to allocate source ports across multiple public IP addresses (overload pool).
Each additional public IP added to the PAT pool increases total concurrent connection capacity by approximately 65,000 port mappings.

Key Concept

PAT Port Exhaustion & IP Pool Expansion
Rate this question

Topics

NAT and PAT Implementation

More questions from this topic