Examkin

Question

Difficulty: Very hardNAT and PAT Implementation

An enterprise branch office has 500 internal workstations configured on a private IPv4 network (10.1.0.0/2210.1.0.0/22). Outbound internet access is currently handled by an edge router using Port Address Translation (PAT / NAT Overload) mapped to a single public IP address (203.0.113.5203.0.113.5). During peak operational hours, users report that while existing web sessions remain active, new outbound connection attempts to cloud services begin timing out consistently. A network administrator inspects the router's active translation table and discovers over 64,00064,000 active translation entries associated with 203.0.113.5203.0.113.5, while CPU, memory, and interface bandwidth utilization on the edge router remain below 25%25\%. Which of the following implementation changes is the most appropriate solution to resolve the connection failures?

  1. Configure a dynamic NAT pool containing multiple public IP addresses and bind PAT to the pool.Answer
  2. B
    Reconfigure the edge router to use Dynamic NAT without overload using the single public IP address.
  3. C
    Modify the outbound security policy to translate Layer 3 IPv4 packets into Layer 2 Ethernet frames at the egress port.
  4. D
    Reassign outbound HTTPS traffic from TCP port 443 to UDP port 443 across the edge router interfaces.

Answer

The correct action is to configure a dynamic NAT pool containing multiple public IP addresses and bind PAT to the pool.
Port Address Translation (PAT) uses 16-bit source port numbers to multiplex multiple private IP streams over a single public IP address. Because a 16-bit port field yields a maximum of 65,535 ports, a high-density subnet can exhaust the ephemeral port pool of a single public IP address. Configuring a NAT pool of public IP addresses and applying PAT across the pool multiplies the available transport port pool by the number of IP addresses in the pool, resolving exhaustion without sacrificing simultaneous connectivity for internal hosts.

Step-by-Step Solution

1
Analyze the symptom and diagnostic evidence.
Router hardware resources (CPU, RAM, bandwidth) are normal (<25%), but active NAT translation entries have reached over 64,000 on a single public IP address.
PAT tracks outbound connections by mapping private IP addresses and source port numbers to a single public IP address and unique external source ports. Since TCP/UDP port fields are 16-bit, the maximum theoretical port count per IP is 65,535 (with around 1,024 reserved/well-known ports, leaving ~64,500 usable ephemeral ports).
2
Identify the underlying bottleneck.
The network is suffering from PAT transport layer source port exhaustion.
Because 500 hosts are generating thousands of concurrent short-lived or long-lived sessions, the single public IP address has exhausted its available unique source port pool.
3
Evaluate candidate solutions to increase socket capacity.
Binding PAT to a pool of public IP addresses increases capacity linearly (e.g., 5 public IPs × ~64,000 ports = ~320,000 available concurrent translations).
Adding additional public IPs into a NAT pool tied to PAT overload expands the total available source port space while allowing all 500 internal hosts to maintain simultaneous outbound connectivity.

Key Concept

PAT Source Port Exhaustion and NAT Pool Scaling
Estimated Time:2m 0s
Rate this question

Topics

NAT and PAT Implementation

More questions from this topic