Examkin

Question

Difficulty: HardNAT and PAT Implementation

An enterprise firewall is configured with Port Address Translation (PAT / NAT Overload) using a single public IP address (203.0.113.50203.0.113.50) to provide outbound Internet connectivity for 350 internal hosts on the 10.100.0.0/2210.100.0.0/22 subnet. The enterprise also needs external clients to access an internal HTTPS web server at 10.100.0.2510.100.0.25, and needs an internal IPsec VPN gateway at 10.100.0.1010.100.0.10 to establish native ESP (IP protocol 50) tunnels with external business partners. Which of the following statements regarding this address translation implementation are correct? (Select TWO)

  1. A 1:1 Static NAT mapping or dedicated public IP is required for the internal IPsec gateway because standard PAT relies on Layer 4 TCP/UDP port numbers, which are not present in raw ESP (IP protocol 50) traffic.Answer
  2. B
    PAT automatically multiplexes raw IP protocol 50 (ESP) traffic across internal hosts by translating Layer 2 MAC addresses during the translation process.
  3. Static Port Forwarding (Destination PAT) can be configured to map incoming TCP port 443 requests on 203.0.113.50203.0.113.50 directly to the internal web server at 10.100.0.25:44310.100.0.25:443.Answer
  4. D
    Static NAT must be implemented for all 350 internal workstations because PAT cannot support more than 254 concurrent outbound host sessions using a single public IP address.

Answer

A 1:1 Static NAT mapping or dedicated public IP is required for the internal IPsec gateway because standard PAT relies on Layer 4 TCP/UDP port numbers, which are missing in raw ESP (IP protocol 50) traffic; AND Static Port Forwarding can map incoming TCP port 443 traffic on the public IP to the internal web server.
The first correct statement accurately notes that standard Port Address Translation (PAT) requires Layer 4 TCP or UDP port headers to multiplex connections. Native IPsec ESP (IP protocol 50) lacks TCP/UDP port headers, requiring a 1:1 Static NAT mapping (or NAT Traversal). The second correct statement properly identifies Static Port Forwarding as the mechanism to route incoming public TCP port 443 traffic to the internal private web server.

Step-by-Step Solution

1
Analyze outbound PAT capabilities and limitations for non-TCP/UDP protocols
Standard PAT (NAT Overload) inspects Layer 4 TCP/UDP ports to differentiate connections sharing a single public IP address. Raw ESP (IP protocol 50) operates at Layer 3 without Layer 4 port headers, making standard PAT unable to multiplex it without 1:1 Static NAT or NAT-T (UDP 4500 encapsulation).
Identify protocol transport requirements for IPsec ESP.
2
Evaluate inbound reachability for the internal HTTPS web server
Inbound TCP port 443 traffic destined for the public IP address can be statically mapped using Destination PAT (Port Forwarding) to the internal private IP address 10.100.0.25:44310.100.0.25:443.
Determine how to expose an internal service to external clients while using a single public IP.
3
Evaluate and eliminate incorrect statements
Statements claiming PAT operates at Layer 2 MAC level or limiting PAT host capacity to 254 hosts are technically false.
PAT operates at Layer 3/4 and supports ~65,000 concurrent source sockets per public IP.

Key Concept

Port Address Translation (PAT) vs Static NAT and Port Forwarding limitations
Estimated Time:2m 0s
Rate this question

Topics

NAT and PAT Implementation

More questions from this topic