Examkin

Question

Difficulty: HardNAT and PAT Implementation

Company A acquires Company B, and a network engineer is tasked with establishing bidirectional host-to-host connectivity across a site-to-site IPsec VPN. During initial discovery, the engineer identifies that both organizations independently use the exact same private IPv4 addressing space (192.168.10.0/24192.168.10.0/24) for their core server subnets. Neither organization can re-address its servers due to legacy application dependencies. Which Network Address Translation (NAT) implementation strategy should the engineer deploy on the network gateways to resolve this IP address conflict?

  1. Configure Twice NAT (overlapping NAT) on the gateway routers to perform simultaneous source and destination IP address translation for traffic crossing the VPN tunnel.Answer
  2. B
    Deploy standard Port Address Translation (PAT / NAT Overload) using the WAN gateway IP to dynamically multiplex destination addresses across Layer 4 port numbers.
  3. C
    Implement Static NAT to map internal server IP addresses to external public IP addresses while keeping transport layer port numbers unmodified at Layer 2.
  4. D
    Reconfigure port forwarding rules on the edge firewalls to map standard service ports (such as port 80 and port 443) between the two overlapping subnets.

Answer

Twice NAT (overlapping NAT) should be configured on the gateway routers to translate both source and destination IP addresses across the VPN tunnel.
Twice NAT (also known as overlapping NAT) is specifically designed for scenarios where two connecting networks use overlapping IP address spaces. It rewrites both the source IP address and the destination IP address in the packet header as traffic traverses the router or firewall interface, mapping virtual dummy subnets to actual private addresses so traffic can be routed cleanly across an IPsec tunnel.

Step-by-Step Solution

1
Analyze the network conflict scenario
Identified that both networks use identical IPv4 subnets (192.168.10.0/24192.168.10.0/24), causing routing ambiguity where local routers cannot distinguish local hosts from remote hosts.
When source and destination IP addresses belong to the same IP subnet, standard Layer 3 routing sends packets locally rather than forwarding them across a VPN tunnel.
2
Evaluate standard NAT and PAT limitations
Standard NAT/PAT translates only one address (typically the source IP for outbound traffic or destination IP for inbound port forwarding).
Translating only the source IP leaves the destination IP unchanged as 192.168.10.x192.168.10.x, which prevents proper routing over the site-to-site VPN.
3
Determine the required NAT technique for overlapping subnets
Select Twice NAT (Bidirectional/Overlapping NAT).
Twice NAT rewrites both the source address to a non-conflicting virtual pool address and the destination address from a dummy alias subnet to the actual destination address, enabling two-way routing between identical IP subnets.

Key Concept

Twice NAT / Overlapping NAT Implementation
Estimated Time:2m 0s
Rate this question

Topics

NAT and PAT Implementation

More questions from this topic