Examkin

Question

Difficulty: Very hardNAT and PAT Implementation

A network engineer is troubleshooting an outbound connectivity issue at a branch office where 500 workstations on the 10.50.0.0/2210.50.0.0/22 internal network access external services through a router configured with Port Address Translation (PAT) on a single public IP address (198.51.100.1198.51.100.1). Users report that while standard web traffic functions without issue, a legacy proprietary monitoring application that transmits raw IP packets (using custom IP protocol 99 without TCP/UDP transport headers or unique layer-4 session identifiers) allows only one internal host at a time to communicate with a remote server. Which of the following best explains why PAT fails to multiplex multiple simultaneous connections for this application?

  1. PAT relies on Layer 4 transport headers or protocol-specific multiplexing identifiers to track distinct flows over a single public IP address, which raw IP protocol 99 traffic lacks.Answer
  2. B
    The router must be configured with Static NAT for the entire 10.50.0.0/2210.50.0.0/22 subnet so that all internal workstations can map to the single public IP address simultaneously without port translation.
  3. C
    PAT restricts outbound traffic to standard well-known destination ports below 1024, causing packets with unassigned protocol numbers to be discarded at Layer 3.
  4. D
    PAT translates Layer 2 MAC addresses within the Ethernet frame header, which prevents non-TCP payload frames from being reassembled at the default gateway.

Answer

PAT relies on Layer 4 transport headers or protocol-specific multiplexing identifiers to track distinct flows over a single public IP address, which raw IP protocol 99 traffic lacks.
Port Address Translation (PAT) requires Layer 4 information—specifically TCP or UDP port numbers—to track and differentiate multiple internal hosts sharing a single public IP address. Protocols that run directly over IP without TCP/UDP transport headers or built-in session identifiers (such as ICMP Query IDs) cannot be multiplexed by PAT across multiple internal hosts targeting the same external destination server.

Step-by-Step Solution

1
Analyze how Port Address Translation (PAT / NAT Overload) disambiguates connections.
PAT maps multiple private 10.50.0.0/2210.50.0.0/22 addresses to a single public IP address 198.51.100.1198.51.100.1 by assigning unique Layer 4 source port numbers (TCP/UDP) to each outbound flow.
Tracking transport layer source ports allows the router to route incoming return packets back to the exact internal host IP and internal port.
2
Evaluate the traffic characteristics of the legacy proprietary application.
The application sends raw IP packets using IP protocol number 99, bypassing Layer 4 TCP and UDP headers entirely.
Without TCP/UDP source/destination port fields or protocol-specific identification fields (such as ICMP Identifier fields), PAT has no Layer 4 data to modify or track in its state table.
3
Determine why only a single session functions at a time.
The translation table can only map the IP protocol 99 tuple (Inside Local IP →\rightarrow Outside Global IP) once without port fields.
Subsequent internal hosts attempting to send IP protocol 99 traffic to the same destination remote server collide with the existing translation entry because the router cannot differentiate the flows.

Key Concept

PAT Layer 4 Multiplexing Requirements and Transport Protocol Translation Limits
Estimated Time:2m 0s
Rate this question

Topics

NAT and PAT Implementation

More questions from this topic