JNCIA-SEC Network Address Translation — 20 Questions

Question 1

Which TWO statements are true regarding Junos NAT rule-sets? (Choose two)

Accepted Answer

Rule-sets define the security zones (from zone and to zone) where the NAT logic applies.. NAT rule-sets group NAT rules and require source and destination security zones.

Answer

Rule-sets are limited to exactly one rule per zone.

Answer

Rule-sets can only be configured under the routing-options hierarchy.

Question 2

You have configured Destination NAT on a SRX Series device to forward web traffic to an internal server. External clients attempt to connect, but the security logs show sessions are being dropped by the security policy. Which security zone and IP address combination must the security policy permit?

Accepted Answer

From the untrusted zone to the trusted zone, using the internal private IP address of the server.. Junos OS security policies for Destination NAT evaluate traffic based on the *post-translation* destination IP address (the internal server's private IP) and the zone where the internal server resides.

Answer

From the untrusted zone to the untrusted zone, using the public destination IP address.

Answer

From the untrusted zone to the trusted zone, using the pre-translation public IP address.

Answer

From the trusted zone to the untrusted zone, using the public destination IP address.

Question 3

You manage an SRX device where multiple internal subnets require Source NAT out to the internet using a shared pool of public IP addresses. However, specific internal servers must always map to a dedicated, unique public IP address to maintain whitelisting on external partner firewalls. How should you configure this requirement?

Accepted Answer

Configure a specific source NAT rule matching the server's IP address placed above the general rule in the rule-set evaluation order.. To ensure specific hosts map to a dedicated public IP while general traffic uses a pool, you can create a specific Source NAT rule with a higher match priority (higher in rule order) specifying the server's IP, translating to a dedicated pool or address, followed by a general rule for all other traffic.

Answer

Use interface-based NAT for the servers and pool-based NAT for the remaining internal subnets.

Answer

Configure Static NAT for the entire subnet and override individual host entries using Source NAT pools.

Answer

Enable persistent-nat on the general source NAT pool and bind the server's MAC address to the public IP.

Question 4

An administrator is troubleshooting a NAT issue on an SRX Series device and wants to view active NAT sessions to verify whether source translation is happening. Which operational command should be used?

Accepted Answer

show security flow session. To view active sessions including NAT translations, the command 'show security flow session' is used, often filtered with 'match' parameters.

Answer

show security nat translation summary

Answer

show system nat active-translations

Answer

show route forwarding-table destination nat

Question 5

When configuring NAT rule sets on a Junos OS device, in what order are different types of NAT evaluated?

Accepted Answer

Destination NAT is evaluated first, followed by Source NAT, and then Static NAT.. Junos OS evaluates NAT rule sets in a specific order: Destination NAT is evaluated first, followed by Source NAT, and finally Static NAT.

Answer

All NAT types are evaluated simultaneously using parallel hardware lookups.

Answer

Source NAT is evaluated first, followed by Destination NAT, and then Static NAT.

Answer

Static NAT is evaluated first, followed by Destination NAT, and then Source NAT.

Question 6

An administrator needs to configure Destination NAT to map incoming traffic destined for a public IP address (203.0.113.50) on port 443 to an internal web server at private IP address (192.168.1.100) on port 8443. Which configuration hierarchy is used to define the pool for this destination NAT mapping?

Accepted Answer

set security nat destination pool web-pool address 192.168.1.100 port 8443. Destination NAT pools are defined under the 'set security nat destination pool address port ' hierarchy in Junos OS.

Answer

set security nat destination rule-set rs1 rule r1 then translation pool web-pool

Answer

set security nat source pool web-pool address 192.168.1.100 port 8443

Answer

set security nat static rule-set static-rs rule r1 then destination-nat pool web-pool

Question 7

A network engineer implements pool-based Source NAT with Port Address Translation (PAT) on a Junos OS device using a pool containing a single public IP address. After deployment, users in the trust zone experience intermittent failures when opening numerous concurrent browser tabs to various internet sites. 'show security flow session' reveals many sessions in a closing state. What is the root cause?

Accepted Answer

Port exhaustion has occurred because all available source ports for the single translation IP are in use.. Port exhaustion occurs when a single IP address runs out of available source ports (totaling 65,535, though ephemeral ports are usually a subset like 1024-65535). Heavy concurrent browser usage quickly exhausts these ports.

Answer

The security policy action is set to permit instead of translating, causing port reuse collisions.

Answer

The source NAT pool lacks the 'port-overloading' statement, causing the device to drop excess traffic.

Answer

Junos OS requires an explicit maximum-sessions limit per pool address to prevent CPU overload.

Question 8

An administrator deploys Static NAT on a Junos OS device to provide a one-to-one mapping between a public IP address (198.51.100.10) and an internal server IP address (10.1.1.10). When external clients attempt to ping the public IP address, the SRX does not respond. Other services work correctly. What must be configured to allow the SRX to respond to ICMP requests for the Static NAT IP?

Accepted Answer

Configure Proxy ARP on the external egress interface for the static NAT public IP address.. Static NAT on Junos OS requires Proxy ARP to be enabled on the external interface so that the SRX answers ARP requests for the static NAT public IP address originating from the upstream router.

Answer

Configure a Source NAT rule matching the ICMP traffic from the internal server.

Answer

Add an explicit static route for the internal server pointing to the Null0 interface.

Answer

Enable ICMP inspection within the security ALG configuration under security algorithms.

Question 9

An administrator configures interface-based Source NAT on the outgoing external interface of a SRX Series device. However, internal hosts report being unable to reach external web servers. Upon checking the security flow session, the administrator notices that packets are egressing the interface with the actual internal private IP address rather than the interface IP. What is the most likely cause?

Accepted Answer

The source NAT rule is missing the 'then source-nat interface' action statement.. Interface-based Source NAT requires the configuration under the security nat source rule-set to reference the correct 'from zone' and 'to zone', and the rule must contain 'then source-nat interface'. If the rule is missing or not applied to the traffic flow direction, translation will not occur.

Answer

The security policy is evaluating the post-translation source IP instead of the pre-translation IP.

Answer

Proxy ARP must be manually enabled on the internal interface for interface-based NAT to function.

Answer

Interface-based Source NAT requires an explicit routing instance to bypass the master routing table.

Question 10

An administrator configures Destination NAT so that traffic arriving on the external interface destined for IP 198.51.100.25 is translated to 10.0.0.5. After applying the configuration, internal hosts on the trust zone attempt to access 198.51.100.25 and fail. What feature is required to allow internal hosts to access a server hosted inside their own network via its public IP address?

Accepted Answer

Configure source NAT for traffic originating from the internal zone destined back to the internal zone (Hairpin NAT).. Accessing a local server via its public IP address from the internal network requires 'twice NAT' or configuring source NAT alongside destination NAT (often referred to as DNS re-writing or hairpin/NAT loopback configuration) so the server replies back to the SRX rather than directly to the internal client.

Answer

Change the destination NAT rule to evaluate source zones as 'any' instead of 'untrust'.

Answer

Enable proxy ARP on the internal interface for the public destination IP address.

Answer

Configure a static route on the internal hosts pointing directly to the internal server IP.

Question 11

You are troubleshooting a complex Static NAT setup where an internal mail server (10.10.10.5) is mapped to a public IP (198.51.100.5). External inbound connections work, but outbound connections initiated from the mail server show that the source IP is being translated by a general interface-based Source NAT rule rather than the Static NAT mapping. How do you ensure outbound connections from the mail server use its Static NAT public IP?

Accepted Answer

Ensure that conflicting Source NAT rules are placed lower in evaluation order or exclude the mail server IP from the Source NAT rule-set match criteria.. In Junos OS, static NAT automatically provides bidirectional translation (both inbound destination and outbound source translation). However, if a more specific Source NAT rule matches the traffic first (due to rule ordering or overlapping source rules), the Source NAT rule takes precedence over the implicit static NAT source translation. The administrator must adjust rule ordering or ensure source NAT rules do not override the static NAT host.

Answer

Explicitly configure a Source NAT rule that maps the mail server IP to its own public IP address.

Answer

Disable interface-based source NAT globally and migrate all internal subnets to pool-based NAT.

Answer

Change the static NAT rule to operate as a destination-only NAT pool.

Question 12

Which Junos configuration block is required to define a static NAT rule set mapping external IP addresses to internal servers?

Accepted Answer

set security nat static rule-set from zone . Static NAT rule sets are configured under 'set security nat static rule-set from zone ' hierarchy.

Answer

set security policies from-zone to-zone static-nat

Answer

set security nat destination rule-set from zone

Answer

set security nat source rule-set from zone

Question 13

An administrator has configured multiple rules within a single Source NAT rule-set. When traffic traverses the SRX device, how does Junos OS determine which specific rule within the rule-set is applied?

Accepted Answer

Rules are evaluated top-down; the first rule matching the packet's criteria is applied.. Rules within a Junos NAT rule-set are evaluated in top-down order (the order in which they were created or inserted). The first rule whose match criteria (source address, destination address, applications, etc.) match the packet is applied.

Answer

Rules are evaluated based on specificity; the most specific match is always applied regardless of configuration order.

Answer

Rules are evaluated using hashing algorithms to distribute translation loads evenly across rules.

Answer

All matching rules are combined, and translations are applied concurrently.

Question 14

You are troubleshooting a Destination NAT rule where traffic matching the rule is dropped. You run 'Traceoptions' for security flow and notice that the packet hits the destination NAT rule, translates successfully, but then fails. Examining the trace output reveals: 'No route found: 10.1.1.50 -> 0.0.0.0'. What is the underlying cause?

Accepted Answer

The routing table lacks a valid route to the post-translation internal IP address.. After Destination NAT translates the destination IP address to an internal private IP, the SRX performs a route lookup on the post-translation destination IP address to determine the egress interface and next hop. If no route exists for the translated IP, the packet is dropped.

Answer

Proxy ARP is not enabled on the internal server interface.

Answer

The security policy is missing the pre-translation public IP address in the destination field.

Answer

The destination NAT pool port translation is misaligned with the server listening port.

Question 15

Which Junos operational command allows an administrator to view translation statistics and hit counts for NAT rule sets?

Accepted Answer

show security nat rule-set. To check hit counts and statistics for NAT rule sets and rules, the command 'show security nat rule-set' is used.

Answer

show security flow statistics nat

Answer

show system services nat statistics

Answer

show nat summary counters

Question 16

Which configuration statement correctly defines a source NAT pool named 'corp-pool' with an address range from 203.0.113.10 to 203.0.113.20 on Junos OS?

Accepted Answer

set security nat source pool corp-pool address 203.0.113.10 to 203.0.113.20. Source NAT pools are configured under 'security nat source pool address ' using Junos CLI syntax.

Answer

set security nat source pool corp-pool address 203.0.113.10/32 to 203.0.113.20/32

Answer

set security nat source address-pool corp-pool range 203.0.113.10-203.0.113.20

Answer

set security nat source pool corp-pool address 203.0.113.10/28

Question 17

An administrator configures a Source NAT pool with multiple IP addresses. By default, how does Junos OS allocate port and IP addresses from this pool for new sessions?

Accepted Answer

Sequential or round-robin allocation across the pool addresses.. By default, Junos OS uses deterministic or round-robin / sequential address allocation from source NAT pools, pairing source IPs with available ports across the pool addresses.

Answer

Using only the first IP in the pool until port exhaustion occurs before utilizing subsequent IP addresses.

Answer

Hashing the internal source IP and port to bind it to a fixed pool IP (Persistent NAT).

Answer

Randomized IP selection for every new session regardless of source IP.

Question 18

You configure a Static NAT mapping for a server. External users report that they can connect to the server, but internal users on the trust zone trying to reach the server via the same static NAT public IP experience connection timeouts. You have already verified that interface routing is correct. What specific Junos feature can be enabled to solve this internal reachability issue without changing internal DNS records?

Accepted Answer

Configure a Source NAT rule for traffic originating from the internal zone destined to the internal zone matching the static NAT IP.. Enabling source NAT for local traffic (Hairpin NAT / NAT loopback) allows internal clients to connect to internal servers using public IPs by translating the internal source IP so the server replies through the SRX.

Answer

Configure a Static NAT rule with the 'off-path' option enabled.

Answer

Change the security policy action to 'permit' with 'nat source interface' embedded.

Answer

Enable 'proxy-arp' on the internal interface facing the trusted network hosts.

Question 19

An administrator configures a Source NAT pool and notices that multiple internal clients sharing the same public IP address are experiencing session disruptions with certain web applications that require consistent source ports. Which Junos feature should be enabled on the source NAT pool to ensure that a specific internal IP address always maps to the same translated public IP and port combination?

Accepted Answer

persistent-nat. Persistent NAT ensures that a given internal source IP and port always map to the same translated public IP and port for all outbound connections, which is required for certain stateful applications.

Answer

session-stable translation

Answer

source-nat deterministic-pat

Answer

port-mapping static

Question 20

Which command is used to clear active NAT sessions on an SRX Series device during troubleshooting?

Accepted Answer

clear security flow session. To clear active security sessions (which flushes active NAT state translations), the 'clear security flow session' command is utilized.

Answer

reset security nat sessions

Answer

clear route forwarding-table nat

Answer

clear security nat translation cache