JNCIA-SEC Network Address Translation — 40 Questions

Question 1

You have configured Destination NAT on a SRX Series device to forward web traffic to an internal server. External clients attempt to connect, but the security logs show sessions are being dropped by the security policy. Which security zone and IP address combination must the security policy permit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

From the untrusted zone to the trusted zone, using the internal private IP address of the server.. On SRX Series devices, security policies are evaluated after destination NAT translation for the destination address and zone. Therefore, the policy must reference the translated (internal) destination IP address and the zone where the internal server resides (trusted zone). The source zone remains untrusted because the client originates from the untrusted zone.

Answer

From the untrusted zone to the untrusted zone, using the public destination IP address.

Answer

From the untrusted zone to the trusted zone, using the pre-translation public IP address.

Answer

From the trusted zone to the untrusted zone, using the public destination IP address.

Question 2

You manage an SRX device where multiple internal subnets require Source NAT out to the internet using a shared pool of public IP addresses. However, specific internal servers must always map to a dedicated, unique public IP address to maintain whitelisting on external partner firewalls. How should you configure this requirement?

Accepted Answer

Configure a specific source NAT rule matching the server's IP address placed above the general rule in the rule-set evaluation order.. To ensure specific internal servers always use a dedicated public IP while other subnets share a pool, you must create a specific source NAT rule for the server's IP and place it above the general pool-based rule in the same rule-set. Junos evaluates rules top-down, so the specific rule will match first and apply the dedicated translation.

Answer

Use interface-based NAT for the servers and pool-based NAT for the remaining internal subnets.

Answer

Configure Static NAT for the entire subnet and override individual host entries using Source NAT pools.

Answer

Enable persistent-nat on the general source NAT pool and bind the server's MAC address to the public IP.

Question 3

When configuring NAT rule sets on a Junos OS device, in what order are different types of NAT evaluated?

Accepted Answer

Destination NAT is evaluated first, followed by Source NAT, and then Static NAT.. Junos OS evaluates NAT rule sets in a specific order: Destination NAT is evaluated first, followed by Source NAT, and finally Static NAT.

Answer

All NAT types are evaluated simultaneously using parallel hardware lookups.

Answer

Source NAT is evaluated first, followed by Destination NAT, and then Static NAT.

Answer

Static NAT is evaluated first, followed by Destination NAT, and then Source NAT.

Question 4

An administrator deploys Static NAT on a Junos OS device to provide a one-to-one mapping between a public IP address (198.51.100.10) and an internal server IP address (10.1.1.10). When external clients attempt to ping the public IP address, the SRX does not respond. Other services work correctly. What must be configured to allow the SRX to respond to ICMP requests for the Static NAT IP?

Accepted Answer

Configure Proxy ARP on the external egress interface for the static NAT public IP address.. For Static NAT, the SRX must respond to ARP requests for the public IP address from external hosts. By default, the SRX does not respond to ARP for NAT IPs unless proxy ARP is enabled on the egress interface. Configuring proxy ARP for the specific public IP allows the SRX to answer ARP requests, enabling ICMP and other services to reach the internal server.

Answer

Configure a Source NAT rule matching the ICMP traffic from the internal server.

Answer

Add an explicit static route for the internal server pointing to the Null0 interface.

Answer

Enable ICMP inspection within the security ALG configuration under security algorithms.

Question 5

You are troubleshooting a complex Static NAT setup where an internal mail server (10.10.10.5) is mapped to a public IP (198.51.100.5). External inbound connections work, but outbound connections initiated from the mail server show that the source IP is being translated by a general interface-based Source NAT rule rather than the Static NAT mapping. How do you ensure outbound connections from the mail server use its Static NAT public IP?

Accepted Answer

Ensure that conflicting Source NAT rules are placed lower in evaluation order or exclude the mail server IP from the Source NAT rule-set match criteria.. In Junos NAT, rule evaluation order determines which NAT rule applies to a session. A general interface-based Source NAT rule placed above the Static NAT rule will match outbound traffic from 10.10.10.5 first, translating the source to the interface address instead of the static public IP. To ensure the mail server's outbound traffic uses its static mapping, the conflicting Source NAT rule must be evaluated after the static NAT rule, or the mail server IP must be excluded from the Source NAT rule's match criteria.

Answer

Explicitly configure a Source NAT rule that maps the mail server IP to its own public IP address.

Answer

Disable interface-based source NAT globally and migrate all internal subnets to pool-based NAT.

Answer

Change the static NAT rule to operate as a destination-only NAT pool.

Question 6

Which Junos operational command allows an administrator to view translation statistics and hit counts for NAT rule sets?

Accepted Answer

show security nat rule-set. The command 'show security nat rule-set' displays configured NAT rule sets along with translation statistics and hit counts for each rule, allowing administrators to verify which rules are matching traffic. This is the standard operational command for viewing NAT rule-set statistics on Junos SRX devices.

Answer

show security flow statistics nat

Answer

show system services nat statistics

Answer

show nat summary counters

Question 7

Which configuration statement correctly defines a source NAT pool named 'corp-pool' with an address range from 203.0.113.10 to 203.0.113.20 on Junos OS?

Accepted Answer

set security nat source pool corp-pool address 203.0.113.10 to 203.0.113.20. The correct Junos syntax for a source NAT pool with an address range is 'set security nat source pool address to '. This defines a pool named 'corp-pool' with addresses from 203.0.113.10 to 203.0.113.20. The 'to' keyword specifies the range without CIDR notation.

Answer

set security nat source pool corp-pool address 203.0.113.10/32 to 203.0.113.20/32

Answer

set security nat source address-pool corp-pool range 203.0.113.10-203.0.113.20

Answer

set security nat source pool corp-pool address 203.0.113.10/28

Question 8

An administrator configures a Source NAT pool with multiple IP addresses. By default, how does Junos OS allocate port and IP addresses from this pool for new sessions?

Accepted Answer

Sequential or round-robin allocation across the pool addresses.. By default, Junos OS Source NAT pools allocate addresses sequentially (round-robin) across the pool, moving to the next IP as ports are consumed, rather than exhausting one IP before moving on. This spreads sessions across all pool addresses and ports, improving utilization and avoiding premature port exhaustion on a single address. The default behaviour is not persistent or hashed unless you explicitly configure address-persistent or port-overloading options.

Answer

Using only the first IP in the pool until port exhaustion occurs before utilizing subsequent IP addresses.

Answer

Hashing the internal source IP and port to bind it to a fixed pool IP (Persistent NAT).

Answer

Randomized IP selection for every new session regardless of source IP.

Question 9

You configure a Static NAT mapping for a server. External users report that they can connect to the server, but internal users on the trust zone trying to reach the server via the same static NAT public IP experience connection timeouts. You have already verified that interface routing is correct. What specific Junos feature can be enabled to solve this internal reachability issue without changing internal DNS records?

Accepted Answer

Configure a Source NAT rule for traffic originating from the internal zone destined to the internal zone matching the static NAT IP.. When internal trust-zone hosts try to reach the server via its public static NAT IP, the packet arrives at the firewall destined to the public IP, gets translated to the private IP, but the return path from the server bypasses the firewall (or the firewall sees the source as the internal host and destination as the internal server, so no NAT is applied on the return). Enabling a Source NAT rule for intra-zone traffic destined to the static NAT IP forces the firewall to also translate the source, ensuring the return traffic is symmetric and passes back through the device. This is the classic 'NAT hairpinning' or 'U-turn' solution in Junos.

Answer

Configure a Static NAT rule with the 'off-path' option enabled.

Answer

Change the security policy action to 'permit' with 'nat source interface' embedded.

Answer

Enable 'proxy-arp' on the internal interface facing the trusted network hosts.

Question 10

An administrator configures a Source NAT pool and notices that multiple internal clients sharing the same public IP address are experiencing session disruptions with certain web applications that require consistent source ports. Which Junos feature should be enabled on the source NAT pool to ensure that a specific internal IP address always maps to the same translated public IP and port combination?

Accepted Answer

persistent-nat. The persistent-nat feature on a Junos source NAT pool ensures that a given internal host always maps to the same translated public IP and port, maintaining session consistency for applications that require stable source ports. This is configured under the source NAT pool with options like 'persistent-nat permit any' and address-mapping settings.

Answer

session-stable translation

Answer

source-nat deterministic-pat

Answer

port-mapping static

Question 11

You are reviewing a Junos configuration containing both Destination NAT and Static NAT. An incoming packet matches both a Destination NAT rule and a Static NAT rule. Based on Junos OS NAT processing architecture, how is this conflict handled?

Accepted Answer

Destination NAT is evaluated first; if a match occurs, the packet is translated by Destination NAT and subsequent NAT stages are skipped for that transformation stage.. Junos OS evaluates Destination NAT first and Static NAT last. However, within distinct processing pipelines, a packet is evaluated against rule sets in order. Destination NAT rule-sets are evaluated before Static NAT rule-sets. If a packet matches a Destination NAT rule, that NAT is applied and evaluation for that stage finishes.

Answer

The SRX device generates a syntax error upon commit if overlapping Destination and Static NAT rules exist.

Answer

Both translations are applied simultaneously, resulting in double destination translation.

Answer

Static NAT takes precedence over Destination NAT because it provides a bidirectional mapping.

Question 12

Which Junos configuration command correctly establishes a destination NAT pool pointing to an internal server IP address of 10.2.2.50?

Accepted Answer

set security nat destination pool srv-pool address 10.2.2.50/32. The correct syntax for configuring a destination NAT pool in Junos is 'set security nat destination pool address '. This creates a pool that can be referenced by a destination NAT rule to translate incoming traffic to the internal server IP. The /32 prefix indicates a single host address.

Answer

set security nat destination address-pool srv-pool 10.2.2.50

Answer

set security nat pool destination srv-pool 10.2.2.50

Answer

set security nat destination rule-set rs1 pool srv-pool address 10.2.2.50

Question 13

An administrator configures Destination NAT so that traffic to public IP 198.51.100.10 is translated to internal server 10.1.1.10. However, when the administrator checks the security logs, they notice that the source IP addresses of incoming connections are being logged as the SRX internal interface IP instead of the actual external client IP addresses. What configuration error caused this?

Accepted Answer

A Source NAT rule is inadvertently matching inbound traffic from the untrust zone and translating the client's source IP.. If a Source NAT rule is matching inbound traffic from the untrust zone, it rewrites the client's source IP to the SRX's internal interface IP before the packet reaches the server. This is why the server logs show the SRX internal IP instead of the real external client address. The fix is to ensure source NAT rules only match outbound (trust-to-untrust) traffic, not inbound sessions.

Answer

Destination NAT inherently replaces the client source IP with the local interface IP by design.

Answer

The security policy action was set to 'log session-init' without specifying 'source-nat off'.

Answer

Proxy ARP on the external interface causes source IP reflection.

Question 14

Which Junos configuration statement defines a source NAT rule-set evaluating traffic from the 'trust' zone to the 'untrust' zone?

Accepted Answer

set security nat source rule-set rs1 from zone trust to zone untrust. The correct Junos configuration statement to define a source NAT rule-set that evaluates traffic from the 'trust' zone to the 'untrust' zone is 'set security nat source rule-set rs1 from zone trust to zone untrust'. This syntax specifies the rule-set name, the source zone, and the destination zone, which are used to match traffic for source NAT.

Answer

set security nat rule-set source rs1 zone trust untrust

Answer

set security nat source zone trust untrust rule-set rs1

Answer

set security policies from-zone trust to-zone untrust source-nat

Question 15

An administrator wants to ensure that a source NAT pool dynamically assigns ports across multiple pool IP addresses to prevent port exhaustion on a single IP. Which feature configuration on the source NAT pool accomplishes load distribution of ports across multiple pool addresses?

Accepted Answer

Configuring multiple pool IP addresses enables automatic port distribution across the pool by default.. In Junos, when a source NAT pool contains multiple IP addresses, the device automatically distributes port allocations across those addresses by default. No explicit load-balancing statement is required; the pool inherently spreads sessions across available IPs to prevent port exhaustion on any single address.

Answer

Interface-based NAT must be combined with pool-based NAT to achieve port load balancing.

Answer

Static NAT must be enabled alongside the source NAT pool to load balance ports.

Answer

The 'round-robin-ports' statement must be explicitly configured under the pool.

Question 16

You are auditing a Junos security device configuration. You observe multiple Static NAT rules configured across different rule sets. One of the rules uses the 'off-path' or similar specialized handling? Wait, you recall Junos Static NAT rule configuration details. Which statement correctly describes how Junos Static NAT handles bi-directional traffic flow without requiring separate source NAT rules?

Accepted Answer

Static NAT automatically provides bidirectional translation, handling both inbound destination translation and outbound source translation implicitly.. Junos Static NAT creates a persistent, bidirectional mapping between a private IP and a public IP. Once configured, the same rule handles inbound traffic (translating the public destination IP to the private host) and outbound traffic (translating the private source IP to the public IP) without needing a separate Source NAT rule. This implicit bidirectional behavior is a core feature of Static NAT in Junos, making it ideal for servers that must be reachable from the internet and also initiate outbound connections.

Answer

Static NAT rules must be bound to a security ALG to function bidirectionally.

Answer

Static NAT requires proxy ARP for inbound traffic and static routing tables for outbound traffic translation.

Answer

Static NAT only handles inbound traffic; outbound traffic from the internal host must always be matched by a separate Source NAT pool rule.

Question 17

An administrator creates a Destination NAT rule that translates incoming traffic on public IP 203.0.113.100 to private IP 10.10.10.100. However, when inspecting sessions using 'show security flow session', the translation shows the correct destination IP, but the application traffic fails. Further inspection reveals that the internal server listens on port 8080, whereas the external traffic arrives on port 80. How should the Destination NAT rule be configured to handle this port translation?

Accepted Answer

Define a destination NAT pool that specifies port 8080, and reference this pool in the Destination NAT rule matching port 80 traffic.. Destination NAT in Junos supports port translation through the destination NAT pool configuration. By defining a pool that specifies the translated port (8080) and referencing that pool in the Destination NAT rule that matches incoming traffic on port 80, the SRX rewrites both the destination IP and the destination port. This is the standard way to perform port forwarding with Destination NAT.

Answer

Enable a security ALG for HTTP traffic to automatically remap port 80 to port 8080.

Answer

Configure a Static NAT rule with port override statements under the security policy.

Answer

Change the Junos system service port mapping table globally.

Question 18

Which Junos configuration statement specifies the action taken when a source NAT rule matches traffic?

Accepted Answer

then source-nat. In Junos security NAT configuration, the action taken when a source NAT rule matches is specified with the 'then source-nat' statement, which references the NAT pool or interface for translation. This is the standard Junos syntax for source NAT rule actions.

Answer

nat-action source

Answer

set action source-translation

Answer

action translate source

Question 19

Which Junos command displays summary counters for all configured NAT rule sets across source, destination, and static NAT?

Accepted Answer

show security nat rule-set. To view summary counters and hit counts for NAT rules and rule-sets, 'show security nat summary' or rule-set summary commands are used.

Answer

show security nat summary

Answer

show security flow summary nat

Answer

show system nat counters

Question 20

You are troubleshooting a complex network where Destination NAT forwards traffic to a server farm. Due to high availability requirements, the destination NAT pool contains multiple internal server IP addresses. How does Junos OS distribute incoming destination NAT connections across multiple pool IP addresses?

Accepted Answer

Junos distributes sessions across multiple pool IP addresses using round-robin or hash-based load distribution.. When a destination NAT pool contains multiple IP addresses, Junos distributes incoming sessions across the pool addresses using round-robin or hashing algorithms to achieve load balancing.

Answer

Destination NAT pools only support a single IP address; multiple IPs are reserved exclusively for Source NAT pools.

Answer

Junos always forwards 100% of traffic to the first IP in the pool until that server fails, acting as an active-passive pair.

Answer

Junos requires an external SLB (Server Load Balancer) hardware module to distribute traffic across a destination NAT pool.