Firewalls and NAT (Network Address Translation) are the core security guards of any business network. They decide what data gets in, what goes out, and how to keep private information hidden from the public internet. For the 350-701 exam, understanding how these two technologies work together is essential because nearly every question about network security relies on them.
Jump to a section
A simple way to picture Firewall Technologies and NAT
When a club opens, the bouncer stands at the door and checks everyone who tries to enter. This is what a firewall does: a security guard that examines every piece of traffic (data) trying to get into a private network. But there's a twist: inside the club, the staff wear name tags only with their first names, not their full home addresses. When a DJ needs to order a pizza, the bouncer doesn't give Domino's the staff member's real home address — instead, the bouncer uses a special temporary name tag that Domino's can call back to reach the staff member through the bouncer.
This is NAT (Network Address Translation): the bouncer replacing the real home address of a person inside the club with a special, temporary address that outsiders can use to reply. Without NAT, every device inside the club would need its own unique, public home address — but there are only a limited number of those in the world. So the bouncer keeps a little notebook: "Staff member at table 7 asked for pizza. I'll give Domino's the club's main phone number and a note saying 'table 7'. When Domino's calls back asking for 'table 7', I'll know to route the pizza to the right person." This is exactly how NAT lets thousands of devices inside a private network share just one or a few public IP addresses. The bouncer also uses rules (the ACL — Access Control List) to decide who is allowed in the club and what they can bring. A firewall is that bouncer, NAT is the name-tag trick, and ACLs are the rulebook the bouncer follows.
A firewall is a security device — either a physical box or software on a server — that sits between a trusted internal network (like a company's private office) and an untrusted external network (usually the internet). Its job is to inspect every data packet that tries to cross that boundary. A data packet is a small chunk of information, like a single envelope in a postal system, that contains a source address (where it came from), a destination address (where it's going), and the payload (the actual message).
The firewall uses a set of rules called an Access Control List (ACL) to decide whether to allow or block each packet. An ACL is just a list of conditions: "If the packet comes from this IP address, allow it" or "If the packet is trying to reach this web server, block it." An IP address is a unique numerical label assigned to every device connected to a network — think of it like a street address for your computer.
There are several types of firewalls, but the 350-701 focuses on next-generation firewalls (NGFW). A traditional firewall only looks at the header of each packet — the envelope's address label. An NGFW goes further: it inspects the payload inside the envelope (deep packet inspection), understands what application is sending the data (for example, recognising YouTube traffic versus Skype), and can even block malware or suspicious content in real time.
Now, NAT (Network Address Translation) solves a specific problem: the internet was designed with only a limited number of public IP addresses. In the early days, every device needed its own unique public address to communicate on the internet. But there are billions of devices now, and not enough addresses for everyone. NAT allows many devices inside a private network to share a single public IP address when they go online.
Here's how it works step by step:
A computer inside the office with a private IP address (like 192.168.1.10) wants to visit a website at 8.8.8.8.
The computer sends the request to the firewall/NAT device.
The NAT device changes the source IP address from the private address (192.168.1.10) to its own public IP address (say 203.0.113.5).
It also changes the source port number — a port is like a door number on the IP address that differentiates one conversation from another.
The NAT device remembers this mapping in a table: "Private 192.168.1.10:port 5000 is now mapped to public 203.0.113.5:port 10000."
When the website replies, the packet is addressed to 203.0.113.5:port 10000.
The NAT device looks up its table, finds that port 10000 corresponds to 192.168.1.10:5000, and forwards the reply to the correct internal computer.
There are three main types of NAT you need to know for the exam:
Static NAT: a one-to-one mapping where a specific private IP address always translates to the same public IP address. Used when a server inside the network must be reachable from the internet with a consistent address.
Dynamic NAT: a pool of public IP addresses is shared. When a device wants to go out, it grabs one free public address from the pool. When it finishes, the address goes back to the pool.
PAT (Port Address Translation), also called NAT overload: this is the most common type in homes and small businesses. It uses one public IP address for thousands of internal devices by varying the source port numbers. That's the method described in the step-by-step above.
Why does this matter for security? NAT provides a basic layer of anonymity because internal IP addresses are hidden from the internet. An attacker outside cannot directly initiate a connection to a device behind NAT unless the NAT device has a specific rule (port forwarding) that says, "If someone from the internet tries to reach this public address on port 80, send it to the internal web server at 192.168.1.50." Without that rule, incoming connection attempts are automatically dropped.
Firewalls and NAT often work together on the same device (like a Cisco ASA or a next-generation firewall). The firewall enforces the rules, and the NAT translates the addresses so the packets can travel correctly.
1. Traffic Egress from Internal Host
A device with a private IP address (e.g., 192.168.1.10) sends a packet to a public internet server. The packet's source IP is private, which cannot route on the public internet. This triggers the need for NAT.
2. NAT Translation Table Lookup
The firewall/NAT device checks its translation table. If no existing entry for this session exists, it creates a new mapping. For PAT, it assigns a unique source port number (e.g., port 12345) and replaces the source IP with the public IP of the firewall.
3. Access Control List Check
The firewall then evaluates the translated packet against its ACL. If the rule set permits traffic of that type (e.g., HTTP to any destination), the packet is forwarded. If not, the packet is dropped.
4. Response Packet Receipt
The external server sends a reply packet addressed to the firewall's public IP and the assigned port. The firewall receives this packet and looks up the destination port in the NAT translation table.
5. Reverse NAT Translation and Forwarding
The firewall matches the port number to the original internal device's private IP and port, translates the destination back to the private address, and forwards the packet to the correct internal host. The session remains stateful until it ends.
Imagine you are the junior IT security administrator for a medium-sized company called 'EcoGoods Ltd' with 200 employees. The company has an office network with 200 computers, all using private IP addresses in the 10.0.0.0/8 range. They also have a public-facing web server for their e-commerce site. Your task is to configure the company's Cisco firewall — a next-generation firewall — to allow employees to browse the internet securely, while protecting internal systems from external attacks, and to make the web server accessible to customers.
Step one: You connect to the firewall's management interface (a web GUI or command-line). You first create an ACL that defines which traffic is allowed outbound. You write a rule that says "Allow all traffic from the internal network (10.0.0.0/8) to any destination on the internet, but only if the traffic is HTTP, HTTPS, or DNS." You block all other protocols to prevent malware from using non-standard ports to exfiltrate data.
Step two: You configure PAT (NAT overload) so that all 200 employees can share the one public IP address assigned to your company by the ISP. You set up the NAT rule: "Translate source address of 10.0.0.0/8 to the public IP 203.0.113.10 using PAT." The firewall will automatically track each employee's session via the source port.
Step three: For the e-commerce server, you need devices from the internet to reach it. You configure static NAT: a static one-to-one mapping from the public address 203.0.113.20 to the internal server's private address 10.0.0.50. You also create an ACL rule that permits inbound traffic to that public address only on ports 80 (HTTP) and 443 (HTTPS). All other inbound traffic to 203.0.113.20 is blocked.
Step four: You enable threat inspection features on the NGFW. You turn on application visibility to see exactly what employees are doing — for example, you might see that someone is using BitTorrent, which you then block via an application-specific rule. You also enable malware detection so if a user accidentally downloads a malicious file, the firewall inspects the file and blocks it.
Step five: You test the configuration. From an internal computer, you try to browse google.com. It works. You try to telnet to an external server (using port 23, which you blocked). It fails. From a friend's computer outside the office, you try to access https://203.0.113.20. The web server responds. You try to ping that public IP — it fails because ICMP traffic is not allowed in the inbound ACL.
This real-world scenario shows exactly how firewalls and NAT are used daily: controlling access, hiding addresses, and selectively exposing services. The exam will expect you to understand when to use each type of NAT and how ACLs interact with NAT rules.
The 350-701 exam tests Firewall Technologies and NAT in several distinct ways. You need to be precise and avoid common traps the exam sets.
First, the exam expects you to know the difference between stateful and stateless firewalls. A stateful firewall keeps track of the state of active connections (like remembering that a device inside sent a request, so the reply is allowed). A stateless firewall (like a basic ACL on a router) treats each packet independently — it does not remember previous packets. The exam loves to ask: "Which type of firewall tracks TCP handshake states?" Answer: stateful.
Second, the exam frequently tests NAT types with scenario-based questions. For example, 'A company has 1000 internal users but only 200 public IP addresses. Which NAT type uses a single public IP for all users?' The correct answer is PAT (NAT overload). They might also ask: 'Which NAT type maps one private IP to one public IP on a permanent basis?' That's static NAT.
Third, you will see questions about the order of operations: when both a firewall rule (ACL) and a NAT rule apply, which is evaluated first? On Cisco firewalls, NAT is typically applied first (translation occurs before the ACL check on outbound traffic), but on some devices the ACL check happens before NAT. The exam will ask about the correct sequence for a specific Cisco product (ASA or Firepower). Memorise: on Cisco ASA, for outbound traffic, the NAT rule is applied first, then the ACL is checked. For inbound traffic, the ACL is checked first, then NAT is applied.
Fourth, be ready for questions about firewall deployment modes. Transparent mode (also called 'bump in the wire') means the firewall acts like a Layer 2 bridge — it doesn't route or change IP addresses, just filters traffic. Routed mode means the firewall acts as a router with its own IP addresses on each interface. The exam will quiz you on which mode is appropriate for different network designs.
Fifth, the exam tests your understanding of the differences between NGFW (Next-Generation Firewall) and traditional firewalls. NGFW capabilities include:
Application awareness (knowing the app, not just the port)
Intrusion prevention (IPS)
SSL/TLS decryption (inspecting encrypted traffic)
Malware sandboxing
Expect a question like: 'Which feature distinguishes an NGFW from a traditional stateful firewall?' The answer is application awareness and integrated IPS.
Sixth, the exam will present you with an exhibit showing a network diagram with a firewall and NAT configurations, and ask you to determine which traffic will be allowed or denied based on the rules. Practice reading ACL entries. The format is usually: permit tcp 192.168.1.0 0.0.0.255 any eq 80. This means 'allow traffic from the 192.168.1.0/24 network to any destination on port 80 (HTTP).'
Finally, know exactly what Port Address Translation (PAT) does differently from dynamic NAT. The key trap: PAT does not need multiple public IP addresses — it uses port numbers to distinguish sessions. Dynamic NAT needs a pool of public addresses.
Use these bullet points to memorise the high-priority topics:
Stateful vs stateless firewall
Static NAT vs Dynamic NAT vs PAT
Order of operations: NAT before ACL (outbound) on ASA
Transparent mode vs Routed mode firewall
NGFW capabilities (application inspection, IPS, SSL decryption)
ACL structure: permit/deny protocol source-address source-wildcard destination-address destination-wildcard eq port
A firewall is a security device that inspects data packets and uses an Access Control List (ACL) to decide which traffic to allow or block.
Stateful firewalls track the state of active connections, allowing return traffic only if it matches a known session.
Network Address Translation (NAT) conserves public IP addresses by allowing many private IPs to share one or a few public addresses.
Port Address Translation (PAT) is the most common NAT type for home and small business networks because it uses port numbers to distinguish multiple sessions behind a single public IP.
Static NAT provides a one-to-one permanent mapping and is used to make internal servers reachable from the internet with a consistent public address.
On Cisco ASA firewalls, outbound traffic is NATted before the ACL is checked, while inbound traffic has the ACL checked before NAT is applied.
Next-Generation Firewalls (NGFW) add application awareness, intrusion prevention, and SSL decryption beyond what traditional firewalls offer.
A firewall in transparent mode operates as a Layer 2 bridge, inspecting traffic without needing an IP address in the data path.
These come up on the exam all the time. Here's how to tell them apart.
Stateful Firewall
Keeps track of connection state (TCP handshake, session timeout).
Automatically allows return traffic for established connections.
Uses more memory and processing per session.
Stateless Firewall
Treats each packet independently without remembering earlier packets.
Must explicitly allow both directions of traffic via ACL rules.
Faster and simpler, but less secure for complex protocols.
Static NAT (One-to-One)
Maps one private IP permanently to one public IP.
Used to make internal servers reachable from the internet.
Consumes one public IP per internal server.
PAT (NAT Overload)
Maps many private IPs to a single public IP using port numbers.
Used for general outbound internet access for many users.
Saves public IP addresses by sharing one among thousands.
Transparent Mode Firewall
Operates as a Layer 2 bridge without IP addresses in the data path.
Does not require changes to existing IP addressing.
Easier to insert into existing networks without redesign.
Routed Mode Firewall
Operates as a Layer 3 router with its own IP addresses on each interface.
Requires IP address configuration and routing changes.
Provides more granular control and supports advanced routing features.
Mistake
NAT provides strong security because it hides the internal IP address from the internet.
Correct
NAT provides basic obfuscation, not strong security. It does not encrypt traffic or protect against advanced attacks. Security should rely on a proper firewall and encryption (like VPNs).
People confuse hiding an address with actual security. NAT was originally designed to conserve IP addresses, not as a security feature. The exam tests that you know NAT is not a substitute for a firewall.
Mistake
A firewall blocks all inbound traffic by default, so no configuration is needed to protect internal devices.
Correct
A default-deny inbound rule is common, but outbound traffic is often allowed by default, which can let malware call home. Firewalls must be properly configured with explicit rules for both inbound and outbound traffic.
Beginner admins often assume a firewall is 'secure out of the box'. In reality, default configurations vary by product, and many allow outbound traffic without restriction. The exam tests that you know security requires deliberate rule creation.
Mistake
Static NAT and PAT are the same thing because both translate addresses.
Correct
Static NAT is a permanent one-to-one mapping between a private IP and a public IP. PAT (NAT overload) maps many private IPs to one public IP using different port numbers. They serve completely different purposes.
Both involve address translation, so beginners lump them together. The exam loves to ask 'Which type of NAT would you use for a public web server?' — the answer is static NAT because PAT doesn't allow consistent incoming connections.
Mistake
If a firewall is in transparent mode, it cannot inspect traffic because it doesn't have an IP address.
Correct
In transparent mode, the firewall still inspects all traffic passing through it, but it operates as a bridge without needing its own IP address for the data path. It can still apply ACLs and perform deep packet inspection.
Transparent mode is a niche concept. Beginners think 'no IP = no inspection'. In reality, the firewall uses management IP addresses for administration and can still inspect everything.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A stateful firewall keeps track of active connections (e.g., it remembers that you requested a web page, so it allows the server's reply). A stateless firewall treats each packet in isolation without remembering previous ones.
Static NAT is used when a device inside the network must always be reachable from the internet with the same public IP address, like a web server. Dynamic NAT is used when internal devices just need temporary internet access and you have a pool of public IPs.
NAT provides a basic level of obfuscation by hiding internal IP addresses, but it does not inspect traffic, block malware, or authenticate users. Real security requires a firewall with proper ACLs and threat inspection.
For outbound traffic (inside to outside), NAT is applied first, then the ACL is checked. For inbound traffic (outside to inside), the ACL is checked first, then NAT is applied.
PAT is a specific type of NAT that uses port numbers to map many private IPs to a single public IP. General NAT (like static or dynamic NAT) maps one private IP to one public IP, or uses a pool of public IPs without relying on port numbers for differentiation.
Yes, in transparent mode the firewall acts as a Layer 2 bridge and does not need an IP address for the traffic path. It still inspects all traffic and applies rules, but it is invisible to the network devices.
You've finished Firewall Technologies and NAT. Continue through the 350-701 study guide to build a complete picture of the exam.
Done with this chapter?