Network Address Translation practice questions

From the untrusted zone to the untrusted zone, using the public destination IP address.

Why it fails: Policies evaluate the post-translation destination IP, which is in the internal zone, not the untrusted zone.

From the untrusted zone to the trusted zone, using the pre-translation public IP address.

Why it fails: Security policies do not evaluate pre-translation destination IP addresses for destination NAT; they use the post-translation IP.

From the trusted zone to the untrusted zone, using the public destination IP address.

Why it fails: This represents outbound traffic direction, whereas destination NAT handles inbound traffic.

Use interface-based NAT for the servers and pool-based NAT for the remaining internal subnets.

Why it fails: Interface-based NAT translates all matching traffic to the egress interface address, so the servers would share that single public IP rather than each holding a dedicated one, defeating partner whitelisting. Interface NAT suits general outbound internet access where per-host identity is irrelevant.

Configure Static NAT for the entire subnet and override individual host entries using Source NAT pools.

Why it fails: Static NAT maps one private address to one public address, so applying it to an entire subnet cannot work and Source NAT pools cannot override individual host entries. It tempts because static NAT is the correct tool for the dedicated one-to-one mappings the partner whitelisting demands.

Enable persistent-nat on the general source NAT pool and bind the server's MAC address to the public IP.

Why it fails: Persistent NAT keeps a given internal host mapped to one pool address for the session timeout, but that address is not guaranteed unique or permanent, so partner whitelisting eventually breaks. Persistent NAT suits applications needing session affinity to the same translated address, not fixed mappings.

All NAT types are evaluated simultaneously using parallel hardware lookups.

Why it fails: Junos evaluates NAT types sequentially based on predefined processing stages.

Source NAT is evaluated first, followed by Destination NAT, and then Static NAT.

Why it fails: Source NAT is not evaluated before Destination NAT.

Static NAT is evaluated first, followed by Destination NAT, and then Source NAT.

Why it fails: Static NAT is evaluated last among the three NAT types.

Configure a Source NAT rule matching the ICMP traffic from the internal server.

Why it fails: Static NAT handles bidirectional translation; a separate source NAT rule for ICMP is unnecessary and incorrect.

Add an explicit static route for the internal server pointing to the Null0 interface.

Why it fails: A Null0 route is not needed for static NAT ARP resolution and would break traffic flow.

Enable ICMP inspection within the security ALG configuration under security algorithms.

Why it fails: ICMP is processed natively by the flow engine and does not require an ALG for basic static NAT reachability.

Explicitly configure a Source NAT rule that maps the mail server IP to its own public IP address.

Why it fails: Static NAT already handles source translation implicitly; adding a redundant source NAT rule adds unnecessary configuration complexity and potential rule conflicts.

Disable interface-based source NAT globally and migrate all internal subnets to pool-based NAT.

Why it fails: Disabling interface-based NAT globally impacts all other traffic unnecessarily.

Change the static NAT rule to operate as a destination-only NAT pool.

Why it fails: Destination NAT is unidirectional; changing static NAT to destination-only would break inbound/outbound symmetry.

show security flow statistics nat

Why it fails: This is not a valid operational command hierarchy in Junos OS.

show system services nat statistics

Why it fails: NAT is handled by the security flow engine, not system services.

show nat summary counters

Why it fails: This command syntax is invalid for Junos OS security devices.

set security nat source pool corp-pool address 203.0.113.10/32 to 203.0.113.20/32

Why it fails: The correct Junos CLI syntax uses address ranges without '/32 to /32' notation inside the pool definition.

set security nat source address-pool corp-pool range 203.0.113.10-203.0.113.20

Why it fails: This syntax uses invalid keywords like 'address-pool' and hyphenated ranges.

set security nat source pool corp-pool address 203.0.113.10/28

Why it fails: A subnet mask like /28 includes network and broadcast addresses, whereas explicit range or single address blocks are defined using standard range syntax.

Using only the first IP in the pool until port exhaustion occurs before utilizing subsequent IP addresses.

Why it fails: Junos distributes sessions across pool addresses rather than exhausting a single IP first unless configured otherwise.

Hashing the internal source IP and port to bind it to a fixed pool IP (Persistent NAT).

Why it fails: Persistent NAT is an optional feature ('persistent-nat') that must be explicitly enabled; it is not the default behavior.

Randomized IP selection for every new session regardless of source IP.

Why it fails: Random allocation is not the default method for source NAT pool address selection.

Configure a Static NAT rule with the 'off-path' option enabled.

Why it fails: There is no 'off-path' option in Junos Static NAT configurations.

Change the security policy action to 'permit' with 'nat source interface' embedded.

Why it fails: NAT actions cannot be embedded directly inside security policy action statements in this manner; NAT is configured in the nat hierarchy.

Enable 'proxy-arp' on the internal interface facing the trusted network hosts.

Why it fails: Proxy ARP is used for external interfaces responding to upstream routers, not internal clients.

session-stable translation

Why it fails: Session stable is not a Junos NAT configuration keyword.

source-nat deterministic-pat

Why it fails: While deterministic NAT exists in some vendor equipment, Junos uses 'persistent-nat'.

port-mapping static

Why it fails: This is not the correct Junos keyword for persistent source port allocation.

The SRX device generates a syntax error upon commit if overlapping Destination and Static NAT rules exist.

Why it fails: Junos allows both rule sets to be configured, relying on the strict evaluation order rather than rejecting the commit.

Both translations are applied simultaneously, resulting in double destination translation.

Why it fails: A packet is only subjected to one primary destination translation stage per flow setup.

Static NAT takes precedence over Destination NAT because it provides a bidirectional mapping.

Why it fails: Destination NAT is evaluated before Static NAT in Junos rule evaluation order.

set security nat destination address-pool srv-pool 10.2.2.50

Why it fails: The keyword 'address-pool' is incorrect; the correct keyword is 'pool'.

set security nat pool destination srv-pool 10.2.2.50

Why it fails: This hierarchy is invalid in Junos OS.

set security nat destination rule-set rs1 pool srv-pool address 10.2.2.50

Why it fails: Pools are defined at the root NAT level, not directly inside rule-sets.

Destination NAT inherently replaces the client source IP with the local interface IP by design.

Why it fails: Destination NAT preserves the original source IP of the external client by default.

The security policy action was set to 'log session-init' without specifying 'source-nat off'.

Why it fails: 'Source-nat off' is not a security policy action parameter.

Proxy ARP on the external interface causes source IP reflection.

Why it fails: Proxy ARP answers ARP requests and does not alter packet source IP addresses.

set security nat rule-set source rs1 zone trust untrust

Why it fails: Junos expects 'from zone' and 'to zone' keywords inside the rule-set, so 'zone trust untrust' is rejected syntax. The tempting shape mirrors the from-zone/to-zone phrasing used in security policies, which is why it looks plausible, but source NAT rule-sets use a different keyword structure entirely.

set security nat source zone trust untrust rule-set rs1

Why it fails: The correct hierarchy is 'security nat source rule-set rs1 from zone trust to zone untrust'; placing 'zone trust untrust' before 'rule-set' inverts the order and Junos rejects it. The ordering looks natural if you think of zones as the primary selector, but rule-set is the parent node under 'security nat source'.

set security policies from-zone trust to-zone untrust source-nat

Why it fails: Source NAT is configured under 'security nat source', not as a source-nat action inside a security policy; policies control permit/deny and application services. The syntax resembles a policy action, which is tempting because NAT is often associated with policy evaluation, but Junos keeps NAT rule-sets in a separate hierarchy.

Interface-based NAT must be combined with pool-based NAT to achieve port load balancing.

Why it fails: Combining interface and pool NAT is not required or standard for pool distribution.

Static NAT must be enabled alongside the source NAT pool to load balance ports.

Why it fails: Static NAT provides one-to-one mapping and does not load balance ports.

The 'round-robin-ports' statement must be explicitly configured under the pool.

Why it fails: Junos does not use a command called 'round-robin-ports'; distribution across pool IPs is handled inherently.

Static NAT rules must be bound to a security ALG to function bidirectionally.

Why it fails: ALGs are only needed for complex protocols embedding IP addresses in payloads (like FTP/SIP), not for basic bidirectional static NAT.

Static NAT requires proxy ARP for inbound traffic and static routing tables for outbound traffic translation.

Why it fails: Outbound translation is handled automatically by the flow session state created by the static NAT mapping.

Static NAT only handles inbound traffic; outbound traffic from the internal host must always be matched by a separate Source NAT pool rule.

Why it fails: Static NAT is bidirectional; outbound traffic from the static NAT host is automatically translated to the public static IP.

Enable a security ALG for HTTP traffic to automatically remap port 80 to port 8080.

Why it fails: HTTP ALGs do not dynamically remap ports across NAT boundaries; port mapping is done via NAT configuration.

Configure a Static NAT rule with port override statements under the security policy.

Why it fails: Port overriding is handled in NAT pool/rule configurations, not security policies.

Change the Junos system service port mapping table globally.

Why it fails: Junos does not use a global system service port mapping table for destination NAT port forwarding.

nat-action source

Why it fails: 'nat-action' is not a valid Junos keyword.

set action source-translation

Why it fails: Action statements are defined with 'then', not 'set action'.

action translate source

Why it fails: This syntax is invalid in Junos OS.

show security nat summary

Why it fails: While descriptive, the specific operational command for rule-sets and counters is 'show security nat rule-set'.

show security flow summary nat

Why it fails: Invalid Junos command.

show system nat counters

Why it fails: Invalid Junos command syntax.

Destination NAT pools only support a single IP address; multiple IPs are reserved exclusively for Source NAT pools.

Why it fails: Destination NAT pools can contain multiple IP addresses for load balancing server farms.

Junos always forwards 100% of traffic to the first IP in the pool until that server fails, acting as an active-passive pair.

Why it fails: Destination NAT pools with multiple addresses perform distribution rather than operating strictly active-passive without health-check monitoring.

Junos requires an external SLB (Server Load Balancer) hardware module to distribute traffic across a destination NAT pool.

Why it fails: The SRX device natively handles distribution across destination NAT pool addresses without external hardware.