PCNSE Deploy and Configure Firewalls Practice Question

Exhibit

Refer to the exhibit.
admin@PA-500# show running config | match nat
...
nat {
    source-nat {
        rule "SNAT-Outside" {
            source [ 10.0.0.0/8 ];
            destination [ any ];
            service [ any ];
            to-interface ethernet1/1;
            source-translation {
                interface-address;
            }
        }
    }
}

The source NAT rule 'SNAT-Outside' is configured to translate traffic from 10.0.0.0/8 to the interface address of ethernet1/1. However, traffic from 10.1.1.1 to the internet is not being translated. What is the most likely reason?

⚠ Common exam trap

Many candidates assume source NAT rules only need a source IP range and an egress interface, overlooking the mandatory 'from' zone specification that PAN-OS requires for rule matching.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The rule is missing a 'from' zone specification.

A source NAT rule in PAN-OS requires a 'from' zone specification to match traffic. Without it, the rule does not know which zone the traffic originates from, so it will not be applied. In this case, the traffic from 10.1.1.1 to the internet likely originates from a zone (e.g., 'trust') that is not specified in the rule, causing the translation to fail.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The 'interface-address' option requires a specific translated address.
Why it's wrong here
Interface-address uses the IP of the specified interface dynamically.
✓
The rule is missing a 'from' zone specification.
Why this is correct
Source NAT rules must include the source zone to determine when to translate.
✗
The rule should be under 'destination-nat' instead of 'source-nat'.
Why it's wrong here
This is a source NAT scenario; destination NAT is for inbound traffic.
✗
The 'to-interface' should be 'any'.
Why it's wrong here
Specifying the egress interface is correct and often necessary.

Visual reference

Go deeper

PCNSE Deploy and Configure Firewalls Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question