Network Address Translation and Routing in Security Gateways
This domain tests source NAT, NAT Server, NAT ALG, and the order in which translation, routing, and policy are applied. Scenario questions often ask why a published server is unreachable or why outbound users cannot browse.
Core rules
- Source NAT translates internal addresses for outbound access. Forms include NAT No-PAT (one-to-one), NAPT (many-to-one with ports), Easy IP (interface address), and Smart NAT.
- NAT Server publishes an internal server by translating the destination address and port; it does not replace the security policy.
- On USG processing, destination NAT for NAT Server occurs before security policy lookup, so the policy references the private server address; source NAT is applied after policy for outbound traffic.
- NAT ALG handles embedded addresses in FTP and SIP.
- Routing uses longest-prefix match; policy-based routing is evaluated before the main routing table.
Worked example
10.1.1.0/24 must browse the Internet through GigabitEthernet1/0/1 using that interface address. Create a source NAT policy from Trust to Untrust with Easy IP on the interface, plus a permit security policy and a default route. If users still fail, check the return path and NAT translations. For a published web server, configure NAT Server plus a policy permitting Untrust to the server’s private address.
Traps that cost marks
- Believing NAT Server bypasses the security policy.
- Configuring NAT without a route to the translated address.
- Using NAPT for a protocol with embedded IPs but no ALG.
- Matching the wrong zone in the NAT policy.