Exam 156-215.80 topic 1 question 185 discussion

A is the correct answer WHen using automatic NAT , the firewall inspect the NAT table twice , once for automatic NAT source and one for automatic nat destination Easy to test, create one object on either side of the gateway a client 172.16.0.250 auto nat 192.168.0.111 and a server 192.168.0.1 auto nat 172.16.0.111. Access the server from the client using its auto nat address. You will see two translation unde NAT rule number and additional NAT rule number LOGs attached Source: 172.16.0.250 Source Port: 51518 Destination: 172.16.0.111 Destination Port: 80 IP Protocol: 6 Xlate (NAT) Source IP: 192.168.0.111 Xlate (NAT) Destination IP: 192.168.0.1 Xlate (NAT) Source Port: 0 Xlate (NAT) Destination Port:0 NAT Rule Number: 3 NAT Additional Rule Number: 6 Action: Accept Type: Connection Policy Name: LAB-FW01-FW03-Policy

https://community.checkpoint.com/t5/General-Topics/What-are-to-the-point-differences-between-Automatic-Manual-NAT/td-p/31229#

D is correct

The question would be then, under what circumstances this would be possible but without using Manual NAT (for A to be valid)?

D https://sc1.checkpoint.com/documents/R80.20_M1/WebAdminGuides/EN/CP_R80.20_M1_SecurityManagement_AdminGuide/html_frameset.htm?topic=documents/R80.20_M1/WebAdminGuides/EN/CP_R80.20_M1_SecurityManagement_AdminGuide/94349 Enabling Manual NAT For some deployments, it is necessary to manually define the NAT rules. Create SmartConsole objects that use the valid (NATed) IP addresses. Create NAT rules to translate the original IP addresses of the objects to valid IP addresses. Then configure the Firewall Rule Base to allow traffic to the applicable translated objects with these valid IP addresses. Note - For manual NAT rules, it is necessary to configure Proxy ARP entries to associate the translated IP address. These are some situations that must use manual NAT rules: Rules that are restricted to specified destination IP addresses and to specified source IP addresses Translate both source and destination IP addresses in the same packet. Static NAT in only one direction Translate services (destination ports) Rules that only use specified services (ports) Translate IP addresses for dynamic objects

Definitely D!

D would be the right Answer as it works in Manual NAT for both source and destination .

How about D? It is not possible to translate both, source and destination using automated NAT