Under which circumstance should a network administrator implement one-way NAT?
A. when the network must route UDP traffic
B. when traffic that originates outside the network must be routed to internal hosts
C. when traffic that originates inside the network must be routed to internal hosts
D. when the network has few public IP addresses and many private IP addresses require outside access
Answer: B
Explanation:
NAT operation is typically transparent to both the internal and external hosts. Typically the internal host is aware of the true IP address and TCP or UDP port of the external host. Typically the NAT device may function as the default gateway for the internal host. However the external host is only aware of the public IP address for the NAT device and the particular port being used to communicate on behalf of a specific internal host.
NAT and TCP/UDP
“Pure NAT”, operating on IP alone, may or may not correctly parse protocols that are totally concerned with IP information, such as ICMP, depending on whether the payload is interpreted by a host on the “inside” or “outside” of translation. As soon as the protocol stack is traversed, even with such basic protocols as TCP and UDP, the protocols will break unless NAT takes action beyond the network layer. IP packets have a checksum in each packet header, which provides error detection only for the header. IP datagrams may become fragmented and it is necessary for a NAT to reassemble these fragments to allow correct recalculation of higher-level checksums and correct tracking of which packets belong to which connection. The major transport layer protocols, TCP and UDP, have a checksum that covers all the data they carry, as well as the TCP/UDP header, plus a “pseudo-header” that contains the source and destination IP addresses of the packet carrying the TCP/UDP header.
For an originating NAT to pass TCP or UDP successfully, it must recompute the TCP/UDP header checksum based on the translated IP addresses, not the original ones, and put that checksum into the TCP/UDP header of the first packet of the fragmented set of packets. The receiving NAT must recompute the IP checksum on every packet it passes to the destination host, and also recognize and recompute the TCP/UDP header using the retranslated addresses and pseudo-header. This is not a completely solved problem. One solution is for the receiving NAT to reassemble the entire segment and then recompute a checksum calculated across all packets.
The originating host may perform Maximum transmission unit (MTU) path discovery to determine the packet size that can be transmitted without fragmentation, and then set the don’t fragment (DF) bit in the appropriate packet header field. Of course, this is only a one-way solution, because the responding host can send packets of any size, which may be fragmented before reaching the NAT.
|
FULL Printable PDF and Software. VALID exam to help you pass.
|
 |
Correct answer: D
What they are referring to is PAT or port address translation where many internal IP addresses are translated to a single public IP address such as the one on the interface. This is 1 way NAT because you can initiate communication from inside of your network to the outside, but the outside cannot initiate communication to you.
The correct response for the test is B.
Definitely D is the correct one. If you need a connection from outside you need static NAT and this is bidirectional. As mentioned this is PAT so only the inside to outside traffic is able to match the rule so it is unidirectional.
Yes Che, D is correct and the definition of ONE-WAY NAT and is the circumstance of ONE WAY NAT implementation.. B is in conflict with the definition and process.
I think the correct answer should be D. The basic concept of NAT is that it allows inside/internal hosts to use the private address spaces, go through the internal interface of a router running NAT, and then have the internal addresses translated to the router’s public IP address on the external interface that connects to the Internet. “Typically the NAT device may function as the default gateway for the internal host.”
Answer D is essentially PAT or port address translation, which is where many internal IP addresses are translated to a single public IP address such as the one on the interface. This is “1-way” NAT because you can initiate communication from inside of your network to the outside, but the outside cannot initiate communication to you.