Palo Alto Networks Certified Network Security Engineer (PCNSE)TroubleshootEasy
A network administrator is troubleshooting an issue where users on the internal network are unable to access a specific external web service. Packet captures on the Palo Alto Networks firewall show traffic leaving the internal interface towards the internet, but no return traffic is observed. Security policies are in place allowing the outbound traffic. Which of the following is the MOST likely cause of this issue?
- AThe firewall is configured with an incorrect default route.
- BThe security policy is blocking the return traffic to the internal network.
- CThe NAT policy is not correctly translating the source IP address for outbound traffic.
- DThe external web service is down or unreachable.
Show answer & explanationAnswer & explanation
Correct answer: C. The NAT policy is not correctly translating the source IP address for outbound traffic.
If outbound traffic is seen leaving the internal interface but no return traffic is observed, and security policies allow outbound traffic, the most common reason is that the external service cannot route back to the internal private IP addresses. This points to an issue with source NAT.
Why the other options are wrong
- A. If the default route was incorrect, outbound traffic wouldn't leave the internal interface towards the internet.
- B. If return traffic was blocked by a security policy, it would likely be observed hitting the firewall's external interface before being dropped, which isn't indicated.
- D. While possible, the question states outbound traffic is seen, implying connectivity to the external service's network, making a NAT issue more likely first.
Source NAT Troubleshooting
Source Network Address Translation (SNAT) is crucial for internal hosts to access external resources when using private IP addresses. If SNAT fails, return traffic cannot reach the internal host.
- Private IPs are not routable on the internet.
- SNAT replaces the private source IP with a public IP.
- Lack of return traffic often indicates SNAT failure.
Memory trick: If traffic goes out but doesn't come back, check the disguise!