Cisco CCNA NAT for IPv4 5 — Questions and Answers
Question 1: Which statement about NAT and IPv6 is most accurate from a CCNA perspective?
- NAT64 is required for all IPv6 networks
- IPv6 was designed with sufficient address space to eliminate the need for NAT (Correct answer)
- NAT is mandatory in dual-stack environments
- IPv6 uses the same NAT implementation as IPv4
Correct answer: IPv6 was designed with sufficient address space to eliminate the need for NAT
IPv6's 128-bit address space provides enough unique addresses for every device globally, removing the address-conservation motivation that drove widespread IPv4 NAT adoption.
Question 2: A 'show ip nat translations' output shows entries with 'Pro' as '---'. What type of traffic do these entries represent?
- TCP sessions
- UDP datagrams
- ICMP pings
- Non-TCP/UDP traffic such as GRE or other IP protocols (Correct answer)
Correct answer: Non-TCP/UDP traffic such as GRE or other IP protocols
The '---' protocol field in NAT translation entries indicates non-TCP/UDP traffic (such as GRE tunnels or other IP protocols) that PAT cannot differentiate by port.
Question 3: What is the purpose of the 'ip nat translation timeout' command?
- Sets the time before a static NAT entry is deleted
- Adjusts how long idle dynamic NAT entries are kept before removal (Correct answer)
- Controls how quickly the NAT pool refreshes
- Limits the maximum number of concurrent translations
Correct answer: Adjusts how long idle dynamic NAT entries are kept before removal
'ip nat translation timeout [seconds]' configures the idle timeout for dynamic NAT translations before the router removes them from the table.
Question 4: Which feature allows a Cisco router to apply NAT based on the destination address rather than the source address?
- ip nat inside source
- ip nat outside source
- ip nat inside destination (Correct answer)
- Policy-based routing with NAT
Correct answer: ip nat inside destination
'ip nat inside destination' translates the destination IP of packets arriving on the inside interface, commonly used for load-balancing to multiple internal servers.
Question 5: An administrator notices that after configuring NAT, internal users cannot reach the internet. The ACL for NAT is 'permit 192.168.10.0 0.0.0.255'. Users are on 192.168.20.0/24. What is the problem?
- The NAT pool is exhausted
- The ACL does not match the users' subnet, so their traffic is not being translated (Correct answer)
- The 'ip nat inside' command is missing from the interface
- PAT requires a host-specific ACL, not a subnet
Correct answer: The ACL does not match the users' subnet, so their traffic is not being translated
The ACL only permits 192.168.10.0/24; users on 192.168.20.0/24 don't match, so their source addresses are never translated and packets are dropped or sent untranslated.
Question 6: Which of the following is a valid benefit of using NAT in an enterprise network?
- NAT improves end-to-end application performance
- NAT enables conservation of public IPv4 addresses by sharing them among many private hosts (Correct answer)
- NAT eliminates the need for a default gateway
- NAT automatically encrypts traffic between inside and outside hosts
Correct answer: NAT enables conservation of public IPv4 addresses by sharing them among many private hosts
NAT's primary benefit is IPv4 address conservation, allowing thousands of private hosts to share a small number of public IP addresses for internet access.
Question 7: A 'debug ip nat' output shows: 'NAT*: s=10.0.0.1->203.0.113.5, d=8.8.8.8'. What does the '->' indicate?
- The destination address is being translated
- The source address is being translated from private to public (Correct answer)
- A static NAT entry was added
- The packet was dropped by NAT
Correct answer: The source address is being translated from private to public
The '->' arrow in NAT debug output shows the original address on the left being translated to the address on the right; here the source 10.0.0.1 becomes 203.0.113.5.
Cisco CCNA NAT for IPv4 5
Which statement about NAT and IPv6 is most accurate from a CCNA perspective?