A manufacturer is deploying a Threat Defense appliance in routed mode between the campus core switch and the ISP edge. Internal hosts in the 10.20.0.0/16 network must reach internet destinations, the existing switch and host addressing stay exactly in place, and the provider edge performs no translation for customer subnets. Which configuration set completes this routed-mode deployment?
Select an answer to reveal the explanation.
Short Explanation
You need addresses on both interfaces, a NAT rule for the inside subnet, an access control rule that permits the traffic, and a default route to the ISP. It’s like giving traffic a map and a pass: NAT translates it, the rule lets it through, and the route shows it where to go.
Full Explanation
In routed mode the appliance acts as a layer 3 hop, so it needs an address on each participating interface, a translation rule for inside hosts, an access control rule permitting the traffic, and a route pointing toward the ISP. Together with routing that sends the hosts' traffic through the appliance, these settings allow packets to leave and return along the intended path. Translation matters because private inside addresses are not routable on the public internet, and the default route provides a path for destinations the appliance has no more specific route for. Leaving translation to the upstream router fails because the provider edge performs none for customer subnets. Peering with the provider over BGP does not meet the requirement if NAT is limited to server subnets, because ordinary workstations would remain untranslated; BGP is not a substitute for the needed NAT and access control policy. Skipping the default route fails because reachability toward the appliance does not give the appliance a path to internet destinations it has never seen. Confirm which interface is the outside path when configuring NAT and policy, then verify that permitted host traffic is translated and routed out.