An FTD publishes a web server at 10.10.5.20 through 203.0.113.20 while inside hosts need PAT for internet access. During a maintenance window, a broad manual rule that PATs any source to the outside interface address and matches both outbound and inbound packets was added to the NAT policy. Internet users then stopped reaching the published address while outbound access kept working. Which change to the NAT policy restores the inbound translation?
Select an answer to reveal the explanation.
Short Explanation
NAT rules work like a line at checkout: the first rule that matches gets handled first. Put the published server’s static rule above the broad PAT rule so your inbound traffic gets translated correctly; a more-specific rule lower down won’t jump the queue.
Full Explanation
The NAT policy is evaluated from the top, and the first rule whose conditions match the packet is applied. In this scenario, the broad rule matches the inbound request aimed at 203.0.113.20 before the static rule does, so the request does not receive the intended static translation. Moving the static rule above the broad rule lets it handle inbound traffic, while the broad rule remains available for inside hosts’ outbound PAT. Adding a second static rule below the broad rule does not apply two translations in sequence. NAT does not rank rules by specificity, so adding conditions to a lower rule does not make it take precedence over an earlier matching rule. After reordering, test traffic to the published address and confirm the static translation, then verify that inside hosts still egress through PAT.