Palo Alto Networks (PANW) Certified Network Security Administrator (PCNSA) Practice Exam

What is true about the traffic when configured with a two-zone U-Turn NAT rule allowing access from Trust-L3 to Untrust-L3?

1. The traffic is considered inter-zone

2. The traffic is considered intra-zone

3. The traffic cannot traverse the firewall

4. The traffic is dropped by default policies

The correct answer is: The traffic is considered intra-zone

In a two-zone U-Turn NAT configuration allowing access from Trust-L3 to Untrust-L3, the traffic is classified as intra-zone. This is because the design of the U-Turn NAT allows traffic to be translated and routed back into the same zone from which it originated after it has been processed. In other words, the U-Turn NAT enables a packet that is going to the Untrust-L3 zone to be redirected back to the Trust-L3 zone while maintaining the original source zone in the process. This specific flow of traffic does not change zones; instead, it is deemed to stay within the same zone from the firewall’s perspective. This is distinct from inter-zone traffic, which typically refers to communication between different zones, such as from Trust to Untrust directly without any U-Turn mechanism. The notion of the traffic being dropped by default policies or unable to traverse the firewall is not applicable here, as the configuration specifically allows for this unique handling of the traffic between the zones in question.