Free Preparation Discussions
MENU
Palo Alto Networks SD-WAN-Engineer Exam - Topic 3 Question 8 Discussion
Topic #: 3
A customer wants to deploy Prisma SD-WAN ION devices at small home offices that use consumer-grade broadband routers. These routers typically use Symmetric NAT and do not allow static port forwarding.
Which standard mechanism does Prisma SD-WAN utilize to successfully establish direct Branch-to-Branch (Dynamic) VPN tunnels through these Symmetric NAT devices?
Comprehensive and Detailed Explanation
Prisma SD-WAN utilizes STUN (Session Traversal Utilities for NAT) to facilitate NAT Traversal for its Secure Fabric overlay.
Discovery: When an ION device connects to the internet behind a NAT router, it reaches out to the Prisma SD-WAN Controller. The controller acts as a STUN server, identifying the public IP address and port that the ION's traffic is originating from.
Symmetric NAT Challenge: In Symmetric NAT, the mapping changes for every destination. However, the Prisma SD-WAN architecture is designed to handle this by having the controller coordinate the connection attempt.
Hole Punching: The controller shares the discovered public mapping information between two peer ION devices. They then simultaneously initiate traffic to each other's public IP/Port (a technique called 'UDP Hole Punching'). This tricks the intermediate NAT devices into allowing the inbound traffic, establishing a direct P2P IPSec tunnel without requiring manual port forwarding or static IPs at the edge.
Coral
14 hours agoTonja
6 days agoLouvenia
11 days agoBulah
16 days agoPansy
21 days agoJolene
26 days agoNell
1 month agoBarbra
1 month agoWilliam
1 month agoFrederick
2 months agoArtie
2 months agoPete
2 months agoTherese
2 months agoTruman
4 months agoPortia
4 months agoHuey
4 months agoAlysa
4 months agoReta
4 months agoHailey
4 months agoJina
5 months agoOdette
5 months agoGeorgiana
5 months agoJesusita
5 months agoEdda
5 months agoSuzi
5 months ago