Free Preparation Discussions
MENU
Palo Alto Networks SD-WAN-Engineer Exam - Topic 3 Question 8 Discussion
Topic #: 3
A customer wants to deploy Prisma SD-WAN ION devices at small home offices that use consumer-grade broadband routers. These routers typically use Symmetric NAT and do not allow static port forwarding.
Which standard mechanism does Prisma SD-WAN utilize to successfully establish direct Branch-to-Branch (Dynamic) VPN tunnels through these Symmetric NAT devices?
Comprehensive and Detailed Explanation
Prisma SD-WAN utilizes STUN (Session Traversal Utilities for NAT) to facilitate NAT Traversal for its Secure Fabric overlay.
Discovery: When an ION device connects to the internet behind a NAT router, it reaches out to the Prisma SD-WAN Controller. The controller acts as a STUN server, identifying the public IP address and port that the ION's traffic is originating from.
Symmetric NAT Challenge: In Symmetric NAT, the mapping changes for every destination. However, the Prisma SD-WAN architecture is designed to handle this by having the controller coordinate the connection attempt.
Hole Punching: The controller shares the discovered public mapping information between two peer ION devices. They then simultaneously initiate traffic to each other's public IP/Port (a technique called 'UDP Hole Punching'). This tricks the intermediate NAT devices into allowing the inbound traffic, establishing a direct P2P IPSec tunnel without requiring manual port forwarding or static IPs at the edge.
Frederick
2 days agoArtie
7 days agoPete
12 days agoTherese
17 days agoTruman
2 months agoPortia
2 months agoHuey
2 months agoAlysa
3 months agoReta
3 months agoHailey
3 months agoJina
3 months agoOdette
3 months agoGeorgiana
3 months agoJesusita
4 months agoEdda
4 months agoSuzi
4 months ago