Chapter 5 of 11 · Huawei HCIA-Security H12-711
Firewall NAT Technologies
NAT basics, source NAT, destination NAT, bidirectional NAT, NAT ALG, NAT Server and server map.
- 3topics
- 18 minfast track
- 2diagrams and exhibits
- 10%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Overview of NAT and Source NATLearn why NAT exists and the USG source NAT types: NAT No-PAT, NAPT, Easy IP, Smart NAT and triplet NAT, with address pools and…Diagram6 min
- 2Destination NAT and Bidirectional NATLearn destination NAT on USG firewalls, static and dynamic mapping, and interzone and intrazone bidirectional NAT, with the…6 min
- 3NAT ALG and NAT ServerLearn NAT ALG, ASPF and server map entries for FTP and other multi-channel protocols, and how to publish servers with nat server…Diagram6 min
About this chapter
What this chapter covers
Firewall NAT Technologies is 10% of the Huawei HCIA-Security H12-711 exam. It covers why NAT exists, the source NAT types a USG firewall offers, destination NAT, bidirectional NAT, and the NAT ALG and NAT Server features that make multi-channel protocols and published servers work.
Questions are single-answer, multiple-answer without a stated count, true/false, drag and drop and typed fill-in-the-blank, often "Which of the following statements is true?". Many show a firewall topology figure with Trust, DMZ and Untrust zones, a nat-policy or nat server configuration, or display firewall session table and display firewall server-map output, and ask what the firewall will translate.
It has 5 outline topics, and three pages cover them.
How the topics fit together
NAT first solves the shortage of public IPv4 addresses for users going out, which is source NAT. Destination NAT and NAT Server then let outside users reach inside servers, and bidirectional NAT combines both when routing would otherwise break.
Every type is built on the same firewall ideas from the security policy chapter: the first packet creates a session, and later packets follow the session table.
Learn the processing order. On a USG firewall, NAT Server and destination NAT happen before the security policy check, and source NAT happens after it. That one fact answers most "which address goes in the security policy" questions.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read each configuration snippet and say what it does before reading the explanation. The exam often shows a short configuration and asks which traffic is permitted, translated or allowed to log in.
Ready for more practice?
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.