2V0-41.24 Question 374
Select 2You are managing a VMware NSX-T environment for a multi-tier application. The web tier VMs are deployed in a private subnet (192.168.10.0/24) and need to communicate with external users over the internet. To achieve this, you configure Source NAT (SNAT) on the Tier-1 Gateway. Which of the following steps is essential to properly configure SNAT in this scenario?
- A
Create an SNAT rule on the Tier-1 Gateway, specifying the private subnet as the source and a public IP as the translated address.
- B
Enable NAT on the Tier-0 Gateway to ensure proper routing of SNAT traffic to external networks.
- C
Attach the logical switch for the private subnet to the Tier-1 Gateway.
- D
Specify the public IP address used for SNAT as part of a pool in the Tier-1 Gateway configuration.
- E
Create a DNAT rule on the Tier-1 Gateway to allow external users to access the private subnet.
Show answer and explanation
Correct answers: A, C
Explanation
To enable outbound communication from the private subnet to the internet, you must configure SNAT on the Tier-1 Gateway. This includes creating an SNAT rule with the private subnet as the source and a public IP address for translation. Additionally, the logical switch for the private subnet must be attached to the Tier-1 Gateway to ensure traffic reaches the SNAT rule for processing. Other options, such as enabling NAT on the Tier-0 Gateway or using DNAT, do not align with the specific requirements of SNAT in this scenario.
- A. Correct.
Correct. Creating an SNAT rule on the Tier-1 Gateway with the private subnet as the source and a public IP as the translated address is necessary to allow outbound traffic from the private subnet to the internet.
- B. Incorrect.
Incorrect. NAT functionality is handled at the Tier-1 Gateway in this scenario, not the Tier-0 Gateway. Enabling NAT on the Tier-0 Gateway is unnecessary for SNAT in this context.
- C. Correct.
Correct. The logical switch for the private subnet must be attached to the Tier-1 Gateway to ensure traffic from VMs in the private subnet can be processed by the SNAT rule.
- D. Incorrect.
Incorrect. While you can use a public IP pool for SNAT, explicitly specifying a single public IP address in the rule is sufficient and more relevant to this scenario.
- E. Incorrect.
Incorrect. DNAT is used for inbound traffic to allow external users to access internal resources, which is not the requirement in this scenario focused on outbound communication.