You have deployed an SRX Series device at your network edge to secure Internet-bound sessions for your local hosts using source NAT. You want to ensure that your users are able to interact with applications on the Internet that require more than one TCP session for the same application session.Which two features would satisfy this requirement? (Choose two.)
Answer(s): A,C
Address persistence ensures that the same NAT IP address is used for all sessions originating from a single source IP. Persistent NAT maintains connections for applications needing multiple sessions, like VoIP. Additional details are available in Juniper NAT Documentation.For applications that require multiple TCP sessions for the same application session (such as VoIP or certain online games), the SRX device needs to handle NAT properly to maintain session continuity.Here's what helps:Address Persistence (Answer A): Address persistence ensures that multiple sessions initiated by the same internal host are mapped to the same external IP address. This is crucial for applications that use multiple TCP sessions to maintain a stateful connection with the external server.Command Example:bash set security nat source persistent-nat address-persistence Persistent NAT (Answer C): This feature allows the external server to initiate new connections to the internal client using the same NAT translation. It's essential for applications that require consistent NAT mappings across multiple sessions.Command Example:bash set security nat source persistent-nat permit target-host-port These features ensure that applications with multiple TCP sessions work seamlessly across NAT.
Juniper NAT and persistent NAT documentation.
Referring to the exhibit,which statement about TLS 1.2 traffic is correct?
Answer(s): A
You have an initial setup of ADVPN with two spokes and a hub. A host at partner Spoke-1 is sending traffic to a host at partner Spoke-2.In this scenario, which statement is true?
Referring to the exhibit,which two statements about User1 are true? (Choose two.)
Answer(s): A,B
In this configuration, User1 is logged into logical system LSYS-1, which restricts access and visibility to that particular system. This ensures isolation between logical systems on the same physical device. Only a system administrator can assign additional permissions. For more details, see Juniper Logical Systems Guide.From the exhibit, we see that User1 is logged into logical system LSYS-1:Access to Assigned Logical System (Answer A): User1, being logged into the logical system LSYS-1, only has access to the configuration and interfaces within that logical system. This is a key feature of logical systems in Junos, ensuring users are restricted to their respective environments. Logged into LSYS-1 (Answer B): The prompt shows that User1 is currently operating in LSYS-1, as indicated by the User1@SRX:LSYS-1> command line.
Juniper logical systems configuration and user permissions.
Exhibit:You are asked to ensure that Internet users can access the company's internal webserver using itsFQDN. However, the internal DNS server's A record only points to the webserver's private address. Referring to the exhibit, which two actions are required to complete this task? (Choose two.)
Answer(s): B,D
In the scenario where internal users are trying to access the company's web server via its FQDN but the DNS server resolves to a private IP, two key actions are needed:Static NAT (Answer B): Since the internal DNS server resolves the web server to its private IP address (10.10.10.4/24), you need to configure static NAT for both the DNS server and the webserver. This will ensure that requests coming from the internet will be translated to the web server's public IP (203.0.113.4) and the DNS server's public IP (203.0.113.2).Example Command:bash set security nat static rule-set public-to-private from zone untrust set security nat static rule-set public-to-private rule dns-server match destination-address 203.0.113.2/32set security nat static rule-set public-to-private rule dns-server then static-nat-prefix 10.10.10.2/32 set security nat static rule-set public-to-private rule web-server match destination-address 203.0.113.4/32set security nat static rule-set public-to-private rule web-server then static-nat-prefix 10.10.10.4/32 Proxy ARP (Answer D): The SRX needs to respond to ARP requests for the public IP addresses of both the DNS and webserver on the interface facing the internet (ge-0/0/3). This allows the SRX to handle requests directed at the public IPs.Example Command:set interfaces ge-0/0/3 unit 0 family inet proxy-arp interface-address 203.0.113.2/32set interfaces ge-0/0/3 unit 0 family inet proxy-arp interface-address 203.0.113.4/32 These two configurations allow external users to access the internal web server via its public IP, as resolved by the DNS server.
Juniper NAT and proxy ARP documentation.
Post your Comments and Discuss Juniper JN0-637 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the JN0-637 content, but please register or login to continue.