A destination NAT policy is configured as follows to allow inbound access to an internal server in the DMZ: Source zone: Outside and source IP…

For inbound traffic subject to Destination NAT, the Palo Alto Networks firewall evaluates the Security policy using the packet's state after the NAT translation has occurred. The firewall first matches the packet against the NAT policy, translating the original destination IP (2.2.2.1) to the final, internal IP (10.10.10.1). It then performs a route lookup on this new destination IP (10.10.10.1) to determine the egress interface and its corresponding zone (DMZ). The Security policy lookup occurs last, using the post-NAT destination IP and post-NAT destination zone. Therefore, the policy must specify the destination as Zone DMZ and IP address 10.10.10.1.

A. Destination Zone Outside, Destination IP address 10.10.10.1: The destination zone is incorrect. The firewall uses the post-NAT zone (DMZ), not the original ingress zone (Outside), for the security policy match.
B. Destination Zone DMZ, Destination IP address 2.2.2.1: The destination IP address is incorrect. The security policy is evaluated against the post-NAT IP address (10.10.10.1), not the pre-NAT address.
C. Destination Zone Outside, Destination IP address 2.2.2.1: Both the zone and IP address are incorrect. These represent the pre-NAT destination, which is not used for the Security policy lookup in this scenario.

1. Palo Alto Networks

PAN-OS® Administrator’s Guide 11.0

"Destination NAT" section.

Under the "Destination NAT" subsection

the guide states: "When you configure a destination NAT rule

you must also configure a Security policy rule that allows the traffic to the post-NAT destination zone and address." This directly supports using the post-NAT zone (DMZ) and address (10.10.10.1).

2. Palo Alto Networks

PAN-OS® Administrator’s Guide 11.0

"NAT Policy Rules" section.

The documentation specifies

"For destination NAT

the security policy rule is based on the original source zone and the post-NAT destination zone." This confirms that the destination zone in the security policy must be the final zone (DMZ).

3. Palo Alto Networks

"Packet Flow Sequence in PAN-OS®" Technical Documentation.

The packet flow diagram for session setup (slow path) shows that the NAT policy lookup (Step 6) and Forwarding/Route lookup (Step 7) occur before the Security policy lookup (Step 8). This confirms the firewall determines the final destination IP and zone before evaluating the security policy.