When configuring a Destination NAT (DNAT) rule on a Palo Alto Networks firewall to forward external traffic to an internal web server, which of the following is a correct configuration setting? (Select all that apply)

### Why this is right - **Source zone is Internet** is true: the inbound request originates in the Internet zone. - **Destination zone is Internet** is true: the original packet is addressed to the firewall's Internet-facing side. - **Destination interface is ethernet1/1** is true: the lab selects that interface. - **Service is service-http** is true: this rule matches HTTP traffic. - **Original destination address is the firewall's 10.xx.xx.253 address** is true: the lab uses this address as the public-facing destination to match. - **Translated destination address is 172.16.10.10** is true: this is the DMZ web server. ### The concept The Original Packet section identifies incoming traffic before translation. The Translated Packet section specifies the new destination address. The lab's HTTP rule uses Static IP destination translation, not Dynamic IP and Port source translation. ### The other options - **G. Translated source uses Dynamic IP and Port**: that setting belongs to the outbound Source NAT example, not this Destination NAT rule. ### Terms - **Static IP**: A translation setting that maps a destination to the specified address. - **HTTP**: Hypertext Transfer Protocol, a web communication protocol. ### Remember An inbound port-forwarding rule matches the external destination and translates it to the internal server.