In the lab's Internet-Web-to-DMZ rule, what does Destination NAT do?

### Why this is right The lab maps traffic sent to the firewall's Internet-facing address to the DMZ web server at 172.16.10.10. That is destination-address translation. ### The concept Destination NAT modifies the destination address of a packet, allowing an externally addressed connection to be forwarded to a server on another network. The lab calls this port forwarding. It differs from Source NAT, which modifies the sender's source address for outbound access. A separate security policy is still needed to permit the relevant traffic. ### The other options - **B. Changes the DMZ server's source address to the Internal workstation**: this describes neither the configured destination mapping nor its direction. - **C. Permits every Internet host to initiate a connection to Internal**: Destination NAT does not create a general security permission. - **D. Changes the destination zone from Internet to Internal**: NAT translates addresses; it does not simply redefine a zone. ### Terms - **Destination NAT**: Destination Network Address Translation. Translation that changes a packet's destination address. - **Port forwarding**: Forwarding traffic addressed to an external-facing endpoint to a selected internal service or server. ### Remember For inbound web-server access, Destination NAT changes the destination to the server's address.