Explain why the lab's Destination NAT rule uses Internet as both the original source zone and original destination zone.

### What a good answer covers - The packet comes from an Internet host, so its original source zone is Internet. - It is initially addressed to the firewall's Internet-facing address, so the original destination zone is also Internet. - The NAT rule translates the original destination to the DMZ server at 172.16.10.10. - NAT matching describes the original packet; the translated destination describes the forwarded target. ### The concept A firewall evaluates NAT rules using the packet's original attributes and then applies the configured translation. The lab's Internet-to-Internet original-packet selection may seem unexpected because the server is in the DMZ, but the packet is first sent to the firewall's Internet-side address. The security policy and NAT rule have related but distinct roles in enabling access to the server. ### Terms - **Original packet**: The packet as it arrives before the NAT rule changes an address. - **Translated destination**: The destination address after Destination NAT is applied. ### Remember For NAT matching, consider where the packet is addressed before translation.