Explain why the lab's Internet ping tests fail before Source NAT and are expected to work after Source NAT is configured.

### What a good answer covers - Before translation, the outgoing packet retains the originating host's source address. - The lab notes that an Internet host would not directly respond to an Internal host in this setup. - Source NAT changes the outbound source address to the firewall's Internet interface address. - The lab tests both Internal and DMZ Internet access after their NAT rules are configured and committed. ### The concept A ping uses Internet Control Message Protocol (ICMP) echo messages, but successful communication also depends on addressing and policy. Source NAT makes outbound traffic use the firewall interface address specified by the lab. The destination host can then respond to the translated address rather than trying to reply directly to the original internal address. This explains the lab's expected result without implying that NAT alone grants policy permission. ### Terms - **ICMP**: Internet Control Message Protocol. A network protocol used for messages such as ping requests and replies. - **Commit**: Apply the configured firewall changes so they take effect. ### Remember For outbound access, verify both that policy permits the traffic and that Source NAT provides the intended source address.