Without NAT, your home or office would run out of internet addresses within minutes, and every device would be directly exposed to the entire internet. NAT is the clever translation system that lets thousands of devices share a handful of public addresses while keeping your internal network hidden and secure. For the NSE4 exam, you must understand exactly how FortiGate configures this translation — it is tested heavily in both the multiple-choice and simulation sections.
Jump to a section
A simple way to picture Network Address Translation (NAT)
A large apartment building with hundreds of residents but only one street address.
Every resident has their own apartment number (private IP address), but the outside world only knows the building's single street address (public IP address). When a package arrives from Amazon, the mailroom clerk checks the apartment number on the package, writes the building's address as the return address, and sends it out. When a package comes in addressed to the building, the clerk reads the apartment number, finds the correct mailbox, and delivers it. The clerk keeps a logbook: for every outgoing package, they note the sender's apartment number, the destination, and which temporary slot they used in the outgoing bin. When the reply comes back, they look up the slot number, find the matching apartment, and deliver it. If the clerk is out sick, packages pile up at the door, and nobody knows which flat they belong to. The building manager can also set up special rules: any package addressed to 'Management Office' always goes to Apartment 1A (a virtual IP), and packages for the old building number (before it was renumbered) get forwarded to the correct apartment (port forwarding). One resident might get their own dedicated street address (one-to-one NAT) so all their personal mail goes directly to them without passing through the mailroom. This system lets hundreds of residents share one street address, keeps their individual apartment numbers private, and ensures every package reaches the right person.
Network Address Translation (NAT) is the process of changing the source or destination IP address in a data packet as it passes through a FortiGate firewall. Think of an IP address as a phone number for your computer. Every device on a network needs a unique IP address to send and receive data. But public IPv4 addresses are scarce — there are only about 4.3 billion possible addresses, and the world has many more devices than that. So private IP addresses were created for internal use (like 192.168.1.1, 10.0.0.1, or 172.16.0.1), and NAT translates those private addresses into one or more public addresses when traffic leaves your network.
There are two main types of NAT tested in NSE4: Source NAT (SNAT) and Destination NAT (DNAT). Source NAT changes the source IP address of outgoing packets. When you browse a website from your laptop, your laptop has a private IP like 192.168.1.10. The FortiGate rewrites that source address to its own public IP (like 203.0.113.5) before sending the packet to the website. The website replies to that public IP, and the FortiGate remembers which laptop made the request, reverses the translation, and delivers the reply. This is called 'hide NAT' or 'masquerade' because all internal devices are hidden behind one address.
Destination NAT changes the destination IP address of incoming packets. If you host a web server inside your network with a private IP of 192.168.1.50, outsiders cannot reach it directly. You configure DNAT on the FortiGate so that when someone from the internet sends a packet to your public IP (203.0.113.5) on port 80, the FortiGate changes the destination to 192.168.1.50:80 and forwards it. This is often called 'port forwarding'.
NAT Pools are a set of public IP addresses that FortiGate can use for Source NAT. Instead of using just one public IP, you can define a range (like 203.0.113.10 to 203.0.113.20). FortiGate picks an address from the pool for each new connection, which helps when you have many simultaneous connections or need to match specific outbound traffic to certain public IPs for compliance or whitelisting reasons.
Virtual IPs (VIPs) are the FortiGate object that defines a Destination NAT rule. When you create a Virtual IP, you specify a mapped IP (the public IP and port that outsiders see) and a destination IP (the private IP and port on your internal server). You then use that VIP in a firewall policy to allow inbound traffic. One-to-One NAT is a special mode where one public IP is mapped permanently to one private IP. For example, if you want a specific internal server to always appear as a specific public address — not sharing with other devices — you configure one-to-one NAT. This is common for email servers or VPN gateways that need to be reachable from the internet.
FortiGate also supports Central NAT, which is a centralised way to define NAT rules separately from firewall policies, but for NSE4, the traditional policy-based NAT is the core focus. Every NAT rule must be paired with a firewall policy that permits the traffic. Without the policy, the NAT rule does nothing. The sequence is: firewall policy checks first, then NAT translation applies.
NAT works at the network layer (Layer 3) of the OSI model. It modifies the IP header, and for some protocols, it also adjusts the port numbers in the TCP or UDP header. FortiGate maintains a session table — a list of all active connections — to keep track of which internal IP is using which translated port and public IP. This session table is why replies find their way back. Without it, return traffic would be dropped because the firewall would not know where to send it.
Why does this matter for security? Because NAT hides your internal structure. An external attacker sees only the public IP of the FortiGate, not the private IP of your laptop or database server. This makes direct attacks on internal devices much harder. NAT also conserves public IP addresses, which is why every home router uses it. For the exam, you need to understand the difference between SNAT and DNAT, how to configure NAT pools, how to create and apply Virtual IPs, and when to use one-to-one NAT versus many-to-one (hide) NAT.
Define the Purpose of the NAT Rule
Determine if you need Source NAT (for outbound traffic from internal users to the internet) or Destination NAT (for inbound traffic from the internet to internal servers). This step decides whether you will create a NAT pool or a Virtual IP.
Create the NAT Pool or Virtual IP Object
For Source NAT, configure a NAT Pool and specify the range of public IP addresses available for translation. For Destination NAT, create a Virtual IP object and map the external IP/port to the internal private IP/port. This object is referenced later in the firewall policy.
Build the Firewall Policy with NAT Action
Create a firewall policy that defines the source and destination interfaces (e.g., from internal to WAN). For Source NAT, enable NAT in the policy and select the NAT pool. For Destination NAT, disable NAT on the policy (unless you also need source NAT) and set the destination to the Virtual IP object.
Add Security Policies and Logging
Configure the security profiles (like antivirus, web filtering) on the policy to protect traffic. Enable logging to capture successful and failed connection attempts for troubleshooting and auditing.
Test and Verify the NAT Configuration
Use tools like ping, traceroute, or accessing a web page from internal devices to confirm outbound traffic shows the correct public IP. For inbound, try reaching the public IP/port from an external network and verify it reaches the internal server. Check the FortiGate session table (diagnose sys session list) to see the translated addresses.
An IT professional at a medium-sized company, Acme Corp, needs to set up FortiGate so employees can access the internet and external customers can reach the company's web server.
First, the IT admin logs into the FortiGate web interface. The office has 200 desktops and laptops, each with a private IP from the 10.10.10.0/24 range. The company has five public IP addresses from their ISP: 203.0.113.100 to 203.0.113.104. The admin's first task is to configure Source NAT so all 200 devices can browse the web. They create a NAT Pool called 'Internet-Pool' containing the five public IPs. Then they create a firewall policy from the internal network to the internet (WAN interface) and enable NAT, selecting the 'Internet-Pool'. FortiGate will now pick an available public IP from the pool for each outbound connection, cycling through them to avoid exhausting ports on any single address.
Next, they need to make the internal web server (10.10.10.50:80 and 443) reachable from the internet. They create a Virtual IP object named 'Web-VIP' with an external IP of 203.0.113.101 on ports 80 and 443, mapped to internal IP 10.10.10.50 on the same ports. Then they create a firewall policy from the WAN interface to the internal network, using the Web-VIP as the destination. The policy permits HTTP and HTTPS traffic. Now, when a customer types http://203.0.113.101, the FortiGate sees the incoming packet, matches the Web-VIP rule, translates the destination to 10.10.10.50, and forwards the traffic.
The admin also has a special requirement: the CEO's laptop (10.10.10.100) must always use a specific public IP (203.0.113.104) for outbound traffic because a partner firewall whitelists only that address. They configure a one-to-one NAT rule: map private IP 10.10.10.100 permanently to public IP 203.0.113.104. This ensures all traffic from the CEO's laptop appears to come from that specific public IP.
Troubleshooting NAT issues is common. If users complain they cannot reach a certain website, the admin checks:
The NSE4 exam tests NAT heavily in objective 3.2, which covers about 8-10% of the total exam. Expect multiple-choice questions, drag-and-drop configuration ordering, and simulation-based scenarios where you must configure NAT rules on a virtual FortiGate.
Key concepts the exam loves to test:
Source NAT changes the source IP of outgoing packets so internal private addresses are hidden behind one or more public IPs.
Destination NAT changes the destination IP of incoming packets so external users can reach internal servers through a public IP.
A NAT pool is a group of public IP addresses used for Source NAT, selected dynamically by FortiGate for outbound connections.
A Virtual IP (VIP) defines a Destination NAT mapping from a public IP/port to a private IP/port.
One-to-one NAT creates a permanent bidirectional mapping between one private IP and one public IP, unlike hide NAT which is many-to-one and outbound only.
Every NAT rule must be paired with a firewall policy that permits the traffic; NAT alone does not allow traffic to pass.
Firewall policies and NAT rules are configured separately in FortiGate, and the exam will test your ability to order and link them correctly.
The session table is critical for NAT return traffic — without it, replies cannot be reverse-translated to the correct internal device.
Central NAT and policy-based NAT are two methods; NSE4 focuses on policy-based NAT as the primary method.
NAT conserves public IPv4 addresses and provides a basic security layer by hiding internal network structure.
These come up on the exam all the time. Here's how to tell them apart.
Source NAT (SNAT)
Changes the source IP of packets leaving the network
Used for outbound traffic from internal devices to the internet
Uses NAT pools to define available public IP addresses
Destination NAT (DNAT)
Changes the destination IP of packets entering the network
Used for inbound traffic from the internet to internal servers
Uses Virtual IPs (VIPs) to define the public-to-private mapping
NAT Pool
A group of public IPs used for Source NAT
FortiGate picks an address dynamically from the pool for each connection
Defined separately and referenced in firewall policy as the source NAT address
Virtual IP (VIP)
A single mapping of public IP/port to private IP/port for Destination NAT
Usually a one-to-one fixed mapping (though port-based NAT supports many-to-one with different ports)
Defined as an object and used as the destination in a firewall policy
Many-to-One NAT (Hide NAT)
Many internal private IPs share one or a few public IPs
Unidirectional: only tracks outbound sessions; unsolicited inbound is blocked by default
Saves public IP addresses and hides internal devices
One-to-One NAT
One private IP is permanently mapped to one public IP
Bidirectional: inbound and outbound traffic both use the same static mapping
Used for servers that need a fixed public address (e.g., email, VPN)
Policy-Based NAT
NAT is configured as an action within a firewall policy
Traditional method; easier for simple setups
Each policy can have its own NAT rules specific to that traffic flow
Central NAT
NAT rules are defined separately from firewall policies in a central NAT table
Newer method; provides more granular control and easier management of large rule sets
The central NAT table is evaluated after the firewall policy match
Mistake
NAT and firewall policies are the same thing; enabling NAT automatically allows traffic.
Correct
NAT and firewall policies are separate. A firewall policy must explicitly permit the traffic, and then NAT is applied as an action within that policy (or via Central NAT). Without a permit policy, no traffic flows even if NAT is configured.
New learners see that both are configured on the FortiGate and assume one implies the other. The exam deliberately tests this by presenting scenarios where NAT is set but the policy is missing, and the candidate must identify why traffic fails.
Mistake
Source NAT changes the destination IP address of outgoing packets.
Correct
Source NAT changes the source IP address in the packet header (the 'from' address). Destination NAT changes the destination IP address (the 'to' address). Confusing these is a common exam trap.
The names 'source NAT' and 'destination NAT' sound similar, and beginners often mix up which part of the packet gets modified.
Mistake
One-to-one NAT means a private IP is translated to a public IP only when traffic is going out; it is the same as hide NAT.
Correct
One-to-one NAT creates a permanent one-to-one mapping between a private IP and a public IP, and it works bidirectionally (both outgoing and incoming). Hide NAT (many-to-one) uses a single public IP for many private IPs and is unidirectional for outbound only.
The phrase 'one-to-one' sounds like it just means one private IP maps to one public IP, which is technically true, but beginners miss that it is bidirectional and not the same as the more common many-to-one hide NAT.
Mistake
You do not need a firewall policy if you only want to use DNAT (port forwarding) because the VIP itself handles everything.
Correct
A Virtual IP only defines the translation mapping. To allow the inbound traffic, you must still create a firewall policy that permits the traffic and references the VIP as the destination.
Many GUI systems in other vendors combine port forwarding and firewall rules into one step. FortiGate keeps them separate, so candidates forget the second step.
Mistake
NAT pools are only used for Destination NAT.
Correct
NAT pools are used for Source NAT, to provide a set of public IPs that outbound connections can use. Destination NAT uses Virtual IPs, not NAT pools (though pools can be used in some DNAT scenarios for load balancing, that is not the core NSE4 focus).
The word 'pool' sounds like a generic resource, so candidates assume it applies to both directions. The exam tests this distinction explicitly.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Source NAT changes the source IP address of outgoing packets (usually from a private IP to a public IP so you can access the internet). Destination NAT changes the destination IP address of incoming packets (so external users can reach a server inside your private network).
Yes. NAT only translates addresses; it does not permit traffic. You must have a firewall policy that allows the traffic and references the NAT configuration (either as an action within the policy or by using a Virtual IP as the destination).
A NAT pool is a set of public IP addresses that FortiGate can use for Source NAT. Use a pool when you need more outbound connections than a single public IP can handle (because each IP has a limited number of port numbers) or when different internal traffic must appear from different public IPs for compliance reasons.
A Virtual IP is an object that defines a Destination NAT rule. It maps an external public IP and port to an internal private IP and port. You then use that VIP in a firewall policy to allow inbound traffic to reach the internal server.
FortiGate keeps a session table (also called a connection table) that records the original source IP and port, the translated source IP and port, and the destination. When a reply comes back, it looks up the translated port in the session table and reverse-maps it to the original internal device.
One-to-one NAT creates a permanent mapping between one private IP and one public IP. It is bidirectional: traffic from the private IP always uses that public IP, and traffic to that public IP always reaches the private IP. It is used for servers that need a predictable public address, like an email or VPN server.
You've finished Network Address Translation (NAT). Continue through the NSE4 study guide to build a complete picture of the exam.
Done with this chapter?