NSE4 Firewall Policies and NAT Practice Question
A company has a web server in the DMZ that needs to be accessible from the internet on port 443 (HTTPS). The administrator configures a Virtual IP (VIP) mapping the public IP 203.0.113.10 to the private IP 10.0.1.10 port 443. Which firewall policy is required to allow inbound traffic?
⚠ Common exam trap
Candidates often assume a VIP automatically permits traffic or that the policy should use the private IP, but FortiGate requires an explicit firewall policy referencing the VIP object to allow inbound traffic through the NAT mapping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A policy from WAN to DMZ with source any, destination VIP, and action ACCEPT
When a Virtual IP (VIP) is configured in FortiGate, the firewall policy must reference the VIP object as the destination, not the actual private IP. The VIP translates the public IP (203.0.113.10) to the private IP (10.0.1.10), and the policy from WAN to DMZ with destination VIP ensures that inbound traffic is matched and permitted before NAT translation occurs. Without this policy, the VIP alone does not allow traffic; it only defines the translation rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A policy from WAN to DMZ with source any, destination IP of the server (10.0.1.10), and action ACCEPT
Why it's wrong here
In FortiOS, security policy lookup is performed on the original packet headers before any destination NAT occurs. Traffic from the internet arrives with the destination IP set to the VIP's public address, not the internal server's 10.0.1.10. Therefore, a policy whose destination is 10.0.1.10 will never match the inbound connection, and the packet is dropped. The policy must reference the VIP object or its public IP.
- ✓
A policy from WAN to DMZ with source any, destination VIP, and action ACCEPT
Why this is correct
This is the correct way to publish a server. The VIP object defines the public-to-private IP mapping, and the policy uses that VIP as the destination to explicitly allow inbound traffic. After the policy is matched, FortiOS performs destination NAT, replacing the VIP IP with the server's private IP and forwarding the packet to the DMZ. This ensures that all traffic is inspected and controlled by the firewall.
- ✗
No firewall policy is needed; the VIP automatically allows traffic
Why it's wrong here
A VIP is only a NAT translation table entry; it does not create any access permission. FortiOS firewalls operate on a default-deny model, so a separate policy is mandatory to permit traffic to pass. Configuring a VIP without an associated WAN-to-DMZ policy will result in the traffic being silently dropped, because the VIP does not bypass the security policy engine.
- ✗
A policy from DMZ to WAN with source VIP, destination any, and action ACCEPT
Why it's wrong here
This policy has the direction reversed: it would apply to connections initiated by the DMZ server heading out to the internet, not to external clients attempting to reach the server. Furthermore, VIPs are designed as destination NAT objects and using a VIP as a source address in a policy is unusual and does not represent the original client traffic. Creating this policy neither allows inbound connections nor affects the traffic flow from WAN to the VIP.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.