NSE4 Firewall Policies and NAT Practice Question
A FortiGate admin creates a new firewall policy with source address object 'Internal_Net' and destination 'All'. After saving, traffic from 'Internal_Net' is not matching the new policy but instead matches an older policy with a broader source. What is the MOST likely cause?
⚠ Common exam trap
Candidates often assume a newly created policy will automatically take precedence over older policies, but FortiGate requires manual reordering to enforce policy priority, unlike some vendors that use a most-specific-match logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The new policy is placed below the older policy in the policy list
A FortiGate firewall evaluates policies sequentially from top to bottom, applying the first match. If the new policy is placed below an older policy with a broader source definition, traffic from 'Internal_Net' will match the older policy first and never reach the new policy. Therefore, option B is the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source address object 'Internal_Net' has an incorrect subnet mask
Why it's wrong here
An incorrect subnet mask in the source address object changes the range of IP addresses the policy claims to match. If the mask is too broad or too narrow, traffic from the intended hosts may not match this policy, and FortiGate will continue evaluating subsequent policies. That could lead to an older policy matching if it covers the same source range, but the mask itself does not force a match to an older policy; the traffic could equally fall through to the implicit deny if no other policy matches. Thus, the symptom of always matching an older policy is more directly explained by policy order, not by a bad mask.
- ✓
The new policy is placed below the older policy in the policy list
Why this is correct
FortiGate firewall policies are evaluated sequentially from the top of the policy list downward, and the first policy whose source, destination, and service match the packet is applied. If the new policy is created below an older, broader policy that also matches the same traffic, the older policy will intercept the traffic before the new policy is ever considered. This first-match behavior is the reason traffic appears to hit the older policy, regardless of the new policy's content. The fix is to move the new policy above the older one in the policy list.
- ✗
The new policy is disabled
Why it's wrong here
A disabled policy is treated as nonexistent during the lookup process: FortiGate skips it entirely and evaluates the next policy in order. If the new policy were disabled, it would simply not match any traffic, so the packet would continue down the policy list and could match an older policy—but that is a passive consequence, not a direct effect. The real problem is the relative position of the policies: even if the new policy were enabled, it would still be skipped if placed below a broader matching policy. Therefore, a disabled policy alone cannot explain why the older policy is consistently matched.
- ✗
Traffic shaping is applied to the new policy and is interfering
Why it's wrong here
Traffic shaping is a QoS feature applied after a policy has been selected, and it controls bandwidth, priority, and guaranteed throughput. It does not influence the policy-matching algorithm, which relies solely on the order and matching criteria of policies. Even if the new policy has a traffic-shaping profile attached, it will still be evaluated in its position in the policy list; if an older policy above it matches first, the traffic will never reach the shaping rule. Thus, traffic shaping cannot be the cause of the older policy being used.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.