NSE4 Firewall Policies and NAT Practice Question
A FortiGate administrator configures a policy-based NAT using an IP pool with type 'Fixed Port Range' for internal users accessing a specific external server. Users report that after some time, they cannot establish new connections to the server. 'diagnose ip pool list' shows many entries with 'used_port=65535'. What is the MOST likely cause?
⚠ Common exam trap
Many candidates confuse IP address exhaustion (Option C) with port exhaustion, but the diagnostic output clearly shows IP addresses are still available while ports are maxed out, pointing directly to the fixed port range being too small.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The fixed port range is too small, causing port exhaustion
The 'Fixed Port Range' IP pool type allocates a specific range of ports per IP address for NAT translations. When all ports in the range are exhausted (indicated by 'used_port=65535'), no new connections can be established, causing the reported issue. This is classic port exhaustion, making D correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The external server is rate-limiting connections
Why it's wrong here
Server-side rate limiting is a remote condition that affects the application server's willingness to accept connections, typically resulting in resets, throttling, or timeouts at the L7 layer. It does not interact with the FortiGate's local NAT port allocation logic, so it cannot cause the IP pool to display 'used_port=65535'. That counter reflects the highest port number currently consumed from the fixed port range on the FortiGate itself, which is completely independent of how the server responds.
- ✗
The firewall policy has a timeout setting that is too low
Why it's wrong here
A firewall policy timeout (e.g., TCP or UDP idle timeout) controls how long an established session is kept alive without traffic before being removed from the session table. Lowering the timeout would cause sessions to be freed more quickly, potentially reducing port consumption over time, not exhausting it. The 'used_port=65535' value indicates that all ports in the fixed range are simultaneously occupied by active sessions, a capacity problem caused by a range that is too small, not by sessions timing out too slowly or too quickly.
- ✗
The IP pool has run out of IP addresses
Why it's wrong here
An IP pool running out of IP addresses means that no additional public IPs are available for allocation to new sessions. In fixed port range NAT, the pool may contain one or more IP addresses, but each IP has its own dedicated port range; the 'used_port=65535' field specifically identifies the port index within the current IP's range, not the IP index. If the pool were truly out of IPs, the FortiGate would generate an error indicating 'no IP address available' or similar, not show a specific port number like 65535, revealing that port exhaustion is the actual condition.
- ✓
The fixed port range is too small, causing port exhaustion
Why this is correct
Fixed port range NAT assigns a block of ports to each source IP. If the range is small (e.g., 1 port), it fills quickly and blocks new sessions. The 'used_port=65535' indicates the last port in a range is in use.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.