NSE4 Firewall Policies and NAT Practice Question
A FortiGate administrator is configuring a Virtual IP (VIP) to allow external users to access an internal web server (192.168.1.10) using the public IP 203.0.113.10 on port 80. The admin creates a VIP with mapped IP 192.168.1.10 and port 80. A firewall policy is created from WAN to DMZ with destination set to the VIP. External users report that they can access the web server. What additional step is needed to allow the internal server to respond correctly?
⚠ Common exam trap
It's easy for candidates to think a separate outbound policy or NAT rule is required for return traffic, but FortiGate's stateful firewall and implicit reverse NAT handle this automatically, making additional policies or VIPs unnecessary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No additional step is needed; the FortiGate automatically performs reverse NAT for established sessions
When a FortiGate performs destination NAT (DNAT) via a VIP for inbound traffic, it automatically creates a session entry that includes the reverse NAT mapping. For return traffic from the internal server, the FortiGate uses this session to perform source NAT (SNAT) back to the original public IP (203.0.113.10). This is called 'implicit reverse NAT' and requires no additional configuration; the session state ensures the reply packets are correctly translated and forwarded to the external client.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
No additional step is needed; the FortiGate automatically performs reverse NAT for established sessions
Why this is correct
No additional configuration is required because FortiGate's session table maintains bidirectional state for every translated flow. When a server responds to a VIP-mapped connection, the FortiGate identifies the session via the 5-tuple, performs the reverse DNAT, and rewrites the source IP back to the original VIP address. This automatic reverse NAT is inherent to stateful inspection, so any manual return-path setup is unnecessary.
- ✗
Create a second VIP for the return traffic
Why it's wrong here
A VIP is an inbound destination NAT construct used only for new connections arriving from the outside. Return traffic initiated by the internal server is part of an already-established session, not a new inbound connection, so no second VIP is needed. Creating an additional VIP would only cause redundant translation rules and could disrupt the session's state by mismatching the expected return flow.
- ✗
Add a policy from DMZ to WAN allowing the internal server to reply
Why it's wrong here
Firewall policies govern the establishment of new sessions; reply packets for an existing session are matched against the session table and are implicitly allowed. The original WAN-to-DMZ policy that permitted the inbound connection already created a bidirectional session entry, which covers both request and response directions. Therefore, adding a separate DMZ-to-WAN policy is not only unnecessary but could also introduce rule-order conflicts and complicate the security policy set.
- ✗
Configure static routing on the internal server to route through the FortiGate
Why it's wrong here
While the internal server must indeed have a route to the FortiGate to reach the VIP network, the question already assumes basic connectivity between the server and the firewall. Configuring static routing on the server does not influence FortiGate's reverse NAT operation, which is determined by the session table, not by the server's routing table. Thus, adding a static route is a network prerequisite, not the missing step for VIP return traffic, and would need to be verified separately only if the server cannot send replies at all.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.