NSE4 Firewall Policies and NAT Practice Question
A FortiGate administrator needs to create a firewall policy that allows traffic from the internal network (10.0.0.0/8) to a public web server (203.0.113.10) on port 443. The policy must also perform source NAT using the FortiGate's external IP (198.51.100.1). Which NAT configuration should be applied?
⚠ Common exam trap
Test-takers frequently confuse source NAT with destination NAT and incorrectly select a VIP (option C), or they overcomplicate the scenario by assuming an IP pool is always required for NAT, when in fact the default interface NAT is sufficient when the goal is to use the FortiGate's own external IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable NAT on the firewall policy without specifying an IP pool
When a firewall policy uses source NAT (SNAT) to translate internal source IPs to the FortiGate's own egress interface IP, simply enabling NAT on the policy without specifying an IP pool is sufficient. This is the default behavior: the FortiGate automatically performs source NAT using the IP address of the outgoing interface (in this case, 198.51.100.1). No additional IP pool or central NAT rule is required for this standard outbound NAT scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an IP pool with the external IP and reference it in the firewall policy
Why it's wrong here
An IP pool is a source NAT object that lets you translate the source address of outbound traffic to a specific IP or range other than the egress interface's own address. In this scenario, the FortiGate's outgoing interface already has the public IP 198.51.100.1, and no requirement exists to use a different or additional source IP, so creating an IP pool adds unnecessary complexity. Without a pool, enabling NAT on the policy will automatically use the interface IP, which fully satisfies the requirement.
- ✓
Enable NAT on the firewall policy without specifying an IP pool
Why this is correct
When you enable NAT on a firewall policy and leave the IP pool field blank, FortiOS performs source NAT using the primary IP address of the egress interface—here, 198.51.100.1. This is the simplest and most common method for enabling internet access from a private network, as it requires no separate NAT objects or additional configuration. The NAT action is directly part of the policy, exactly matching the scenario's request to apply NAT to the policy itself.
- ✗
Create a VIP for the web server and reference it in the firewall policy
Why it's wrong here
A Virtual IP (VIP) is used for destination NAT, translating an incoming packet's destination address from a public IP to a private internal server, such as a web server backend. It does not affect the source address of outbound packets, so it cannot perform the source NAT required in this policy. Since the scenario involves outbound traffic (implied by the need for source NAT), referencing a VIP would misapply a DNAT object and fail to achieve the intended translation.
- ✗
Configure Central SNAT and a matching rule
Why it's wrong here
Configuring Central SNAT would manage source NAT rules in a dedicated table, separate from the firewall policy itself. This approach fails the scenario because the question asks for the NAT configuration *applied to the policy*, implying policy-based NAT where the NAT action is defined directly within the firewall rule. Central SNAT is tempting as it performs source NAT, and it is the correct choice when an administrator prefers a centralised, ordered list of NAT rules, independent of individual firewall policies, for consistent management across multiple rules.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.