NSE4 Firewall Policies and NAT Practice Question
A FortiGate has a policy that enables NAT with an IP pool that uses overload (port address translation). The administrator notices that some applications are failing because they require a fixed source port range. What should the administrator do to resolve this?
⚠ Common exam trap
A common mix-up: candidates confuse 'Preserve Source Port' (a valid IP pool setting) with a firewall policy option, or assume that Central SNAT inherently provides fixed port ranges, when in fact the IP pool type must be explicitly changed to 'Fixed Port Range'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the IP pool type to 'Fixed Port Range'
When an IP pool uses overload (PAT), the FortiGate dynamically assigns source ports from a default range (typically 1024-65535). Some applications require a fixed source port range (e.g., SIP or FTP) to function correctly. Changing the IP pool type to 'Fixed Port Range' allows the administrator to define a specific, static range of source ports that the FortiGate will use for NAT, ensuring the application receives traffic on the expected ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change the IP pool type to 'Fixed Port Range'
Why this is correct
In FortiOS, an IP pool configured as Fixed Port Range allocates source ports from a contiguous range for each NAT session rather than randomly selecting them as in Overload mode. This deterministic port assignment is essential when the destination service expects a stable or predictable source port per connection, such as legacy protocols or inter-server communications with port-based ACLs. Select this pool type in the IP pool configuration and reference it in the firewall policy's Dynamic IP Pool setting to satisfy the application requirement.
- ✗
Disable NAT and use policy-based routing
Why it's wrong here
Disabling NAT and employing policy-based routing would eliminate the translation entirely, causing traffic to egress with either the original private source IP or the FortiGate's interface IP, which is almost certainly not routable on the public network and fails to meet the application's need for a predictable source port range. Policy-based routing influences only the routing decision (next-hop or interface) and has no effect on how the FortiGate performs source port allocation during NAT. Thus, this approach not only leaves the port issue unresolved but also breaks NAT, making it an incorrect remedy.
- ✗
Use Central SNAT instead of policy-based NAT
Why it's wrong here
Central SNAT is an alternative NAT configuration model in FortiOS, but it does not inherently change the IP pool behavior; the default pool type in a central SNAT rule is still Overload, which randomizes source ports and maintains a many-to-one mapping. To obtain fixed port assignment, you would still need to specify a Fixed Port Range IP pool within the central SNAT policy, which is precisely the same fix as the correct answer. Therefore, merely switching from policy-based NAT to Central SNAT without altering the pool type fails to address the application's requirement.
- ✗
Enable 'Preserve Source Port' in the firewall policy
Why it's wrong here
In FortiOS, there is no "Preserve Source Port" toggle in the firewall policy itself; port preservation is a property of the IP pool, specifically available when the pool type is Fixed Port Range, where it can be enabled to keep the original source port when it is available. Since the policy only references an IP pool, enabling this option in the policy is not possible in the standard GUI/CLI, and attempting to do so would not affect port mapping. The correct sequence is to configure a Fixed Port Range pool (and optionally enable Preserve Source Port in that pool) before referencing it in the policy, making this option both unavailable and conceptually misplaced.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.