NSE4 System and Network Administration Practice Question
A medium-sized enterprise has a FortiGate 100F in NAT/Route mode with three interfaces: port1 (WAN, 203.0.113.1/24, gateway 203.0.113.254), port2 (internal, 192.168.1.1/24), and port3 (DMZ, 10.0.0.1/24). The internal network hosts a web server at 192.168.1.10 and a mail server at 192.168.1.20. The DMZ hosts a public web server at 10.0.0.10 and a public DNS server at 10.0.0.20. The company has a single public IP 203.0.113.1. The administrator has configured the following: - Port forwarding: external HTTP to DMZ web server (10.0.0.10:80) and external DNS to DMZ DNS server (10.0.0.20:53). - Outbound NAT (IP Pool) for internal users to 203.0.113.1. - Firewall policies allowing internal to external, DMZ to external, and external to DMZ (for forwarded services).
Users report that they can access the Internet but cannot reach the internal web server (192.168.1.10) via its public IP (203.0.113.1:80). The DMZ web server is accessible from the Internet. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume hairpin NAT is the universal fix for internal access to public IPs, but they overlook that the port forwarding rule must first exist for the target internal server; without that rule, hairpin NAT has no effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port forwarding rule maps the public IP to the DMZ server, not the internal server
The port forwarding rule is configured to forward external HTTP requests (port 80) to the DMZ web server at 10.0.0.10. The internal web server at 192.168.1.10 is not covered by any port forwarding rule. Therefore, when internal users try to access the public IP 203.0.113.1:80, the traffic is not redirected to the internal server, and the request fails. This is the primary cause, not a missing hairpin NAT or misconfigured outbound NAT.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall policy from internal to DMZ is blocking traffic
Why it's wrong here
The firewall policy between internal and DMZ is explicitly configured to permit traffic, as verified in the policy table. Even if it were blocking, that would affect direct internal-to-DMZ communication, but the problem is about internal users reaching an internal server via the public IP. Since the policy allows traffic, and the destination of the forwarded traffic is a DMZ server, the policy is not the bottleneck. In fact, the traffic path from internal to public IP would first hit the FortiGate's VIP, then be redirected to the DMZ server, which is allowed by the internal-to-DMZ policy.
- ✗
Hairpin NAT is not enabled on the FortiGate
Why it's wrong here
Hairpin NAT (also known as NAT loopback) is a feature that allows internal clients to access a public IP address that is mapped to an internal server through the FortiGate's external interface. However, in this scenario, the destination server is the DMZ server (10.0.0.10) because the port forwarding rule is defined for that server. Enabling hairpin NAT would only allow the internal users to reach the DMZ server via the public IP; it would not change the destination IP to the internal server. Therefore, the root cause is the misconfiguration of the destination in the VIP/port forwarding rule, not the absence of hairpin NAT.
- ✓
The port forwarding rule maps the public IP to the DMZ server, not the internal server
Why this is correct
The port forwarding rule, implemented as a Virtual IP (VIP), maps the public IP and port to 10.0.0.10, which is the DMZ server. When internal users attempt to access the internal server via the public IP, the FortiGate uses this VIP and translates the destination to the DMZ server's IP address. Consequently, the traffic never reaches the intended internal server, and the internal users cannot establish a connection to it. To resolve this, the VIP's mapped IP must be changed to the internal server's address, or a separate VIP must be created for the internal server.
- ✗
The IP Pool for outbound NAT is misconfigured
Why it's wrong here
The IP pool is used for source NAT when internal users initiate outbound connections to the Internet. Since internal users are able to browse the Internet successfully, the IP pool is functioning as intended and is not misconfigured. This proves that the outbound NAT path is not the cause of the problem. The issue lies in the inbound port forwarding rule, which uses a VIP rather than an IP pool; a misconfigured IP pool would not affect the forwarding of incoming traffic to an internal server.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.