NSE4 System and Network Administration Practice Question
A network administrator is configuring a new FortiGate and needs to ensure that all traffic from the internal network to the internet is source NATed to the public IP address on port1. The default route points to port1. Which configuration step is required to achieve this?
⚠ Common exam trap
Candidates often confuse NAT configuration with interface settings or static routes, mistakenly thinking NAT must be enabled on the egress interface or as part of the route, whereas FortiOS applies NAT exclusively at the firewall policy level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable NAT on the firewall policy from internal to internet
Source NAT (SNAT) on a FortiGate is configured at the firewall policy level, not on the interface or via a static route. By enabling NAT on the firewall policy from the internal network to the internet, the FortiGate automatically translates the source IP of traffic egressing port1 to the interface's primary IP address (the public IP). This is the standard method for implementing source NAT in FortiOS, as defined in the FortiGate Administration Guide.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a static route to the internet with NAT enabled
Why it's wrong here
Static routes only define the next hop and egress interface for destination networks; NAT is not a configurable property of a route. To enable internet access, you need a default route to the ISP next hop, but the actual source NAT translation must be applied on the firewall policy that permits traffic from the internal network to the internet. Enabling NAT on a static route is not supported in FortiOS.
- ✓
Enable NAT on the firewall policy from internal to internet
Why this is correct
In FortiGate, source NAT is performed by enabling the NAT option on the firewall policy that matches the internal-to-internet traffic. This setting causes the FortiGate to masquerade the source IP of each packet with the IP address assigned to the egress interface, which is typically the public IP of the WAN port. This is the standard and correct method for allowing internal users to share a single public IP address when accessing the internet.
- ✗
Set the interface port1 to NAT mode in its settings
Why it's wrong here
FortiGate interfaces do not have a 'NAT mode' setting; NAT is solely applied through firewall policies. The concept of NAT mode versus transparent mode applies to the entire FortiGate operating mode, not to individual interfaces. Configuring an interface in NAT mode is not a valid action, so this option cannot be used to enable internet NAT.
- ✗
Create an IP pool with the public IP and reference it in the policy
Why it's wrong here
An IP pool is only required when you need to use a specific public IP address (or a range of addresses) other than the egress interface IP, e.g., for source NAT with multiple public IPs or to satisfy a server's allow-list. For a basic internet connection where the interface already has a public IP, enabling NAT directly on the policy without referencing an IP pool is sufficient. Creating an IP pool and referencing it is an optional advanced configuration, not a necessary step for simple internet NAT.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.