NSE4 Firewall Policies and NAT Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The Central SNAT rule is disabled

  Why it's wrong here

  If the Central SNAT rule were disabled, FortiOS would simply not consider it during session setup, leaving the original source IP unchanged in the packet header. That could produce a "no translation" log entry, but in practice an admin who just created the rule typically leaves it enabled. Moreover, a disabled rule cannot explain why the translation is absent when an IP pool is attached to the matching firewall policy, because that override occurs regardless of the central rule's state.

• ✓

  The Central SNAT rule is applied to the wrong outgoing interface

  Why this is correct

  Central SNAT rules specify an outgoing interface, and if the interface does not match the actual egress interface used by the traffic, the rule is skipped and no translation occurs. However, in a typical policy-based NAT deployment, the firewall policy's IP pool takes precedence over any central SNAT rule, regardless of interface matching. This makes an interface mismatch a possible but less likely explanation, because the override would still mask the central rule even if the interface were correct.

• ✗

  The firewall policy has an IP pool configured, overriding Central SNAT

  Why it's wrong here

  In FortiOS, when a firewall policy has an IP pool configured, that policy-based NAT is evaluated before any Central SNAT rule and takes precedence. The session's source address is translated according to the IP pool, and the Central SNAT rule is effectively bypassed, so no translation from that rule is visible in the logs. This is the most common cause of "no translation" when a Central SNAT rule exists but a policy with an IP pool also matches the traffic.

• ✗

  The destination address in the Central SNAT rule is incorrect

  Why it's wrong here

  A Central SNAT rule's destination address must match the traffic's destination for the rule to apply; if the rule specifies a destination that does not include 8.8.8.8, the rule is not matched and no translation occurs. Yet in typical internet-bound traffic, the rule is often configured with a destination of "all" or a broad address range, making this an unlikely oversight. More importantly, even with a correct destination, an IP pool on the firewall policy would override the Central SNAT rule, so the real cause is the policy-level NAT.

Go deeper

Related to this question