NSE4 Firewall Policies and NAT Practice Question
An admin configures a firewall policy to allow SMTP traffic from a mail server to the internet with NAT enabled. External recipients report that the email source IP is the FortiGate's external interface IP. The admin wants the source to be a specific IP from a pool. What should the admin configure?
⚠ Common exam trap
It's easy for candidates to confuse IP pools with VIPs or central SNAT, mistakenly thinking VIPs can modify source IPs or that central SNAT is required, when in fact the IP pool directly attached to the firewall policy is the correct and simplest solution for overriding the source NAT address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the firewall policy, enable NAT and specify the IP pool as a fixed port range or overload
The admin wants the source IP of outbound SMTP traffic to be a specific IP from a pool rather than the FortiGate's external interface IP. In a firewall policy with NAT enabled, you can specify an IP pool to override the default source NAT behavior. The IP pool can be configured as Fixed Port Range or Overload (PAT) to translate the mail server's source IP to a desired address from the pool, ensuring external recipients see that specific IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a central SNAT policy with the source as the mail server and the translated IP as the desired address
Why it's wrong here
Central SNAT is a distinct feature that is only functional when the FortiGate's NAT mode is set to Central NAT. In a policy-based NAT environment, the NAT is performed by the firewall policy itself, and enabling central SNAT policies would conflict or be ignored. The administrator would need to switch the entire NAT mode to central, which is a different configuration path than the simple policy-based NAT setup described. Therefore, this approach is incorrect for translating the mail server's source address in this scenario.
- ✗
Use a VIP with port forwarding to translate the source
Why it's wrong here
A Virtual IP (VIP) object is designed for destination translation, mapping an external destination address and/or port to an internal server. It cannot modify the source address of the outgoing SMTP traffic from the mail server, which is exactly what the administrator needs. Port forwarding associated with the VIP only affects inbound connections to a service. Since the traffic direction in question is outbound from the mail server, a VIP would be irrelevant and ineffective.
- ✓
In the firewall policy, enable NAT and specify the IP pool as a fixed port range or overload
Why this is correct
In the firewall policy, enabling NAT and referencing an IP pool is the proper method for policy-based source NAT. An IP pool configured as overload (PAT) allows multiple internal sessions to share a single translated IP, while a fixed port range pool also uses a single IP but constrains the source port range; both can satisfy the requirement for a single public address for the mail server. This is exactly what the admin needs for SMTP traffic, ensuring all outbound mail appears from the same IP. Thus it is the correct choice.
- ✗
Enable NAT on the policy and set the IP pool configuration to use a dynamic IP pool
Why it's wrong here
A dynamic IP pool assigns multiple different source IP addresses from a configured range to sessions, which would cause outgoing SMTP traffic from the mail server to use varying source addresses. This defeats the purpose of needing one specific translated IP for the mail server, as reverse DNS and SPF records rely on a consistent source address. Dynamic IP pools are typically used for load distribution or when having many source IPs is acceptable, not for a fixed single-address translation. Therefore, this configuration is incorrect.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.