NSE4 Firewall Policies and NAT Practice Question
An admin configures a VIP to map a public IP to an internal server. The firewall policy uses the VIP as the destination. External users can access the server, but the server's logs show the source IP as the FortiGate's internal interface IP instead of the original client IP. Why is this happening?
⚠ Common exam trap
Watch out — candidates often assume NAT only applies to outbound traffic, but FortiGate policies apply NAT bidirectionally unless explicitly disabled, causing the source IP to be overwritten even for inbound VIP traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall policy has NAT enabled, which changes the source IP to the FortiGate's egress interface IP
When a firewall policy has NAT enabled (typically 'Enable NAT' or 'Use Outgoing Interface Address'), the FortiGate performs source NAT (SNAT) on the traffic, replacing the original client source IP with the IP of its egress interface (the internal interface in this scenario). This is standard behavior for source NAT, which hides the original client IP from the internal server, causing the server logs to show the FortiGate's internal interface IP instead of the actual client IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VIP is configured with port forwarding and the server is expecting a different port
Why it's wrong here
Port forwarding on the VIP controls destination address and port translation, leaving the source IP untouched. If the internal server expects a different port, the firewall would translate the destination port accordingly, but the source address would still reflect the original client or the FortiGate's egress IP depending on policy NAT. Thus, port mismatch explains connection failures, not the altered source IP observed by the server.
- ✗
The VIP is using a different public IP than expected
Why it's wrong here
This option contradicts the scenario's premise, since external users can successfully reach the server through the configured public IP. If the VIP were bound to a different public IP, the expected destination would not be reachable, and the traffic would never arrive at the server. Even if the VIP had an incorrect IP, it would not cause source address rewriting; source IP modification is governed solely by the firewall policy's NAT settings.
- ✓
The firewall policy has NAT enabled, which changes the source IP to the FortiGate's egress interface IP
Why this is correct
When the firewall policy matching the VIP traffic has NAT enabled, FortiGate replaces the original source IP with the IP of the egress interface used to forward the packet. This source NAT (SNAT) hides the client's real address, so the internal server logs show the FortiGate's interface IP as the connection source. This is the standard behavior, explaining why the admin observes the FortiGate IP instead of the client's public IP.
- ✗
The server's routing is misconfigured and traffic is returning via a different path
Why it's wrong here
Asymmetric routing occurs when reply traffic returns via a different path, which can cause state timeouts or dropped packets but does not alter the source IP recorded on incoming packets. If NAT were disabled, the server would still see the client's original IP even with misconfigured routing, because routing decisions don't modify the source address field. The observed source IP change is a direct result of policy NAT, not a routing anomaly.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.