NSE4 Firewall Policies and NAT Practice Question
An admin configures a VIP to map public IP 203.0.113.10 to internal server 10.0.1.100 on port 80. External users can reach the server via the public IP. However, internal users cannot access the server using the public IP. What is the MOST likely cause?
⚠ Common exam trap
Many candidates assume internal users can always reach a server via its public IP because the VIP is working externally, overlooking the need for NAT reflection to handle traffic sourced from the same subnet as the destination server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VIP does not have NAT reflection enabled
The most likely cause is that NAT reflection (also known as hairpin NAT or NAT loopback) is not enabled on the VIP. When an internal user sends a request to the public IP (203.0.113.10), the FortiGate must translate the source IP back to the internal network and loop the traffic back through the VIP to reach the internal server (10.0.1.100). Without NAT reflection, the FortiGate drops the packet because it sees the destination as the VIP's public IP but the source is from the same internal subnet, causing asymmetric routing or no reply.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VIP does not have NAT reflection enabled
Why this is correct
The VIP lacks NAT reflection (also called NAT hairpin or loopback), which is required for internal users to reach the same VIP that external users can access. With NAT reflection disabled, a packet from an internal client destined to the VIP's public IP hits the FortiGate but is neither source-NATed nor properly routed back, so the session never establishes. This perfectly matches the symptom where external users work, but internal users cannot use the public IP.
- ✗
The server is not responding to internal requests
Why it's wrong here
If the server were unresponsive to internal requests, external requests through the VIP would also fail, since the same server is behind the VIP. We see external users working, meaning the server is functioning and reachable via the VIP; the problem is specific to internal-initiated sessions. Therefore, lack of server response is not the correct diagnosis.
- ✗
The firewall policy for internal to VIP is missing
Why it's wrong here
If external users work, the policy from external to VIP exists. For internal users, a policy from internal to VIP (using the public IP) would also be needed, but the question says internal users cannot access using the public IP, implying the policy might be missing, but the most likely cause is lack of NAT reflection, as the policy could be in place but traffic not translated correctly.
- ✗
The VIP is configured on a different interface
Why it's wrong here
If the VIP were bound to the wrong interface, that would impact all users — both internal and external — trying to reach the VIP, not just internal clients. Because the scenario states that internal users cannot access the public IP while external users (presumably via the WAN interface) can, the VIP's interface binding is not the culprit. The selective failure points to a NAT behavior issue rather than an interface misconfiguration.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.