NSE4 Policy-based NAT (Central SNAT) Practice Question
An admin is configuring a policy-based NAT (central SNAT) to translate internal users to a pool of public IPs using overload. The admin wants to ensure that specific applications using non-standard ports are not affected by NAT. Which THREE steps should the admin consider?
⚠ Common exam trap
The trap is that candidates may believe only disabling NAT (Option A) can protect applications, overlooking that a dedicated IP pool with a fixed port range (Options B and C) can also preserve application behavior by controlling source port allocation. Additionally, some might incorrectly assume that a VIP (Option D) or simply enabling NAT (Option E) would address the issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable NAT for those applications by adding a policy before the NAT policy with 'set nat disable'
Adding a policy before the central SNAT policy with `set nat disable` explicitly exempts specific traffic from NAT translation, ensuring that applications using non-standard ports are not affected by the overload behavior. Option B is correct because configuring a separate IP pool dedicated to those applications allows you to control the NAT behavior independently, such as using a pool without PAT or with a fixed port range, thereby avoiding port remapping issues. Option C is correct because using a fixed port range in the IP pool confines source port allocation to a specified range, accommodating applications that expect particular ports. Option D is incorrect because a VIP is for destination NAT, not source NAT, and does not address source port modification. Option E is incorrect because enabling NAT on the policy would translate all traffic, not protect specific applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable NAT for those applications by adding a policy before the NAT policy with 'set nat disable'
Why this is correct
Adding a policy before the central SNAT policy with 'set nat disable' creates a deterministic exception: traffic matching that earlier policy is evaluated and its NAT disabled, so it is never processed by the subsequent central SNAT rule. Due to FortiOS policy ordering, the first match wins, meaning this exempt policy must be placed ahead of the NAT policy. This selectively preserves the original source address/port for those applications while other traffic continues through central SNAT.
- ✓
Configure a separate IP pool dedicated to those applications
Why this is correct
A dedicated IP pool for those applications gives the administrator independent control over the NAT behavior for that traffic, such as disabling PAT entirely or using a fixed port range. Because the pool is referenced only by a specific SNAT policy or policy match, the general NAT rule for other clients is unaffected. This avoids port conflicts by ensuring the applications' source port is either preserved or mapped within an acceptable range.
- ✓
Use a fixed port range in the IP pool configuration
Why this is correct
A fixed port range in the IP pool configuration confines the ephemeral source port allocation to a defined range rather than the default high ports. This is the most direct solution because it keeps NAT overload (PAT) active while making the translated source port predictable for applications that need a specific port or port range. When an application expects a particular source port, a fixed range prevents the NAT engine from selecting an incompatible random port.
- ✗
Use central SNAT with a VIP for source NAT
Why it's wrong here
A virtual IP (VIP) is inherently a destination NAT construct; it maps an external destination address/port to an internal server address/port. Central SNAT policies require source IP pools to perform source translation, not VIPs. Even if a VIP were somehow referenced, it would not constrain the ephemeral source port selection performed by overload/PAT, so the application's source port would still be modified.
- ✗
Enable 'set nat enable' on the policy
Why it's wrong here
Enabling 'set nat enable' on the policy is not a targeted fix because it forces source NAT onto all traffic matched by that policy, including the applications that rely on raw source ports. With overload enabled, the FortiGate will translate source ports globally, potentially breaking those applications. You need an exemption or controlled pool rather than a blanket NAT enable.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.