NSE4 Firewall Policies and NAT Practice Question
An administrator configures a Virtual IP (VIP) to map public IP 203.0.113.10 to internal server 10.0.1.10 on port 443. The firewall policy uses the VIP as the destination address. External users report they cannot connect. The administrator checks the policy and sees the destination interface is 'wan1' and source interface is 'wan1'. What is the most likely issue?
⚠ Common exam trap
It's easy for candidates to confuse the source and destination interface roles in a VIP policy, assuming the destination interface should match the incoming interface (wan1) rather than the internal interface where the server resides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The destination interface should be the internal interface, not wan1
The VIP maps the public IP to the internal server, but the firewall policy's destination interface is set to 'wan1', which is the external interface. Traffic arriving on wan1 and destined for the VIP must be processed by a policy where the destination interface is the internal interface (e.g., 'internal' or 'lan') so that the firewall can route the decapsulated traffic to the private server. Setting the destination interface to wan1 prevents the firewall from forwarding the traffic to the internal network, breaking connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The destination interface should be the internal interface, not wan1
Why this is correct
After the virtual IP (VIP) performs destination NAT (DNAT), the packet's destination IP becomes the internal server's private address. To deliver that packet, the firewall must route it out the interface that connects to that server, which is the internal interface. If the policy's destination interface is mistakenly set to wan1, the firewall will attempt to send the packet back out the WAN interface, causing the traffic to fail or be misrouted. Therefore, the destination interface must be the internal interface to match the post-DNAT forwarding path.
- ✗
The policy needs NAT enabled
Why it's wrong here
Enabling NAT on a FortiGate policy controls source NAT (SNAT), which translates the source IP address of outbound traffic. The virtual IP (VIP) already provides destination NAT (DNAT) for incoming traffic, translating the public destination IP to the internal server's private IP. Policy NAT is not required for DNAT to work, and enabling it would only alter the source address, not affect the VIP's function. Thus, this setting is not the cause of the problem and is unnecessary for the policy.
- ✗
The source interface should be the internal interface
Why it's wrong here
The source interface in a firewall policy specifies which interface the traffic enters from. For traffic arriving from the internet to the VIP, the incoming interface is wan1, not the internal interface. Setting the source interface to internal would cause the policy to match only traffic originating from the internal network, which would not include the external sessions destined to the public IP. Therefore, the source interface should remain wan1 to correctly match the inbound traffic flow.
- ✗
The VIP is not associated with the policy
Why it's wrong here
In FortiGate, a virtual IP (VIP) is associated with a policy by specifying the VIP as the destination address in that policy. The firewall automatically applies the corresponding DNAT translation when traffic matches the policy's criteria, so no separate association step is needed. Since the policy's destination is the VIP, it is inherently associated, and traffic will be translated accordingly. This option is incorrect because the VIP is indeed linked to the policy through the destination address field.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.