NSE4 Firewall Policies and NAT Practice Question
An administrator configures a Virtual IP (VIP) to map the public IP 203.0.113.10 port 8080 to the internal server 192.168.1.100 port 80. External users report they cannot connect. The firewall policy allows inbound traffic to the VIP. What is the MOST likely missing configuration?
⚠ Common exam trap
Candidates often assume the firewall policy should use the public IP as the destination, not realizing that the VIP object must be referenced in the policy for the NAT translation to be applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The destination in the firewall policy is set to the public IP directly instead of the VIP object
When a Virtual IP (VIP) is configured, the firewall policy must reference the VIP object as the destination, not the public IP address directly. If the policy uses the public IP (203.0.113.10) as the destination, the FortiGate will not perform the destination NAT translation to the internal server (192.168.1.100). The VIP object contains the mapping logic, so the policy must point to that object for the translation to occur.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The destination in the firewall policy is set to the public IP directly instead of the VIP object
Why this is correct
FortiGate matches inbound traffic against the VIP object, not the public IP. If the policy destination is the raw public IP, the connection never maps to the internal server, so external users fail despite the policy appearing to permit traffic.
- ✗
The VIP is configured with port forwarding disabled
Why it's wrong here
With port forwarding disabled, the VIP maps the address without translating port 8080 to 80, so the server receives traffic on a port it is not listening on. Port forwarding is correctly enabled here, since the requirement explicitly maps 8080 to 80; disabling it would only suit a one-to-one address mapping.
- ✗
The server's default gateway is not set to the FortiGate
Why it's wrong here
If the server's default gateway does not point to the FortiGate, its return traffic bypasses the firewall and the connection never completes, since the VIP only rewrites the inbound destination. This is tempting because gateway misconfiguration commonly breaks connectivity, but it would be the answer only when the firewall sits off the server's return path.
- ✗
The source NAT is not configured
Why it's wrong here
Source NAT rewrites the client's address so replies return through the FortiGate; without it, the server may still answer directly if routing permits, and the stem gives no evidence of asymmetric routing. Source NAT is required only when the server's default gateway cannot point to the firewall.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 773 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.