NSE4 Firewall Policies and NAT Practice Question
An administrator has configured a firewall policy with a destination NAT (DNAT) VIP to map public IP 203.0.113.5 to internal server 10.10.10.20 on port 443. The policy allows HTTPS traffic from the internet to the VIP. However, when testing from an internal client on the same subnet as the server, the connection to 203.0.113.5 fails. What is the most likely cause?
⚠ Common exam trap
The trap here is overlooking the need for hairpin NAT when internal clients access the public IP of a VIP that maps to an internal server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hairpin NAT (NAT loopback) is not configured, so internal clients cannot reach the public IP and be redirected to the internal server.
Hairpin NAT is required when internal clients access a public IP that is DNATed to an internal server. Without it, the server's return traffic bypasses the FortiGate, causing asymmetric routing and connection failure. Configuring hairpin NAT involves adding a firewall policy that allows the internal subnet to access the VIP and enabling NAT on that policy, ensuring return traffic is translated correctly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Hairpin NAT (NAT loopback) is not configured, so internal clients cannot reach the public IP and be redirected to the internal server.
Why this is correct
When an internal client tries to access the public IP of a VIP that points to an internal server on the same subnet, the traffic goes to the FortiGate, which performs DNAT, but the return traffic from the server goes directly to the client, bypassing the FortiGate. This asymmetric routing breaks the connection. Hairpin NAT (or NAT loopback) is required to ensure return traffic also goes through the FortiGate, allowing proper translation.
- ✗
The firewall policy does not have NAT enabled for the outbound direction.
Why it's wrong here
For inbound DNAT, the firewall policy typically does not require outbound NAT to be enabled. Enabling NAT in the policy would apply source NAT to the traffic after DNAT, which might be needed in some cases but is not the cause of the failure here. The issue is specifically about internal clients accessing the public IP, which is a hairpin NAT scenario.
- ✗
The firewall policy does not include the internal client's subnet as a source address.
Why it's wrong here
The firewall policy for inbound access typically allows 'all' or the internet as source. Even if the internal subnet is not explicitly listed, the policy might still allow it if 'all' is used. However, the failure is due to the return path asymmetry, not the source address matching. Adding the internal subnet might help in some designs but is not the core issue for hairpin NAT.
- ✗
The VIP does not have the 'port-forward' option enabled.
Why it's wrong here
Port forwarding is used when translating a specific port to a different port on the internal server. In this scenario, the external port 443 is mapped to internal port 443, so port forwarding is not required. The failure is not due to port forwarding settings but due to the internal client accessing the public IP from inside the network.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.