Transparent Mode VLAN Forwarding: Required Configurations
An administrator is configuring a FortiGate in transparent mode and needs to forward traffic between two VLANs. Which three configurations are required? (Choose three.)
Quick Answer
The answer is that creating firewall policies to allow traffic between the VLANs is one of three required configurations for transparent mode VLAN forwarding on a FortiGate. In transparent mode, the FortiGate operates as a Layer 2 bridge, so it does not route between VLANs; instead, you must create VLAN subinterfaces on the physical interface to tag and separate traffic, assign an IP address to each subinterface for management access, and then apply firewall policies to control and permit the Layer 2 forwarded frames between those VLANs. On the Fortinet NSE 4 exam, this question tests your understanding that transparent mode still enforces security policies even without routing, and a common trap is assuming that simply creating subinterfaces is enough without also configuring the policies. Remember the mnemonic “VIF-P” for VLAN subinterfaces, IP for management, and Firewall policies to allow traffic.
⚠ Common exam trap
It's easy for candidates to assume transparent mode requires routing or NAT for inter-VLAN communication, but FortiGate in transparent mode bridges VLANs at Layer 2, relying on an external router for Layer 3 forwarding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign an IP address to each VLAN subinterface for management
In transparent mode, FortiGate acts as a Layer 2 bridge, so VLAN subinterfaces must be created on the physical interface to tag and separate traffic for each VLAN (Option C). An IP address must be assigned to each VLAN subinterface for management access (Option B), as the FortiGate does not route between VLANs at Layer 3 but still needs an IP to be reachable for administration. Firewall policies are required to control and allow traffic between VLANs (Option D), even in transparent mode, because the FortiGate applies security rules to Layer 2 forwarded frames.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable NAT on the policies to translate addresses between VLANs
Why it's wrong here
NAT is not typically used in transparent mode for inter-VLAN traffic; it would be layer 2 forwarding.
- ✓
Assign an IP address to each VLAN subinterface for management
Why this is correct
In transparent mode, each VLAN subinterface typically gets an IP for management, but for traffic forwarding, the FortiGate needs to be in the VLANs. Actually, a management IP is required for the VDOM, but not necessarily on each VLAN? In transparent mode, you set a management IP for the VDOM, but traffic forwarding between VLANs requires the FortiGate to have interfaces in both VLANs. So subinterfaces are needed, and they usually have IPs assigned for management, but forwarding itself uses layer 2. However, to perform any layer 3 inspection, the FortiGate needs IPs on the subnets. So likely needed.
- ✓
Create VLAN subinterfaces on the physical interface for each VLAN
Why this is correct
VLAN subinterfaces are needed to participate in each VLAN.
- ✓
Create firewall policies to allow traffic between the VLANs
Why this is correct
Firewall policies control traffic forwarding even in transparent mode.
- ✗
Configure static routes to route between VLANs
Why it's wrong here
Transparent mode does not route; it bridges. So no routing needed.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is configuring a VLAN interface on a FortiGate. The physical interface is port2 and the VLAN ID is 100. Which of the following correctly creates the VLAN interface?
easy- ✓ A.config system interface edit port2.100 set vlanid 100 set type vlan next end
- B.config system interface edit port2 set vlanid 100 next end
- C.config system interface edit port2.100 set type vlan next end
- D.config system vlan edit port2.100 set vlanid 100 next end
Why A: It uses the correct CLI syntax to create a VLAN subinterface on a FortiGate. The command `config system interface` enters the interface configuration context, `edit port2.100` creates or edits the subinterface named with the physical interface and VLAN ID, `set vlanid 100` assigns the VLAN tag, and `set type vlan` explicitly defines the interface type as VLAN. This matches the required configuration for 802.1Q VLAN tagging on FortiGate.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.