NSE4 Firewall Policies and NAT Practice Question
An administrator is troubleshooting why traffic from a specific VLAN (192.168.10.0/24) to the internet is not being NATed correctly. The firewall policy allows the traffic with NAT enabled and uses an IP Pool (overload) for the source translation. The IP Pool is configured with the address 203.0.113.10. However, the traffic still shows the original source IP. Which THREE of the following could cause this issue? (Choose three.)
⚠ Common exam trap
Many exam-takers assume simply enabling NAT on the policy and configuring an IP Pool is sufficient, but they overlook the requirement to explicitly select the IP Pool in the policy's NAT settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall policy does not have the IP Pool selected in the NAT section
The IP Pool must be explicitly selected in the NAT section of the firewall policy for the pool to be used for source translation. Without this selection, the firewall will use the default NAT behavior (typically the outgoing interface IP) or no NAT at all, even if NAT is enabled on the policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
There is a Central SNAT rule with higher priority that does not match the traffic
Why it's wrong here
A Central SNAT rule that does not match the traffic is irrelevant to policy-based NAT. Policy-based NAT, which uses an IP Pool selected in a firewall policy, is evaluated independently; a non-matching Central SNAT rule simply has no effect on that translation. If the traffic matches the policy and the IP Pool is correctly selected, the source address would still be translated, so this is not the cause of the original IP being observed.
- ✓
The firewall policy does not have the IP Pool selected in the NAT section
Why this is correct
In FortiGate policy-based NAT, an IP Pool is only applied when the firewall policy explicitly references it via the 'NAT' section and the 'Use IP Pool' dropdown. Merely creating an IP Pool does not cause it to be used; the pool must be tied to the specific policy that binds the source and destination. Without that selection, the firewall falls back to using the outgoing interface address or no NAT, which would leave the original source IP visible.
- ✓
The IP Pool is configured on the wrong outgoing interface
Why this is correct
Each IP Pool is bound to a specific outgoing interface, and the firewall only applies the pool when the traffic egresses through that exact interface. If the pool is configured on a different interface than the one used by the affected traffic, the pool is never evaluated, and the traffic is sent with the original source IP. This interface mismatch is a common misconfiguration that prevents the intended source NAT from occurring.
- ✗
The IP Pool uses one-to-one NAT instead of overload
Why it's wrong here
One-to-one NAT and overload (many-to-one with port translation) both perform source address translation; the difference is in the mapping granularity, not in whether translation occurs. A one-to-one pool still replaces the private source IP with a public IP, so the user would not see the original IP. If the original source IP appears, the problem is unrelated to the NAT type and more likely lies in pool selection, policy matching, or interface binding.
- ✓
Another firewall policy above the current one matches the traffic and either denies it or does not use NAT
Why this is correct
FortiGate firewall policies are evaluated from top to bottom, and the first matching policy wins. If a policy above the intended one matches the traffic and either denies it or accepts it without enabling NAT, the IP Pool on the lower policy will never be applied. A denying policy would block traffic entirely, while an accepting policy without NAT would forward the traffic with the original source IP, exactly matching the observed symptom.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.