CCNA Firewall Policies and NAT Questions

Option C is correct because the firewall policy must match the destination port of the incoming traffic. External users connect to port 8080 on the VIP, but if the policy's destination service is set to HTTP (port 80), the policy will not match traffic destined for port 8080. Even though the VIP translates the destination to port 80 on the internal server, the firewall policy evaluation occurs before NAT translation, so the policy must match the original destination port (8080).

A Virtual IP (VIP) object is the correct choice because it specifically maps a public IP and port (203.0.113.5:22) to a private IP and port (10.0.1.10:22) for inbound destination NAT (DNAT). This allows external SSH traffic to reach the internal server by translating the destination address and port at the FortiGate WAN interface.

The 'diagnose firewall iprope list 100000' command displays the kernel-level firewall policy list. If the policy list shows an allow policy (ID 1) but the kernel entries show 'action=deny', it indicates that the policy was not successfully installed into the kernel's connection tracking or firewall engine. This typically occurs due to a policy installation error, such as a configuration inconsistency or a failure during the commit process, causing the kernel to fall back to a default deny action for that traffic.

Option C is correct because a Wildcard FQDN object allows the FortiGate to match traffic based on the destination domain name pattern (e.g., *.example.com) regardless of the IP address the domain resolves to. This object type performs DNS-based policy enforcement, where the FortiGate inspects the SNI field in the TLS handshake or the Host header in HTTP to match the FQDN pattern, not the destination IP.

The output shows a TCP session (proto=6) in state 01 (possibly ESTABLISHED or SYN_SENT), duration 3600 seconds, with 3599 seconds until expiry. It is a normal session.

Option A is correct because policy-based NAT requires separate firewall policies to apply different IP pools to different source subnets. Each firewall policy can have its own NAT settings, including a specific IP pool, allowing traffic from 192.168.1.0/24 to use POOL1 and traffic from 192.168.2.0/24 to use POOL2.

Policy-based routing (PBR) allows traffic matching a policy to be routed to a specific next-hop or interface, overriding the regular routing table. This is the correct approach for selective routing.

Option C is correct because it combines the required firewall policy elements: enabling authentication, setting the authentication type to LDAP, and restricting access to members of the LDAP group 'LDAP-Users'. This ensures that only users who successfully authenticate via LDAP and belong to the specified group can reach the sensitive server at 10.0.0.100. Without the group restriction, any authenticated LDAP user could access the server, which does not meet the requirement of restricting access to only authenticated users.

Policy ID 1 has a higher priority because FortiGate evaluates firewall policies in sequential order from top to bottom. When policy ID 1 matches the traffic (e.g., it also allows HTTPS to the same destination), the traffic is processed by policy ID 1 and never reaches policy ID 10. This is the most likely reason the intended policy is not matching.

To use a specific source IP for NAT, an IP Pool object must be created with the desired IP (203.0.113.2) and then referenced in the firewall policy. Option C is correct.

Without NAT reflection (also called hairpin NAT), traffic from internal users to the public IP goes out then comes back, but the firewall may not translate it correctly. The solution is to enable NAT reflection on the VIP.

Policy-based NAT takes precedence over central SNAT. Since the policy has NAT enabled (policy-based), it overrides the central SNAT rule.

FortiGate does not automatically tear down existing sessions when a policy is deleted. Sessions continue until they expire naturally or are explicitly cleared. The admin must use 'diagnose sys session clear' to remove them.

Option B is correct because when the SD-WAN strategy is set to 'Manual', the FortiGate does not automatically perform failover based on interface or link health. Manual mode requires explicit administrator action or must be combined with link health monitoring to trigger a switch. Without an automatic strategy or configured health checks, the SD-WAN zone will continue to use wan1 even if it goes down, preventing failover to wan2.

Option B is correct because a Virtual IP (VIP) is required to map the public IP address to the web server's private IP, allowing inbound traffic to reach the internal server. Option E is correct because a firewall policy must have the destination set to the VIP and must include an application control profile to enforce blocking of specific web applications on the HTTPS traffic.

In FortiGate firewalls, the implicit deny policy at the end of the firewall policy list has a default action of 'Deny'. This means any traffic that does not match an explicit firewall policy is automatically dropped. This is a fundamental security principle to ensure that only explicitly permitted traffic is allowed through the firewall.

The ID 2000000000 is reserved for the implicit deny policy. It matches all traffic from any interface to any interface and denies. This is the last rule checked.

The output shows 'duration=3600' and 'expire=3599', which directly indicate the session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds. The 'proto=6' confirms TCP (protocol 6), and 'proto_state=01' indicates an established TCP session. This is a standard FortiGate session diagnostic display.

When Central SNAT is enabled, it overrides policy-based NAT for matching traffic. The firewall policies are still used for access control, but the NAT is determined by the central NAT rules. Central NAT has higher precedence than policy-based NAT.

For inbound DNAT, the firewall policy must have the incoming interface as source interface and internal interface as destination interface. If both are set to wan1, the traffic is not forwarded to the internal network.

Destination NAT (DNAT) is used to translate the destination IP of incoming traffic. Virtual IP (VIP) is the FortiGate object for DNAT. Option B is correct.

When an IP pool is configured with overload (PAT), the FortiGate translates the source IP address and also changes the source port to a random high port. For protocols like SIP that rely on fixed source ports (e.g., UDP 5060), this port remapping breaks the application because the SIP server expects traffic from a specific port. Option D correctly identifies this as the root cause.

Option B is correct because 'diagnose firewall policy list' displays the effective policy table, including policy IDs, match criteria, and action (accept/deny). This helps verify whether the policy intended for the traffic is actually present and in the correct order. Option C is correct because 'diagnose debug flow' enables real-time packet flow tracing, showing exactly which policy is matched (or not) and why the traffic is denied, such as a policy hit with action 'deny' or a session table lookup failure.

To apply a traffic shaper to a specific policy, you need to either select the shaper in the policy configuration, or use a traffic shaping policy. Also, ensure that the shaping policy is enabled and applied correctly.

FortiGate firewalls evaluate policies sequentially from top to bottom. The first policy that matches the packet's source, destination, service, and other attributes is applied, and no further policies are checked. This top-down evaluation is fundamental to policy design and troubleshooting.

Option D is correct because a Geography object in FortiGate is specifically designed to represent traffic based on geographic location (e.g., country, continent). When used in a firewall policy's source field, it allows the administrator to block or allow traffic originating from an entire country without needing to manage individual IP addresses or subnets, leveraging FortiGate's GeoIP database.

If all traffic uses the first IP in the pool, possible reasons: the pool is configured for fixed port range which might allocate only one IP, or the NAT mode is not overload (which uses multiple IPs), or a single session is using all ports.

The correct answer is A because the policy allows traffic from 10.0.1.0/24 to 192.168.1.10 on HTTP, but without NAT enabled, the return traffic from the web server will be sent directly to the source IP (10.0.1.x) without going through the FortiGate. Since the source is a private IP, the server cannot route back to it unless the FortiGate performs source NAT (SNAT) to translate the source IP to its own interface IP. Without NAT, the session is logged as allowed but the client never receives the server's response, resulting in a connectivity failure.

The correct answer is D, FQDN object. FortiGate FQDN objects resolve domain names to IP addresses dynamically, allowing the firewall to update the destination IP automatically when the server's IP changes. This is ideal for scenarios where the external server uses a fully qualified domain name and its IP address is not static.

The IP pool overload mode uses dynamic port allocation, which can break applications needing a consistent port range. The 'Fixed Port Range' option in the IP pool configuration assigns a fixed port range to each session, preserving the original source port or a fixed range. Option A is correct.

An FQDN address object resolves the domain name to IP addresses dynamically. This allows the policy to adapt to IP changes, unlike a subnet object.

PBR requires the rule to be enabled, the gateway to be reachable, and the rule's priority to be higher (lower number) than other routes. Also, the PBR must be applied to the correct incoming interface. If the interface is wrong, or the gateway is unreachable, or the rule is disabled, PBR will not work.

The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate session diagnostics, `proto_state=01` for TCP indicates the session is in the SYN-SENT state, meaning the initial SYN packet has been sent but the three-way handshake (SYN-ACK) has not yet been received. The session has been active for 3600 seconds but has not yet completed establishment, which is why the correct answer is A.

Applications sensitive to NAT, such as SIP, H.323, or FTP, often require a fixed port range or an explicit NAT rule that preserves the original source port. When a dynamic IP pool with overload (PAT) is used, the FortiGate may change the source port, breaking protocols that embed IP addresses or port information in the payload. This is the most likely cause of application failures in this scenario.

To achieve this, the admin must configure a central SNAT rule for the subnet with overload, and a separate central SNAT rule (or fixed port range) for the server using fixed port range. Alternatively, the server could have a policy-based NAT with fixed port range, but central SNAT is specified. The question implies using central SNAT for both.

PBR uses policy routes that define a source and destination, and a gateway/interface. A policy route is created, and the traffic must be allowed by a firewall policy (maybe using the same criteria).

If the schedule does not match the current time, the firewall policy is not evaluated for that traffic. The FortiGate continues to check subsequent policies. If no other policy matches, the implicit deny rule blocks the traffic.

Since policies are evaluated top-down, the deny policy above the allow policy will match first. The administrator should move the allow policy above the deny policy (or adjust the deny policy to exclude the subnet).

When using VIP, the security policy destination should reference the VIP object, not the real server IP. The VIP handles the translation of destination IP and port.

An inter-VDOM link policy (or simply a policy between VDOMs) must be configured, often using a physical or logical inter-VDOM link. Option D correctly identifies the need for an inter-VDOM policy.

The IP Pool is configured with type 'Overload' (Port Address Translation), which maps multiple internal hosts to a single public IP by using unique source ports. With a single public IP (203.0.10.10), the maximum number of concurrent sessions is limited by the available source ports (approximately 65,535 per IP, minus reserved ports). Once all source ports are consumed, new outbound sessions cannot be established, causing users to lose access to external websites.

Central SNAT takes precedence over policy-based NAT when both are configured. The Central SNAT rule might be incorrect or missing, causing unexpected behavior.

Policy 2 is applied because it matches the destination IP (10.0.2.10) and the schedule 'Weekdays' is active on Wednesday at 2 PM. FortiGate uses a first-match approach only when multiple policies have the same priority; here, Policy 1 does not match the destination, so Policy 2 is the only matching policy. Since the schedule is valid, the action 'accept' is executed.

The most common misconfiguration when LDAP authentication fails is an incorrect bind DN or password. The FortiGate uses the bind DN to authenticate to the LDAP server before it can search for users; if these credentials are wrong, the LDAP server rejects the bind request, resulting in an 'authentication failed' log entry. This error occurs even before user credentials are checked, making it a frequent root cause.

The implicit deny policy is a default, hidden policy at the end of the FortiGate policy list that denies all traffic not explicitly allowed by preceding policies. Since the administrator wants to allow only HTTP traffic from internal to the DMZ web server and deny all other traffic, relying on the implicit deny is the correct and recommended security posture. It automatically blocks everything else without requiring manual configuration, ensuring no unintended traffic is permitted.

The 'diagnose sys session list' output showing many sessions in 'proto_state=01' with a short TTL indicates that sessions are failing to establish properly. When the IP pool used for Source NAT (SNAT) exhausts its address range, new outbound connections cannot obtain a translated source IP, causing them to fail intermittently. This matches the symptom of intermittent failures as the pool becomes temporarily depleted.

A schedule object in FortiGate defines time-based conditions (e.g., recurring weekly windows like Monday–Friday 09:00–18:00) that can be applied directly to a firewall policy. When a schedule is attached, the policy is enforced only during the specified time range, making it the correct object for restricting policy activation to business hours.

When a Virtual IP (VIP) is configured, the firewall policy must reference the VIP object as the destination, not the public IP address directly. If the policy uses the public IP (203.0.113.10) as the destination, the FortiGate will not perform the destination NAT translation to the internal server (192.168.1.100). The VIP object contains the mapping logic, so the policy must point to that object for the translation to occur.

Option A is correct because a newly created firewall policy in FortiGate is disabled by default. The administrator must explicitly enable the policy for it to be enforced. Without enabling, the deny rule will not process traffic, leaving the block ineffective.

The 'no matching policy' message indicates that the traffic did not match any firewall policy, likely because there is no policy allowing the traffic from that source to the destination.

Option D is correct because 'logtraffic=all' in FortiGate firewall policy configuration means that every packet belonging to a session matching this policy will be logged, regardless of whether the action is accept or deny. This is distinct from other log settings like 'logtraffic=utm' or 'logtraffic=disable', and it ensures full audit trail for all traffic handled by the policy.

SSL VPN requires user group, portal, settings, firewall policy, and enabling the service.

In FortiGate firewall policies, the first matching policy is applied to traffic. The Deny-All policy is placed above the Allow-HTTP policy, so traffic from 10.0.0.0/8 to the internet on HTTP matches the Deny-All policy first and is denied before reaching the Allow-HTTP policy. This is a classic policy ordering issue.

The session is a TCP (proto=6) session, state 01 means TCP SYN sent, duration 3600 seconds indicates it has been up for 1 hour, expire 3599 means it will expire in about 3599 seconds (almost 1 hour from now). Option C is correct.

To block by FQDN, you create an address object with the FQDN, then use it in a firewall policy with action DENY.

FortiGate evaluates policies from top to bottom. The new policy must be placed above the broader policy to be matched first. By default, new policies are added at the bottom.

The principle of least privilege dictates blocking all first (implicit deny is last, so explicit deny needed) then allowing only required traffic. Option A does that.

When using IP pool with overload (PAT), the FortiGate will perform port translation. The source port in the session list is the translated port (the port number after NAT). The original source port (from the internal host) is not shown in the session list; the output shows the post-NAT source port.

Option A is correct because creating a service group allows you to combine two separate service objects (one for UDP 5060 and one for UDP 10000-20000) into a single logical group, which can then be applied in one firewall policy. This is the most efficient method as it avoids duplicating policies or using an overly broad port range, and it leverages FortiGate's service group feature for clean, manageable rule sets.

The implicit deny rule is a default, hidden policy at the end of the FortiGate firewall policy list that denies all traffic not explicitly permitted by any user-created policy. This behavior is inherent to the FortiGate operating system and ensures a default-deny posture without requiring manual configuration. It is always present and cannot be deleted or moved, providing a safety net that blocks any unmatched traffic.

In FortiGate, when both Central SNAT and policy-based NAT (configured within a firewall policy) are present, Central SNAT takes precedence. This is because Central SNAT is evaluated before policy-based NAT in the NAT processing order, and once a match is found in Central SNAT, the system applies it and does not proceed to policy-based NAT. The specific server's traffic (10.0.1.100) would still be subject to the Central SNAT rule unless a more specific Central SNAT rule is created for that IP.

The output shows `proto=6` (TCP) and `proto_state=01`, which in Fortinet's session table corresponds to the TCP state `SYN_SENT` (the session has sent a SYN and is awaiting a SYN-ACK). The `duration=3600` and `expire=3599` indicate the session has been alive for 3600 seconds and will expire in 3599 seconds, but the state itself is not established or closing. Option A is correct because `proto_state=01` specifically maps to the TCP SYN_SENT state in FortiOS session diagnostics.

Option C is correct because FortiGate requires an explicit allow policy for HTTP/HTTPS traffic to pass through the firewall before a web filter profile can inspect and block malicious URLs. The web filter profile is applied as a security policy feature on an allow policy, not on a deny policy, since deny policies drop traffic before inspection can occur. Without an allow policy, the traffic would be blocked by default, and the web filter would never see the traffic to apply its filtering rules.

By default, FortiGate does not allow hairpin NAT (internal users accessing the VIP from inside). A policy with source NAT and the VIP as destination is required, and often NAT needs to be disabled on that policy to avoid double NAT. The common solution is to add a policy from internal to internal (or use NAT with source translation) but the core issue is that traffic from internal to VIP is not handled without a specific policy.

A geography object is specifically designed to match traffic based on geographic location (country, continent, or region) using the GeoIP database integrated into FortiOS. When a firewall policy needs to allow or deny traffic to or from a specific country like France, a geography object is the correct address object type because it dynamically resolves IP ranges assigned to that country by IANA/RIRs.

Option B is correct because to allow inbound SSH access from the internet to an internal server, you need a Virtual IP (VIP) that maps a public IP and port (e.g., 203.0.113.5:22) to the private IP and port (192.168.1.10:22), combined with a firewall policy from the WAN zone to the DMZ zone that permits SSH traffic. This is Destination NAT (DNAT), which translates the destination address of incoming packets so they are routed to the internal server.