Understanding FortiGate IP Pool Types: Fixed Port Range, Overload, and One-to-One
A FortiGate has a policy that matches traffic from LAN to WAN with NAT enabled and an IP pool. The pool contains IPs 203.0.113.1 to 203.0.113.5. The administrator notices that all traffic appears to come from 203.0.113.1. Which THREE reasons could explain this?
Quick Answer
The answer is that the IP pool is configured with type fixed port range, which restricts translation to a single IP address regardless of the pool size. In fixed port range mode, FortiGate assigns one IP per session and exhausts its port range before moving to the next IP, so if only one session is active or the pool is misapplied, all traffic appears from the first address. This concept tests your understanding of FortiGate IP pool types and behavior on the NSE4 exam, where overload mode distributes traffic across multiple IPs using port address translation, while fixed port range and one-to-one behave differently. A common trap is assuming a pool of multiple IPs automatically load-balances—it does not unless overload is selected. Memory tip: “Fixed locks one, Overload spreads the load, One-to-One maps a single IP.”
⚠ Common exam trap
Test-takers frequently assume 'overload' always distributes traffic across all pool IPs, but they overlook that distribution only occurs when multiple source IPs or port exhaustion triggers rotation; with a single source, the first pool IP is used exclusively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Only one source IP is generating traffic
If only one source IP (e.g., a single internal host) is generating traffic, the IP pool's overload (PAT) mechanism will map all sessions from that host to the first available IP in the pool (203.0.113.1) until its port range is exhausted. Since the pool has multiple IPs but only one source is active, the FortiGate will consistently use the same pool IP for all outbound traffic, making it appear as if all traffic originates from 203.0.113.1.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Only one source IP is generating traffic
Why this is correct
If only one client, all traffic will use that client's translation.
- ✓
The IP pool is configured with 'type one-to-one'
Why this is correct
One-to-one uses a single mapping per source IP.
- ✗
The IP pool is configured with 'type overload' and all source ports are being used
Why it's wrong here
Overload should distribute across IPs.
- ✓
The IP pool is configured with 'type fixed port range'
Why this is correct
Fixed port range assigns a unique port range per source, but may use one IP if the range is large.
- ✗
The 'set nat' command is missing from the policy
Why it's wrong here
If NAT were missing, no translation occurs.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate has a firewall policy with NAT enabled using an IP pool of type 'Fixed Port Range'. The pool range is 203.0.113.10-203.0.113.20 with port range 10000-20000. A user initiates a connection to an external server. Which of the following describes how the FortiGate will assign the source address and port?
hard- A.The FortiGate uses the pool IPs in round-robin and assigns the same port number as the original source port
- ✓ B.The FortiGate assigns a fixed IP and port mapping based on the original source IP and port, so the same internal host always gets the same public IP and port range
- C.The FortiGate randomly selects an IP from the pool and a random port from 10000-20000 for each session
- D.The FortiGate uses the first available IP in the pool and assigns a port sequentially from 10000 upward
Why B: Fixed Port Range NAT (also known as NAT with fixed port range) creates a deterministic mapping between an internal host's source IP address and a specific public IP and port range from the pool. This mapping is based on a hash of the original source IP address only; the original source port number is not used in the selection. All sessions from the same internal host will use the same public IP and dedicated port range (10000-20000), which is essential for protocols that require consistent source addressing, such as SIP or H.323. The FortiGate does not round-robin, randomly assign, or sequentially assign IPs/ports; it hashes the source IP to select the fixed public IP and port range.
Variation 2. A FortiGate has a policy that enables NAT with an IP pool that uses overload (port address translation). The administrator notices that some applications are failing because they require a fixed source port range. What should the administrator do to resolve this?
hard- ✓ A.Change the IP pool type to 'Fixed Port Range'
- B.Disable NAT and use policy-based routing
- C.Use Central SNAT instead of policy-based NAT
- D.Enable 'Preserve Source Port' in the firewall policy
Why A: When an IP pool uses overload (PAT), the FortiGate dynamically assigns source ports from a default range (typically 1024-65535). Some applications require a fixed source port range (e.g., SIP or FTP) to function correctly. Changing the IP pool type to 'Fixed Port Range' allows the administrator to define a specific, static range of source ports that the FortiGate will use for NAT, ensuring the application receives traffic on the expected ports.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.