Which Policy Matches When Source Subnets Overlap?
A FortiGate has the following policy list: ID 1: allow from trust to untrust, source 10.0.0.0/24, destination all, service HTTP, NAT enabled. ID 2: allow from trust to untrust, source 10.0.1.0/24, destination all, service ALL, NAT enabled. A host 10.0.1.50 sends an HTTP request to 203.0.113.5. Which policy matches?
Quick Answer
The answer is Policy ID 2 because it matches both the source subnet and the service for the host 10.0.1.50. FortiGate uses first-match logic, meaning it evaluates policies from top to bottom and applies the first one where all conditions are true. In this case, Policy ID 1 specifies source 10.0.0.0/24, which covers only 10.0.0.0 through 10.0.0.255, so 10.0.1.50 falls outside that range and the policy does not match. Policy ID 2, however, specifies source 10.0.1.0/24, which includes 10.0.1.50, and its service is ALL, which includes HTTP, so it matches perfectly. On the Fortinet NSE 4 exam, this question tests your understanding of policy matching with overlapping source subnets and the critical concept that a more specific subnet does not automatically take precedence—order in the policy list is what matters. A common trap is assuming a broader subnet like 10.0.0.0/8 would match, but here the explicit /24 boundaries prevent any overlap. Remember: first match wins, not best match.
⚠ Common exam trap
A common mix-up: candidates assume the first policy in the list always matches if the service is HTTP, ignoring that the source must also match; FortiGate requires all conditions to be met for a policy to apply.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policy ID 2 because it matches the source and service
Policy ID 2 matches because the source IP 10.0.1.50 falls within the 10.0.1.0/24 subnet, and the service is set to ALL, which includes HTTP. FortiGate uses a top-down policy lookup and selects the first match based on source, destination, and service; since Policy ID 2 matches all criteria, it is applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Policy ID 2 because it matches the source and service
Why this is correct
Policy ID 2 matches source and service.
- ✗
Both policies, and the traffic is load-balanced
Why it's wrong here
Only one policy matches per session.
- ✗
No policy matches, traffic is denied by implicit deny
Why it's wrong here
Policy ID 2 matches, so traffic is allowed.
- ✗
Policy ID 1 because it is first in order and matches the service HTTP
Why it's wrong here
Policy ID 1's source is 10.0.0.0/24, which does not include 10.0.1.50.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate has multiple firewall policies. Policy ID 1 allows HTTP from LAN to WAN. Policy ID 2 allows all traffic from DMZ to WAN. A packet arrives from the DMZ interface destined to a web server on the internet using HTTPS. Which policy is matched?
medium- A.Policy ID 1, because it is first in order
- B.Policy ID 2, but only if it has a service allowing HTTPS
- C.Implicit deny, because no policy matches HTTPS traffic
- ✓ D.Policy ID 2, because it matches the source interface and destination
Why D: Policy ID 2 is matched because it allows all traffic from the DMZ interface to the WAN destination interface without any service restriction. The packet originates from the DMZ interface and is destined to the internet (WAN), so the source and destination interfaces match Policy ID 2. Since Policy ID 2 does not specify a service, it implicitly permits all protocols, including HTTPS.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.