Transparent Mode Traffic Troubleshooting
An administrator is troubleshooting a FortiGate in transparent mode where clients cannot reach the internet. The FortiGate has two interfaces in the same VLAN. Which two items must be checked? (Choose two.)
Quick Answer
The answer is that firewall policies must be present to allow traffic from internal to external zones, and both interfaces must be in the same software switch or VDOM. In transparent mode, the FortiGate operates as a Layer 2 bridge, meaning it does not route between subnets; instead, all traffic must remain within a single broadcast domain. If the two interfaces are not logically bridged together, the Layer 2 path between clients and the upstream router is broken, preventing internet access even if policies are correct. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding that transparent mode troubleshooting requires verifying both the bridging configuration and the policy layer—a common trap is to check only policies while overlooking the interface membership. Remember the mnemonic “Bridge Before Policy”: ensure the Layer 2 path is intact before inspecting firewall rules.
⚠ Common exam trap
Test-takers frequently assume transparent mode still requires a default gateway on the FortiGate (like in NAT mode), but in transparent mode, clients use their own default gateway, and the FortiGate simply bridges traffic at Layer 2.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The two interfaces are members of the same software switch or VDOM
In transparent mode, FortiGate acts as a Layer 2 bridge, so traffic must flow through a single broadcast domain. If the two interfaces are not in the same software switch or VDOM, they are isolated, breaking the Layer 2 path between clients and the upstream router. Option C is correct because both interfaces must be logically bridged to forward traffic within the same VLAN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL inspection is enabled on the policy
Why it's wrong here
SSL inspection is not required for basic internet connectivity.
- ✗
The default gateway is configured on the FortiGate's management IP
Why it's wrong here
Transparent mode does not require a default gateway; traffic is bridged.
- ✓
The two interfaces are members of the same software switch or VDOM
Why this is correct
For transparent mode to work, interfaces must be in the same layer 2 broadcast domain, typically via a software switch or VDOM configuration.
- ✗
The management IP is on a different subnet from the bridged network
Why it's wrong here
Management IP can be on the same subnet; it does not affect traffic bridging.
- ✓
Firewall policies are present that allow traffic from internal to external zones
Why this is correct
Even in transparent mode, firewall policies control traffic flow.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is configuring a FortiGate in transparent mode for a data center segment. Which of the following is true about transparent mode operation in an enterprise environment?
medium- A.The FortiGate requires an IP address on each interface to route between VLANs
- ✓ B.Transparent mode operates at Layer 2, so no IP configuration is needed on the FortiGate interfaces
- C.Transparent mode is only available on specific hardware models
- D.Transparent mode supports NAT and VPN termination
Why B: In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This means the FortiGate interfaces do not require IP addresses for traffic forwarding; a management IP is configured on a VLAN interface or the root VDOM for administrative access only. Option B correctly identifies that transparent mode functions at Layer 2, so no IP configuration is needed on the physical interfaces for data plane operation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.