nerdexam
Fortinet

NSE4 · Question #116

How is traffic routed onto an SSL VPN tunnel from the FortiGate unit side?

The correct answer is B. Assignment of an IP address to the client causes a host route to be added to the FortiGate unit's. When an SSL VPN client connects in tunnel mode, the FortiGate assigns an IP address to the client, which automatically creates a host route in its routing table to direct traffic back to that client.

Submitted by yuriko_h· Apr 18, 2026VPN and Routing

Question

How is traffic routed onto an SSL VPN tunnel from the FortiGate unit side?

Options

  • AA static route must be configured by the administrator using the ssl.root interface as the outgoing
  • BAssignment of an IP address to the client causes a host route to be added to the FortiGate unit's
  • CA route back to the SSLVPN IP pool is automatically created on the FortiGate unit.
  • DThe FortiGate unit adds a route based upon the destination address in the SSL VPN firewall

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    85% (22)
  • C
    4% (1)
  • D
    8% (2)

Why each option

When an SSL VPN client connects in tunnel mode, the FortiGate assigns an IP address to the client, which automatically creates a host route in its routing table to direct traffic back to that client.

AA static route must be configured by the administrator using the ssl.root interface as the outgoing

A static route using `ssl.root` as the outgoing interface is not the mechanism for routing traffic to individual SSL VPN clients; the FortiGate manages client routes dynamically.

BAssignment of an IP address to the client causes a host route to be added to the FortiGate unit'sCorrect

When an IP address is assigned to the SSL VPN client, the FortiGate automatically adds a host route (a /32 route for that specific IP) to its routing table, directing traffic destined for that client through the SSL VPN tunnel.

CA route back to the SSLVPN IP pool is automatically created on the FortiGate unit.

While an SSLVPN IP pool exists, the FortiGate does not automatically create a general route back to the entire pool; instead, it creates specific routes for assigned client IPs.

DThe FortiGate unit adds a route based upon the destination address in the SSL VPN firewall

SSL VPN firewall policies control which traffic is *allowed* through the tunnel but do not define the underlying *routing mechanism* for the FortiGate to reach the client.

Concept tested: SSL VPN tunnel mode routing

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/181555/ssl-vpn-modes

Topics

#SSL VPN#Routing#Host Routes#FortiGate

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice