nerdexam
Fortinet

NSE4 · Question #21

In the case of TCP traffic, which of the following correctly describes the routing table lookups performed by a FortiGate operating in NAT/Route mode, when searching for a suitable gateway?

The correct answer is B. A lookup is done when the first packet coming from the client (SYN) arrives, and a second one is. For TCP traffic, a FortiGate in NAT/Route mode performs two routing table lookups: one for the initial SYN packet from the client and another for the first SYN/ACK packet from the server.

Submitted by anjalisingh· Apr 18, 2026VPN and Routing

Question

In the case of TCP traffic, which of the following correctly describes the routing table lookups performed by a FortiGate operating in NAT/Route mode, when searching for a suitable gateway?

Options

  • AA lookup is done only when the first packet coming from the client (SYN) arrives.
  • BA lookup is done when the first packet coming from the client (SYN) arrives, and a second one is
  • CThree lookups are done during the TCP 3-way handshake (SYN, SYN/ACK, ACK).
  • DA lookup is always done each time a packet arrives, from either the server or the client side.

How the community answered

(44 responses)
  • A
    5% (2)
  • B
    91% (40)
  • C
    2% (1)
  • D
    2% (1)

Why each option

For TCP traffic, a FortiGate in NAT/Route mode performs two routing table lookups: one for the initial SYN packet from the client and another for the first SYN/ACK packet from the server.

AA lookup is done only when the first packet coming from the client (SYN) arrives.

This is incomplete; a second lookup is performed for the SYN/ACK to potentially adjust the routing decision for the session.

BA lookup is done when the first packet coming from the client (SYN) arrives, and a second one isCorrect

A FortiGate performs the first routing lookup when the initial SYN packet arrives from the client to determine the egress interface and next hop. A second lookup occurs for the SYN/ACK packet from the server to ensure symmetric routing, as the FortiGate creates a session entry that includes the ingress and egress interfaces and IP addresses based on these lookups.

CThree lookups are done during the TCP 3-way handshake (SYN, SYN/ACK, ACK).

While the TCP 3-way handshake involves three packets, only two distinct routing lookups are typically performed for establishing the session, for the SYN and SYN/ACK packets.

DA lookup is always done each time a packet arrives, from either the server or the client side.

Routing lookups are generally performed per new session establishment; subsequent packets within that session follow the established session entry without repeated lookups, which would be inefficient.

Concept tested: FortiGate TCP session establishment routing lookups

Source: https://docs.fortinet.com/document/fortigate/7.4.0/admin-guides/508492/how-traffic-is-processed-by-fortigate

Topics

#Routing Table Lookup#TCP Session#FortiGate Operation#NAT/Route Mode

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice