nerdexam
Fortinet

NSE4 · Question #264

In the Tunnel Mode widget of the web portal, the administrator has configured an IP Pool and enabled split tunneling. Which of the following statements is true about the IP address used by the SSL…

The correct answer is A. The IP pool specified in the SSL-VPN Tunnel Mode Widget Options will override the IP address. When an IP Pool and split tunneling are configured for SSL VPN tunnel mode, the SSL VPN client will receive its IP address from the pool specified in the Tunnel Mode Widget Options.

Submitted by deeparc· Apr 18, 2026VPN and Routing

Question

In the Tunnel Mode widget of the web portal, the administrator has configured an IP Pool and enabled split tunneling. Which of the following statements is true about the IP address used by the SSL VPN client?

Options

  • AThe IP pool specified in the SSL-VPN Tunnel Mode Widget Options will override the IP address
  • BBecause split tunneling is enabled, no IP address needs to be assigned for the SSL VPN tunnel
  • CThe IP address range specified in SSL-VPN Settings will override the IP address range in the

How the community answered

(32 responses)
  • A
    88% (28)
  • B
    9% (3)
  • C
    3% (1)

Why each option

When an IP Pool and split tunneling are configured for SSL VPN tunnel mode, the SSL VPN client will receive its IP address from the pool specified in the Tunnel Mode Widget Options.

AThe IP pool specified in the SSL-VPN Tunnel Mode Widget Options will override the IP addressCorrect

The IP pool configured within the SSL-VPN Tunnel Mode Widget Options is explicitly used to assign an IP address to the SSL VPN client for the tunnel interface, and this setting takes precedence for client IP assignment regardless of split tunneling being enabled.

BBecause split tunneling is enabled, no IP address needs to be assigned for the SSL VPN tunnel

Even with split tunneling enabled, an SSL VPN tunnel still requires an IP address for the client to establish and operate the tunnel itself.

CThe IP address range specified in SSL-VPN Settings will override the IP address range in the

The IP address range specified in SSL-VPN Settings generally defines broader parameters, but the IP Pool within the Tunnel Mode Widget Options specifically dictates the range for client tunnel IP addresses, overriding more general settings if configured.

Concept tested: FortiGate SSL VPN Client IP Assignment

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/707412/configuring-ssl-vpn-settings

Topics

#SSL VPN#IP Pool#Split Tunneling#FortiGate Configuration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice