nerdexam
Fortinet

NSE4 · Question #347

Which of the following statements about central NAT are true? (Choose three.)

The correct answer is A. IP tool references must be removed from existing firewall policies before enabling central NAT. B. Central NAT can be enabled or disabled from the CLI only. C. Source NAT, using central NAT, requires at least one central SNAT policy. Enabling central NAT requires removing existing IP tool references from firewall policies, can only be toggled via CLI, and necessitates dedicated central SNAT policies for source NAT.

Submitted by eva_at· Apr 18, 2026FortiGate Deployment and System Configuration

Question

Which of the following statements about central NAT are true? (Choose three.)

Options

  • AIP tool references must be removed from existing firewall policies before enabling central NAT.
  • BCentral NAT can be enabled or disabled from the CLI only.
  • CSource NAT, using central NAT, requires at least one central SNAT policy.
  • DDestination NAT, using central NAT, requires a VIP object as the destination address in a firewall

How the community answered

(35 responses)
  • A
    86% (30)
  • D
    14% (5)

Why each option

Enabling central NAT requires removing existing IP tool references from firewall policies, can only be toggled via CLI, and necessitates dedicated central SNAT policies for source NAT.

AIP tool references must be removed from existing firewall policies before enabling central NAT.Correct

To avoid conflicts and ensure proper NAT rule processing, any existing IP pool configurations or source NAT settings within standard firewall policies must be removed before central NAT is enabled.

BCentral NAT can be enabled or disabled from the CLI only.Correct

Central NAT is a global system setting that must be enabled or disabled through the FortiGate command-line interface (CLI) using specific system commands, as it fundamentally changes NAT behavior.

CSource NAT, using central NAT, requires at least one central SNAT policy.Correct

In central NAT mode, source network address translation (SNAT) is no longer performed directly within firewall policies; instead, dedicated central SNAT policies must be explicitly configured and matched for source IP translation.

DDestination NAT, using central NAT, requires a VIP object as the destination address in a firewall

While Destination NAT typically uses VIP objects in firewall policies, this is a general requirement for DNAT and not a specific condition imposed by or unique to enabling central NAT itself; central NAT primarily affects SNAT policy creation.

Concept tested: FortiGate Central NAT configuration and requirements

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/994627/central-nat

Topics

#Central NAT#FortiGate NAT Configuration#Firewall Policies#CLI Configuration

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice