NSE4 · Question #347
Which of the following statements about central NAT are true? (Choose three.)
The correct answer is A. IP tool references must be removed from existing firewall policies before enabling central NAT. B. Central NAT can be enabled or disabled from the CLI only. C. Source NAT, using central NAT, requires at least one central SNAT policy. Enabling central NAT requires removing existing IP tool references from firewall policies, can only be toggled via CLI, and necessitates dedicated central SNAT policies for source NAT.
Question
Which of the following statements about central NAT are true? (Choose three.)
Options
- AIP tool references must be removed from existing firewall policies before enabling central NAT.
- BCentral NAT can be enabled or disabled from the CLI only.
- CSource NAT, using central NAT, requires at least one central SNAT policy.
- DDestination NAT, using central NAT, requires a VIP object as the destination address in a firewall
How the community answered
(35 responses)- A86% (30)
- D14% (5)
Why each option
Enabling central NAT requires removing existing IP tool references from firewall policies, can only be toggled via CLI, and necessitates dedicated central SNAT policies for source NAT.
To avoid conflicts and ensure proper NAT rule processing, any existing IP pool configurations or source NAT settings within standard firewall policies must be removed before central NAT is enabled.
Central NAT is a global system setting that must be enabled or disabled through the FortiGate command-line interface (CLI) using specific system commands, as it fundamentally changes NAT behavior.
In central NAT mode, source network address translation (SNAT) is no longer performed directly within firewall policies; instead, dedicated central SNAT policies must be explicitly configured and matched for source IP translation.
While Destination NAT typically uses VIP objects in firewall policies, this is a general requirement for DNAT and not a specific condition imposed by or unique to enabling central NAT itself; central NAT primarily affects SNAT policy creation.
Concept tested: FortiGate Central NAT configuration and requirements
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/994627/central-nat
Topics
Community Discussion
No community discussion yet for this question.