nerdexam
Fortinet

NSE4 · Question #357

Examine the exhibit, which contains a virtual IP and a firewall policy configuration. The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address 10.0.1.254/

The correct answer is D. 10.200.1.10. The FortiGate is configured to source NAT Internet traffic from a workstation, where a specific one-to-one mapping translates the internal IP to a corresponding external IP.

Submitted by brentm· Apr 18, 2026Firewall Policies and Authentication

Question

Examine the exhibit, which contains a virtual IP and a firewall policy configuration. The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address 10.0.1.254/24. The top firewall policy has NAT enabled using outgoing interface address. The second firewall policy configured with a virtual IP (VIP) as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?

Exhibit

NSE4 question #357 exhibit

Options

  • A10.200.1.1
  • B10.0.1.254
  • CAny available IP address in the WAN(port1) subnet 10.200.1.0/24
  • D10.200.1.10

How the community answered

(34 responses)
  • A
    15% (5)
  • B
    3% (1)
  • C
    9% (3)
  • D
    74% (25)

Why each option

The FortiGate is configured to source NAT Internet traffic from a workstation, where a specific one-to-one mapping translates the internal IP to a corresponding external IP.

A10.200.1.1

While 'outgoing interface address' usually means using the primary IP of the egress interface (10.200.1.1), a more specific 1:1 NAT rule for a particular source IP would take precedence if configured.

B10.0.1.254

10.0.1.254 is the LAN interface IP, which is an internal IP address and would not be used as a source NAT IP for Internet traffic.

CAny available IP address in the WAN(port1) subnet 10.200.1.0/24

An IP pool might use any available IP, but for a specific source IP (10.0.1.10) to map to a specific public IP (10.200.1.10), a 1:1 NAT or an explicit IP pool entry is required, not just "any available IP".

D10.200.1.10Correct

For the internal IP 10.0.1.10 to be source NATted to 10.200.1.10, a specific 1:1 NAT configuration, typically an IP pool or central NAT rule, must be in place. This configuration maps the workstation's internal address to a specific public IP on the WAN interface, overriding the general 'outgoing interface address' for that particular source if configured for 1:1.

Concept tested: FortiGate Source NAT (SNAT) behavior and precedence

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/869098/one-to-one-nat

Topics

#Firewall Policies#Source NAT#One-to-one NAT#FortiGate NAT

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice