NSE4 · Question #357
Examine the exhibit, which contains a virtual IP and a firewall policy configuration. The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address 10.0.1.254/
The correct answer is D. 10.200.1.10. The FortiGate is configured to source NAT Internet traffic from a workstation, where a specific one-to-one mapping translates the internal IP to a corresponding external IP.
Question
Examine the exhibit, which contains a virtual IP and a firewall policy configuration. The WAN(port1) interface has the IP address 10.200.1.1/24. The LAN(port2) interface has the IP address 10.0.1.254/24. The top firewall policy has NAT enabled using outgoing interface address. The second firewall policy configured with a virtual IP (VIP) as the destination address. Which IP address will be used to source NAT the Internet traffic coming from a workstation with the IP address 10.0.1.10/24?
Exhibit
Options
- A10.200.1.1
- B10.0.1.254
- CAny available IP address in the WAN(port1) subnet 10.200.1.0/24
- D10.200.1.10
How the community answered
(34 responses)- A15% (5)
- B3% (1)
- C9% (3)
- D74% (25)
Why each option
The FortiGate is configured to source NAT Internet traffic from a workstation, where a specific one-to-one mapping translates the internal IP to a corresponding external IP.
While 'outgoing interface address' usually means using the primary IP of the egress interface (10.200.1.1), a more specific 1:1 NAT rule for a particular source IP would take precedence if configured.
10.0.1.254 is the LAN interface IP, which is an internal IP address and would not be used as a source NAT IP for Internet traffic.
An IP pool might use any available IP, but for a specific source IP (10.0.1.10) to map to a specific public IP (10.200.1.10), a 1:1 NAT or an explicit IP pool entry is required, not just "any available IP".
For the internal IP 10.0.1.10 to be source NATted to 10.200.1.10, a specific 1:1 NAT configuration, typically an IP pool or central NAT rule, must be in place. This configuration maps the workstation's internal address to a specific public IP on the WAN interface, overriding the general 'outgoing interface address' for that particular source if configured for 1:1.
Concept tested: FortiGate Source NAT (SNAT) behavior and precedence
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/869098/one-to-one-nat
Topics
Community Discussion
No community discussion yet for this question.
