NSE4 · Question #544
Examine this output from a debug flow: Which statements about the output are correct? (Choose two.)
The correct answer is B. The source IP address of the packet was translated to 10.0.1.10. C. FortiGate routed the packet through port 3. The debug flow output indicates that the packet's source IP address was translated to 10.0.1.10 and that the FortiGate routed the packet out through port 3.
Question
Examine this output from a debug flow:
Which statements about the output are correct? (Choose two.)
Exhibit
Options
- AFortiGate received a TCP SYN/ACK packet.
- BThe source IP address of the packet was translated to 10.0.1.10.
- CFortiGate routed the packet through port 3.
- DThe packet was allowed by the firewall policy with the ID 00007fc0.
How the community answered
(57 responses)- A11% (6)
- B74% (42)
- D16% (9)
Why each option
The debug flow output indicates that the packet's source IP address was translated to 10.0.1.10 and that the FortiGate routed the packet out through port 3.
Without specific TCP flag information (e.g., 'flags=0x12'), the debug flow output related to routing and NAT alone does not provide sufficient detail to confirm it was a TCP SYN/ACK packet.
A debug flow output line indicating 'snat ip=... -> 10.0.1.10' explicitly confirms that the source IP address of the packet underwent Source NAT (SNAT) to 10.0.1.10.
A debug flow output line stating 'route_lookup: matched kernel route with distance 1, output [port3]' or similar indicates that the FortiGate selected port 3 as the egress interface for the packet.
A hex value like '00007fc0' is not a standard firewall policy ID; FortiGate policy IDs are typically decimal integers (e.g., policy_id=10).
Concept tested: FortiGate debug flow interpretation (NAT and Routing)
Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-handbook/356593/debug-flow-examples
Topics
Community Discussion
No community discussion yet for this question.