nerdexam
Fortinet

NSE4 · Question #63

Examine the following output from the diagnose sys session list command: session info: proto=6 proto_state=65 duration=3 expire=9 timeout=3600 flags=00000000 sockflag=00000000 sockport=443 av_idx=9…

The correct answer is C. The IP address 192.168.1.110 is being translated to 172.17.87.16. D. The FortiGate is not translating the TCP port numbers of the packets in this session. This question asks to interpret FortiGate session information, focusing on NAT translations and port behavior.

Submitted by hans_de· Apr 18, 2026Firewall Policies and Authentication

Question

Examine the following output from the diagnose sys session list command:

session info: proto=6 proto_state=65 duration=3 expire=9 timeout=3600 flags=00000000 sockflag=00000000 sockport=443 av_idx=9 use=5 origin-shaper=guarantee-100kbps prio=2 guarantee 12800Bps max 134217728Bps traffic 13895Bps reply-shaper=guarantee-100kbps prio=2 guarantee 12800Bps max 134217728Bps traffic 13895Bps state=redir local may_dirty ndr npu nlb os rs statistic(bytes/packets/allow_err): org=864/8/1 reply=2384/7/1 tuples=3 orgin->sink: org pre->post, reply pre->post dev=7->6/6->7 gwy=172.17.87.3/10.1.10.1 hook=post dir=org act=snat 192.168.1.110:57999->74.201.86.29:443(172.17.87.16:57999) hook=pre dir=reply act=dnat 74.201.86.29:443- >172.17.87.16:57999(192.168.1.110:57999) hook=post dir=reply act=noop 74.201.86.29:443->192.168.1.110:57999(0.0.0.0:0) misc=0 policy_id=1 id_policy_id=0 auth_info=0 chk_client_info=0 vd=0 npu info: flag=0x00/0x00, offload=0/0, ips_offload=0/0, epid=0/0, ipid=0/0, vlan=0/0 Which statements are true regarding the session above? (Choose two.)

Options

  • ASession Time-To-Live (TTL) was configured to 9 seconds.
  • BFortiGate is doing NAT of both the source and destination IP addresses on all packets coming
  • CThe IP address 192.168.1.110 is being translated to 172.17.87.16.
  • DThe FortiGate is not translating the TCP port numbers of the packets in this session.

How the community answered

(34 responses)
  • A
    21% (7)
  • B
    9% (3)
  • C
    71% (24)

Why each option

This question asks to interpret FortiGate session information, focusing on NAT translations and port behavior.

ASession Time-To-Live (TTL) was configured to 9 seconds.

The `expire=9` value indicates the remaining time until the session expires, not the initial configured Time-To-Live (TTL) for the session.

BFortiGate is doing NAT of both the source and destination IP addresses on all packets coming

The FortiGate is performing SNAT (source IP translation) for original packets and DNAT (destination IP translation) for reply packets; it's not simultaneously translating both source and destination IPs on all packets in the same direction.

CThe IP address 192.168.1.110 is being translated to 172.17.87.16.Correct

The output `act=snat 192.168.1.110:57999->74.201.86.29:443(172.17.87.16:57999)` explicitly shows that the original source IP `192.168.1.110` is translated to `172.17.87.16` for outgoing traffic.

DThe FortiGate is not translating the TCP port numbers of the packets in this session.Correct

The SNAT entry `192.168.1.110:57999->... (172.17.87.16:57999)` and the DNAT entry both show the source and destination TCP port numbers (`57999` and `443`) remaining unchanged after translation.

Concept tested: FortiGate session table (NAT, ports, state)

Source: https://docs.fortinet.com/document/fortigate/7.4.0/fortios-cli-reference/224217/diagnose-sys-session

Topics

#Session monitoring#NAT (Network Address Translation)#FortiGate CLI#Troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice