Exam NSE4_FGT-6.0 topic 1 question 109 discussion

Actual exam question from Fortinet's NSE4_FGT-6.0

Question #: 109
Topic #: 1

Which statements are true regarding firewall policy NAT using the outgoing interface IP address with fixed port disabled? (Choose two.)

A. This is known as many-to-one NAT.
B. Source IP is translated to the outgoing interface IP.
C. Connections are tracked using source port and source MAC address.
D. Port address translation is not used.

Show Suggested Answer

Suggested Answer: AB 🗳️

by topicx at Oct. 2, 2019, 3:06 p.m.

Comments

Submit Cancel

Jevza

Highly Voted 3 years, 10 months ago

Answer is B&D because the fixed port is disabled, then no port address translation will take place

upvoted 5 times

...

herlock_sholmes_2810

Most Recent 4 months, 1 week ago

Selected Answer: AB

A. and B. "When you select Use Outgoing Interface Address on the matching firewall policy, FortiGate uses the egress interface address as the NAT IP for performing SNAT. If there are multiple devices behind FortiGate, FortiGate performs many-to-one NAT. This is also known as PAT. FortiGate assigns to each connection sharing the egress interface address a port number from a pool of available ports. The assignment of a port enables FortiGate to identify packets associated with the connection and then perform the corresponding translation. This is the same behavior as the overload IP pool type, which you will also learn about. Optionally, you may select a fixed port, in which case the source port translation is disabled. With a fixed port, if two or more connections require the same source port for a single IP address, only one connection is established." Reference: FortiGate 7.4 Administrator Study Guide, page 56

upvoted 1 times

...