An administrator runs a FortiGate in per-policy NAT mode and builds one LAN-to-wan1 policy with action ACCEPT and NAT enabled, selecting an overload IP pool that contains a small contiguous range of public addresses. Several hundred private LAN hosts browse the internet through this single policy. Which two statements correctly describe how this overload IP pool translates the outbound source addresses? Select TWO.
- AEach internal host's source address is translated to one of the pool's public addresses, and port translation lets many hosts share each public address at the same time. Correct
- BThe pool translates the destination address of inbound replies instead, mapping the public range back to the original internal hosts on the return path.
- CThe pool draws from its range of public addresses and uses source port translation, so the number of concurrent sessions is not limited to the count of addresses in the pool. Correct
- DBecause it is an overload pool, each internal host is permanently reserved one dedicated public address for the life of the device, with no port reuse.
- EThe pool leaves the source address unchanged and only rewrites the source port, so packets exit carrying their original private LAN addresses.
Why A is correct: Correct: an overload pool performs many-to-few source NAT, rewriting the source port so multiple internal hosts can be multiplexed behind each public address in the range.
Why B is wrong: This is tempting because translated sessions do have a return path, but an IP pool only ever performs source NAT on outbound traffic; destination translation toward internal hosts is the job of a virtual IP.
Why C is correct: Correct: because overload reassigns source ports, each public address supports many simultaneous sessions, so session capacity far exceeds the small number of addresses in the range.
Why D is wrong: This describes one-to-one pool behaviour, not overload; an overload pool deliberately shares addresses through port translation rather than pinning one address per host.
Why E is wrong: An overload pool rewrites the source address to a routable public address from the range as well as the port; private source addresses would not be routable on the internet.