The two sites use non-overlapping private subnets and should preserve original source identities. What is the usual source-NAT choice on their site-to-site forward policies?

Choose the single best answer.

A.Use a VIP as a substitute for peer authentication.
B.Keep SNAT disabled unless a deliberate translation requirement exists.
C.Enable SNAT because a VPN interface always requires public source addresses inside selectors.
D.Enable every available IP pool simultaneously.

Show the answer and explanation

✓ Correct answer

Keep SNAT disabled unless a deliberate translation requirement exists.

Ordinary non-overlapping site-to-site designs preserve private addresses with NAT disabled. VPN carriage does not inherently require public translated inner sources. Pools and VIPs do not replace the configured identity/selector design or authenticate peers.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.