A utility network engineer initially deployed a FortiGate in transparent mode to bridge two segments of the back-office network, but now needs the unit to also perform source NAT for outbound traffic and to route between several newly added subnets. What must the engineer do to support this new requirement?
Select an answer to reveal the explanation.
Short Explanation
Transparent mode is a bridge, not a router, so it simply can't do what you're asking of it here. Switch the whole unit to NAT mode and give each interface its own routed address, and you unlock both source NAT and true routing between subnets.
Full Explanation
Transparent mode operates strictly at Layer 2: the FortiGate bridges frames between interfaces using a single management IP address and does not build the per-interface routing table that source NAT and inter-subnet routing depend on. Because NAT and multi-subnet routing are Layer 3 capabilities, the engineer must switch the unit to NAT mode, which requires assigning each interface a routable IP address before policies can translate addresses or route between subnets. Adding a VLAN subinterface while remaining in transparent mode only creates another bridged segment; it grants no routing or NAT capability, since the underlying mode is still Layer 2. There is no NAT setting hidden inside transparent-mode policies to enable, because those policies match and forward bridged traffic rather than translate addresses — the architecture simply does not support it. A static route in transparent mode fares no better, since transparent mode has no per-interface routing table; forwarding there is limited to the bridge. Before switching, back up the current configuration, since operating-mode changes require re-addressing every interface and are disruptive to apply live.