If the Services field is configured in a Virtual IP (VIP), which of the following statements is true when central NAT is used?

A Virtual IP (VIP) object in FortiOS is used to perform Destination NAT (DNAT). Within a single VIP object, the port forwarding feature (referred to as the Services field in some contexts) allows an administrator to define multiple port mapping rules. Each rule maps a specific external port and protocol to a corresponding internal port. This functionality consolidates configuration by allowing a single VIP object to handle various services (e.g., HTTP, HTTPS, RDP) destined for the same internal server, thereby eliminating the need to create a separate VIP object for each individual service.

B. VIP groups are used to bundle multiple, separate VIP objects together, typically for load balancing or policy simplification, not for bundling services within a single VIP.

C. The Services field within a VIP object defines the DNAT port translation; it does not impose any restrictions on whether Source NAT (SNAT) can be applied in the same policy.

D. The Services field explicitly enables traffic for multiple defined services from various sources (as defined in the firewall policy) to connect to a single mapped server.

---

1. Fortinet FortiOS 7.4.0 Administration Guide:

Section: Firewall objects > Virtual IPs > Static NAT VIPs

Content: The guide explains the configuration of a VIP with port forwarding enabled. It states

"You can add multiple port forwarding entries to a VIP." This directly confirms that a single VIP can handle multiple services

supporting the correct answer (A). The guide also describes VIP Groups as collections of VIP objects

which invalidates option B.

2. Fortinet FortiOS 7.4.0 Administration Guide:

Section: Central NAT > DNAT & SNAT policies

Content: This section details how to create central NAT policies. It shows that a VIP object is used as the Destination Address for DNAT. The policy configuration allows for a separate IP Pool to be configured for SNAT within the same rule

demonstrating that DNAT and SNAT can be combined

which invalidates option C. The function of the VIP's internal service mapping is independent of this policy structure.