If the Services field is configured in a Virtual IP (VIP), which statement is true when central NAT is used?

When configuring a Virtual IP (VIP) object, the port forwarding feature allows you to map multiple external service ports to different internal ports on the destination server. This consolidates the configuration, removing the need to create a separate VIP object for each service (e.g., one for HTTP on port 80, another for HTTPS on port 443). This functionality is independent of whether central NAT or policy-based NAT is used.

A. The Services field in a VIP defines port mapping; it does not control or prevent how SNAT and DNAT are combined in a central NAT policy.

B. VIP groups are separate objects used to bundle multiple, distinct VIP objects. The Services field configures port mapping within a single VIP.

D. This statement is the opposite of the feature's purpose. The Services field explicitly enables multiple services to connect to a server through a single VIP.

1. Fortinet. (2021). FortiGate Infrastructure Study Guide for FortiOS 7.0, p. 178. "If you enable Port Forwarding, you can configure multiple port mappings. This allows you to use a single VIP to forward traffic for different services to different ports on the real server."

2. Fortinet. (2021). FortiOS Administration Guide 7.0.1, p. 311. "Port forwarding can be used to forward a port or a range of ports. You can also map a port to another port or port range."