Which of the following statements about central NAT are true? (Choose two.)

When enabling Central NAT, the NAT configuration is decoupled from firewall policies. Before switching, any NAT-related settings, such as IP pool references, must be removed from existing firewall policies to prevent configuration conflicts. Once Central NAT is active, source NAT is no longer configured in the firewall policy; instead, it is managed by creating specific policies in the Central SNAT policy table. At least one Central SNAT policy is required to perform source address translation for outbound traffic.

B. Central NAT can be enabled or disabled from the GUI under System > Feature Visibility, not just from the CLI.

D. In Central NAT mode, a firewall policy's destination is the real (internal) IP address. A Central DNAT policy handles the translation, not a VIP object in the firewall policy.

1. FortiOS 7.0.0 Firewall Handbook, "Central NAT," Page 101: "When Central NAT is enabled, NAT is configured in a single table... Source NAT is configured by creating a policy in the central SNAT policy table."

2. FortiOS 7.0.0 Firewall Handbook, "Enabling central NAT," Page 102: "Before enabling central NAT, you must remove any IP pool references from existing firewall policies."

3. FortiOS 7.0.0 Firewall Handbook, "Central DNAT + virtual IPs," Page 106: "The firewall policy is configured with the VIP's mapped IP address as the destination address." (This describes the firewall policy configuration, where the destination is the real IP, not the VIP object itself as in policy NAT).