A utility shares one small overload IP pool across many back-office hosts for outbound access, and the SOC needs to trace a suspicious outbound connection reported by the analytics partner back to the specific internal host that generated it, using only the shared external address and port at the time of the connection. Which IP pool feature makes this kind of per-host attribution practical at scale?

Port block allocation is an overload-pool refinement in which FortiOS assigns each internal host a defined range of ports out of the shared external address's total port space, and logs which host was allocated which block; this turns 'which host used external-address:port at time X' from a guess into a lookup, which is exactly the attribution problem described. One-to-one mapping would technically remove ambiguity by giving each host its own address, but that isn't the constraint in this scenario, the utility is deliberately sharing a small overload pool, so the answer needs to work within that shared-pool design rather than replace it. Fixed port preserves a host's original source port rather than assigning it a distinct range, which does not solve the attribution problem on a shared address, because multiple hosts using naturally similar or colliding source ports offers no reliable, loggable way to separate them. Central NAT is an architectural choice about where NAT rules are configured and ordered, it is not what generates per-host port attribution; port block allocation logging is available regardless of whether NAT is configured centrally or per-policy. To use this operationally, the SOC cross-references the FortiGate's port-block-allocation log for the reported external address and port at the relevant timestamp to identify which internal host held that block.