A utility exposes a substation's engineering-access web console to a small set of external vendor IP addresses for remote diagnostics, without giving the vendor a route into the substation's internal address space directly. External requests arrive at one of the FortiGate's public WAN addresses and must be redirected to the console's actual private address behind the firewall. Which FortiOS construct is designed to perform this kind of external-to-internal address translation for inbound traffic?
Select an answer to reveal the explanation.
Short Explanation
A virtual IP is the mirror image of the outbound NAT you already know — instead of hiding internal hosts behind one public address on the way out, it exposes one internal host behind a public address on the way in, translating destination addresses for inbound traffic.
Full Explanation
A virtual IP (VIP) object defines a mapping from an external address (and optionally a specific port) to an internal host's private address, and FortiOS uses that mapping to perform destination NAT on inbound traffic, rewriting the destination address of externally initiated sessions so they reach the correct internal host, which is exactly the direction and purpose needed to expose the substation console without routing vendors directly into internal address space. IP pools are a source-NAT construct used for outbound sessions initiated from inside the network; they are not designed for, and do not perform, inbound destination translation, so applying overload logic here misapplies a fundamentally different NAT direction. Address groups are purely organizational containers for address objects used in policy source/destination fields, FortiOS has no automatic inbound translation flag on an address group, and inventing one conflates two unrelated features. Disabling NAT on a policy does not trigger any translation at all; NAT disabled simply means the firewall performs no address rewriting for that policy's traffic, which is the opposite of what destination NAT requires. In practice, the VIP is referenced as the destination address in an inbound firewall policy, and FortiOS then rewrites the packet's destination from the public VIP address to the console's real private address before forwarding it. An engineer can confirm the mapping by reviewing the session table for an inbound session and checking that the destination address translates from the public VIP to the private console address.