A utility wants external vendor access to a substation console's management interface, which listens only on internal TCP port 8080, but wants vendors to connect using the more familiar external port 443 on the FortiGate's public address, rather than remembering a nonstandard port. Which VIP configuration accomplishes translating both the address and the port in a single object?

A FortiOS virtual IP supports an optional port forwarding setting where the administrator specifies both an external service port and the internal 'map to' port, and the FortiGate rewrites both the destination address and the destination port of matching inbound sessions in one operation, precisely the capability needed to let vendors connect on 443 while the console keeps listening on 8080 internally. A plain address-only VIP has no port fields configured and performs no port translation at all; it forwards whatever port the external connection used straight through to the internal host on that same port number, so a vendor connecting on 443 would simply fail to reach a service listening on 8080. Splitting the requirement across two separate VIP objects doesn't reflect how VIPs work, a single VIP object is the unit that carries both the address and, when port forwarding is enabled, the port mapping together; there is no complementary port-only VIP type to pair with an address-only one. A service object defines which ports a policy matches for filtering purposes; it has no translation function of its own and cannot rewrite a destination port, that capability belongs specifically to the VIP's port forwarding fields, not to any service object referenced alongside it. To verify the mapping works, the engineer connects externally to the FortiGate's public address on 443 and confirms in the session table that the session is delivered to the console's internal address on port 8080.