A Virtual IP (VIP) in FortiGate is a core object used for Destination Network Address Translation (DNAT). Its primary purpose is to map a public, external IP address to a private, internal IP address. This translation allows inbound traffic initiated from an external network (like the internet) to be forwarded to a specific server (such as a web or mail server) located on an internal, protected network. VIPs can also perform port forwarding, translating not only the IP address but also the destination port, which is essential for publishing internal services securely.

B. VLANs are configured as distinct virtual sub-interfaces on a physical or aggregate interface, not through VIP objects.

C. Secondary IP addresses are configured directly on an interface to allow it to respond to multiple addresses, which is different from a VIP's NAT function.

D. While VIPs can be configured for server load balancing, their function is not specifically for VPN tunnels; VPN load balancing uses different mechanisms.

1. Fortinet FortiOS 7.4.0 Administration Guide

Firewall > NAT > Virtual IPs (VIPs)

Page 1.

"A virtual IP (VIP) is a FortiGate feature that translates a public IP address to a private IP address. When traffic from the internet is sent to the public IP address

the FortiGate unit translates the public IP address to the private IP address and forwards the traffic to the correct destination."

2. Fortinet Cookbook

Configuring a virtual IP (VIP) for port forwarding

Document ID: FD35172.

"A virtual IP (VIP) is used to map an external IP address to an internal IP address. This allows you to have a server on your internal network that can be accessed from the Internet."

3. Fortinet FortiOS 7.4.0 Networking Guide

NAT > Destination NAT (DNAT)

Page 1.

"Destination NAT (DNAT) changes the destination address of packets passing through the FortiGate unit. It is typically used to forward traffic from the internet to a server on a private network. DNAT is configured using virtual IPs (VIPs) and VIP groups."