Hi there,
I know this question is pretty old but I wanted to see if I could give it an answer in case anyone ever stumbled on it again. Currently, to my knowledge, FTD does not support any kind of VIP object (similar to the FortiGate VIP that does the NAT for you) and any NATing will need to be done purely through the NAT section of FDM / CDO / FMC / etc.
You can think of it in terms of (very simplied, and poorly written) ASA code like the following:
nat (wan,dmz) source static Server-Public Server-Private service HTTP HTTPS
In essence, the Server-Public address from the above example would be a pseudo-VIP as your wan interface isn't necessarily assigned that IP.
For this example, you'd also want to write your ACLs to allow inbound traffic to your Server-Private subnet specifically:
access-list WAN-TO-WEBDMZ extended permit tcp any object Server-Private eq http https
Hope this helps. If I've made any mistakes, please let me know and I'll get them corrected ASAP. Thanks!
