Firewall policy opens external or internal port?

I created a VIP to map (forward) external port to internal port on the server inside (e.g. 8080 to 80). When I create a firewall policy for this incoming connection, should I specify external or internal port or both in the "Service"?

If only one is enough (for example, 8080) how another (80) is managed in that case (explicitly opened or whatever...)?