PORT FWDING Help needed!!

to use a VIPGRP in a policy, you need to have selected the incoming and outgoing interfaces, as well as (perhaps; this may depend on your specific config) configured the VIP and VG that match those interfaces. 

To demonstrate that, I open the GUI and create a new IPv4 policy, and hit the + in Destination - only ADDRs and ADDRGRPs are visible. If I select an incoming and outgoing I/F, and select the Dest + again, I can see VIPGRPs.  

I also struggled with this in 6.4 It seems like we now have to create an address object for the internal IP and use that in the security policy. But this contradicts what the documentation says....