On the VIP object you can specify a permitted source address by set src-filter command, example:
FortiGate # sh firewall vip FAC_SSH
config firewall vip
set uuid 4fb2d328-5416-51eb-63ce-2697c2a45f2c
set src-filter "192.168.15.49"
set extip 192.168.103.10
set mappedip "10.10.10.254"
set extintf "any"
set portforward enable
set extport 2222
set mappedport 22
If both this two works, you can ensure that your rule is working as expected. However, if it doesnt work when both steps is done, i would suggest checking the port forwarding configuration under "Policy & Objects" > "Virtual IPs". Make sure that an IPv4 Virtual IP and IPv4 Virtual IP Group is created for the connection
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.