VNAT should always be your first choice for inbound connections.
Virtual NAT is essentially an application proxy. This means that the Edge appliance passes applications from the WAN to the LAN network.
VNAT can NOT be used under the following circumstances:
1) If the application is UDP-based (i.e. DNS, SNMP, etc)
2) If you have multiple servers but only a single WAN address
3) If you are using Passive FTP (VNAT only supports Active)
4) If you are using most VPN applications (IPSec, etc, they shoudl use 1-to-1)
5) If you are using any VoIP appliction (they should also use 1-to-1)
Always make sure to setup firewall rules to allow these incoming connections after the VNAT rule has been configured.