🛡️ ToastFort

NAT: central vs policy

central NAT · policy-based NAT

whether NAT is configured on each firewall policy, or in separate central SNAT / DNAT tables evaluated independently

A per-VDOM setting. The exam tests the evaluation difference, not just the config location.

How it is read

Policy NAT (default)

mode

NAT is a checkbox on the firewall policy that already matched. SNAT = "use outgoing interface address" or an IP pool; DNAT = a VIP referenced as the destination address (the VIP creates its own implicit inbound rule). Simple: one policy, one NAT decision.

Central NAT

mode

Firewall policies only allow/deny — they carry no NAT. SNAT lives in the Central SNAT table (ordered, first-match, its own rules), DNAT in DNAT & Virtual IPs. The DNAT/VIP table is consulted before policy lookup (it can rewrite the destination the policy then matches on). More moving parts, but SNAT rules aren't tied 1:1 to policies — useful at scale.

In the corpus (1)

Firewall policies & authentication