NAT: central vs policy
central NAT · policy-based NAT
whether NAT is configured on each firewall policy, or in separate central SNAT / DNAT tables evaluated independently
A per-VDOM setting. The exam tests the evaluation difference, not just the config location.
How it is read
Policy NAT (default)
mode
NAT is a checkbox on the firewall policy that already matched. SNAT = "use outgoing interface address" or an IP pool; DNAT = a VIP referenced as the destination address (the VIP creates its own implicit inbound rule). Simple: one policy, one NAT decision.
Central NAT
mode
Firewall policies only allow/deny — they carry no NAT. SNAT lives in the Central SNAT table (ordered, first-match, its own rules), DNAT in DNAT & Virtual IPs. The DNAT/VIP table is consulted before policy lookup (it can rewrite the destination the policy then matches on). More moving parts, but SNAT rules aren't tied 1:1 to policies — useful at scale.