Cisco Cisco Firepower Management Center 4000

The list updates as you type to display matching conditions. See 

 for more information.

Click a condition in the 

 list. Use the Shift and Ctrl keys to select multiple conditions, 

or right-click and then click 

. 

Conditions you select are highlighted.

You have the following choices:

To match traffic by original destination network, click 

.

To specify the translation value for traffic that matches the translated destination network, click 

.

Alternatively, you can drag and drop selected conditions into the 

 or 

 lists.

Conditions you selected are added.

Optionally, click the add icon (

) above the 

 list to add an individual network object.

For dynamic rules, you can add multiple IP addresses, CIDR blocks, and prefix lengths to each network 
object. For static rules, you can add only a single IP address. Optionally, you can then select the object 
you added. See 

 and 

 for more information.

Optionally, click the 

 prompt below the 

 or 

 list, then type an IP address or address block and click 

.

The list updates to display your entry. See 

 for more 

information.

Save or continue editing the rule.

You must apply the NAT policy for your changes to take effect; see 

Any

You can add a port condition to a rule to match network traffic based on the original and translated 
destination port and transport protocol for translation. If the original port is not configured, any 
destination port matches the rule. If a packet matches the NAT rule and a translated destination port is 
configured, the system translates the port into that value. Note that for dynamic rules, you can specify 
only the original destination port. For static rules, you can define a translated destination port, but only 
with an object with the same protocol as the original destination port object or literal value.

The system matches the destination port against the value of the port object or literal port in the original 
destination port list for static rules, or multiple values for dynamic rules.

Because static NAT rules are one-to-one translations, the 

 list contains only port objects 

and groups that contain only a single port. For static translations, you can add only a single object or 
literal value to both the 

 or 

 lists.

For dynamic rules, you can add a range of ports. For example, when specifying the original destination 
port, you can add 

1000-1100

 as a literal value.