During a firewall change review at a logistics firm, an engineer sees that a manual NAT rule covering the whole 10.40.0.0/16 subnet, placed before the automatic NAT section, supplies the translation for a server session, even though an automatic NAT rule on that server object matches the same session and is far more specific. Which FMC NAT evaluation behavior explains this outcome?
Select an answer to reveal the explanation.
Short Explanation
Your manual NAT rule is evaluated before the automatic section, so FMC never reaches the more specific automatic rule. Think of it as a checklist: the first matching item wins, and first-match evaluation ends the search.
Full Explanation
FMC evaluates the manual NAT section placed before automatic NAT rules first. Within that section, rules are considered in their configured order, and the first matching rule supplies the translation; FMC does not continue to the more-specific automatic rule. Longest-prefix matching across NAT sections does not determine the result: section precedence and rule order apply instead. Although manual rules are checked before automatic rules, FMC does not compare every matching rule and then select the most specific translation; a match ends the search. Nor does FMC automatically sort the manual section from narrowest to broadest subnet: configured order matters. Exam caveat: “manual NAT” alone does not guarantee evaluation before automatic NAT; placement in the NAT policy section matters, because manual rules can also appear after the automatic section. Practical check: inspect the deployed NAT policy’s section placement, rule order, and match criteria, then confirm the selected rule using device-side packet-tracer output or relevant rule hit counters.