In a Next-Generation Firewall (NGFW), Network Address Translation (NAT) must be categorized according to the mode of operation, primarily including the following three types:

Source NAT (SNAT): Converts the source IP addresses of internal network hosts to the firewall’s external IP address, enabling address hiding and traffic forwarding when internal hosts access external networks.

Destination NAT (DNAT): Converts the destination IP address of incoming traffic to the internal server’s IP address, allowing external users to access internal services.

Bidirectional NAT: Supports both source and destination address translation, suitable for complex network scenarios such as two-way communication between internal and external networks or traffic mapping across multiple egress points.

By clearly distinguishing between different NAT types, the NGFW can achieve flexible and efficient address translation and traffic control across various network scenarios.

Note: The current tool does not support automatic configuration conversion for Central NAT scenarios. This means that if a Central NAT setup is used in the network, the relevant NAT policies must be manually reconfigured on the target firewall to ensure correct address translation and traffic forwarding.