Firepower Auto NAT with interface group and Zone

There are two types of interface objects: security zones and interface groups. The key difference is that interface groups can overlap. Only security zones can be used in access control policy rules.

An interface can belong to only one security zone, which are strictly required for Access Control Policy rules. Conversely, an interface can belong to multiple interface groups, which are designed to support overlapping configurations in NAT, QoS, or prefilter policies.

An overlapping configuration happens when a single physical or logical interface needs to belong to multiple traffic-handling rules at the same time. Because interface groups allow the same interface to be a member of multiple groups, they make these scenarios possible.

1. Dual-Purpose Guest and IoT Isolation (NAT)

You have a physical DMZ interface (GigabitEthernet0/2) that hosts both corporate guest Wi-Fi and smart office IoT devices.

• The Overlap: You create two distinct Interface Groups: Guest_Group and IoT_Group. You place the GigabitEthernet0/2 interface into both groups.
• The Application: You can now write one NAT policy that translates Guest_Group traffic to Web Server A, and a completely separate NAT policy that translates IoT_Group traffic to Web Server B, even though the traffic originates from the exact same interface. [1]

LAB FTD 7.4

FTD has two outside interface, for LAN network objest, only one Auto-NAT can be created

1. When try to create another Auto-NAT with destination Interface Object Zone-Outside2, got the error:

2. When try to add outside2 interface to the same zone Zone-Outside which interface outside belongs to, got the error:

2 Solutions:

1. Create  NAT Rules Before or NAT Rules After with Interface Group instead of Auto NAT

2. Instead of Auto NAT, create  NAT Rules Before or NAT Rules After with Zone-Outside contains both outside interfaces