I am trying to understand the rationale for destination source group, where one NATs source IP addresses and source ports for flows originating from a client on the public side of the CSS.. Wouldn't those addresses be public in the first place, so wh...