Hi,
I guess you already asked something like this on the previous thread.
If you situation is still so that NO HOSTS need to be NATed through the firewall then you can simply LEAVE OUT ALL NAT configurations.
Generally when people need to exempt hosts from NAT they usually only have certain destination networks for which this should apply. (VPN connections). So you usually define destination parameters for the NAT configuration also.
Then you might naturally have public subnets behind the firewall that dont need NAT. As long as no other NAT rule matches these public subnets as a source then you can simply leave out all NAT configuration.
From what I tested I wouldnt probably suggest the above NAT configuration even though I mentioned it in the other thread. It might possibly even cause problems.
I would suggest the other format which basically is that you define the source networks behind that interface under an "object-group network" and then configure the NAT rule
object-group network NETWORKS
network-object
network-object
nat (interface,any) source static NETWORKS NETWORKS
Pretty hard to say more than that when dont have exact picture of the situation.
- Jouni
