Rules – how to apply NAT NAT policy should be apply to incoming traffic IP outgoing interface cannot be used in the NAT pool NAT pool must be on separate subnet (not part of interface subnet) In dynamic