> Source: [sk98989](https://support.checkpoint.com/results/sk/sk98989)

# sk98989 - How to configure Automatic NAT rules in specific order

| Property | Value |
|----------|-------|
| Solution ID | sk98989 |
| Date Created | 2014-04-08 |
| Last Modified | 2025-01-15 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |

## Solution

When configuring Automatic NAT settings in a Host / Network object, the Management Server creates Automatic NAT rules in the NAT rulebase.

Security Gateway administrators might need to implement *Automatic* NAT rules for a large network, and additional *Automatic* NAT rules for a subnet that is encompassed by the large network.

To ensure that the more specific Automatic NAT rule is applied first in the NAT rulebase, make sure that more specific Automatic NAT rule is created above the NAT rule for the larger network.

*Example*:
----------

**Goal:**

1. Large network 10.0.0.0/8 must be hidden behind IP address 172.21.1.1  

2. Subnet 10.10.200.0/24 (which is a part of 10.0.0.0/8) must be hidden behind IP address 192.168.1.1  

3. The NAT rule for 10.10.200.0/24 must be applied before the NAT rule for 10.0.0.0/8

**Action plan:**

By design, the Management Server creates Automatic NAT rules in the **alphabetical order** and it is not possible to move them, you should configure the names of your objects and enable NAT in a **specific order**:

1. The name of "Subnet" object should be alphabetically located **above** the name of "Large network" object  

2. The NAT should be first enabled in the "Subnet" object, and only then in the "Large network" object

**Procedure:**

1. Create the 'Network' object for Subnet 10.10.200.0/24 - for example, with the name "`Network_A`"  

2. Create the 'Network' object for Large network 10.0.0.0/8 - for example, with the name "`Network_B`"  

3. Enable NAT in object for Subnet 10.10.200.0/24 ("`Network_A`")  

4. Enable NAT in object for Large network 10.0.0.0/8 ("`Network_B`")  

5. Check the NAT rulebase - the rules for Subnet 10.10.200.0/24 ("`Network_A`") should appear above the rules for Large network 10.0.0.0/8 ("`Network_B`")

   If the names of the objects are alphabetically correct, but the order of Automatic NAT rules is wrong (e.g., the NAT rules for "`Network_B`" appear above the NAT rules for "`Network_A`"), then:
   * disable the NAT in the object, whose NAT rules appear above (in this case - disabe NAT in the "`Network_B`" object)  

   * re-enable the NAT in the object (in this case - re-enable NAT in the "`Network_B`" object)

   <br />

   <br />

6. Publish the changes.  

7. Install the Access Control policy.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content