NAT has problematically constrained policy capabilities.
Does that mean that a NAT is a workable firewall but introduces
undesirable side effects?
No, it means that NAT is inherently incapable of
enforcing policy decisions at a granularity that's useful.
Melinda