This resolution KB article addresses an issue in which traffic originating from specific source IP addresses underwent unexpected source NAT translation behavior. The issue was observed in environments using firewall filters with filter-based forwarding, where traffic from certain source IPs followed a different routing path than intended. As a result, the translated source IP address did not match the expected NAT configuration.

1. Investigation revealed that a firewall filter was applied on the ingress interface with a term configured to use the routing-instance action. Due to this configuration, the route lookup for matching traffic was performed in the specified routing-instance instead of the master routing table.
2. Because source NAT processing relies on the outcome of the route lookup, using an alternate routing table caused traffic from the affected source IP addresses to undergo source NAT translation based on the routing-instance's egress path, resulting in an unexpected translated source IP address.
3. To resolve the issue, an additional firewall filter term was configured above the existing term containing the routing-instance action. This new term matched the specific source IP addresses that required route lookup in the master routing table and allowed them to bypass the filter-based forwarding logic.
4. By ensuring that these source IP addresses performed route lookup using the appropriate routing table, the source NAT translation occurred as expected and the correct translated source IP address was applied.