To Customize the Bootstrap.xml File for deploying the AWS CFT in your production environment, you must copy the following NAT policy rule into your configuration file. You can find the NAT rule and address objects in the bootstrap.xml file in the GitHub repository.
NAT Policy Rule
<nat>
<rules>
<entry name="nat-for-asg">
<to>
<member>Untrust</member>
</to>
<from>
<member>any</member>
</from>
<source>
<member>any</member>
</source>
<destination>
<member>AWS-NAT-UNTRUST</member>
</destination>
<service>any</service>
<to-interface>ethernet1/1</to-interface>
<destination-translation>
<translated-address>AWS-NAT-ILB</translated-address>
</destination-translation>
<source-translation>
<dynamic-ip-and-port>
<interface-address>
<interface>ethernet1/2</interface>
</interface-address>
</dynamic-ip-and-port>
</source-translation>
</entry>
</rules>
</nat>
NAT Policy Address Objects
<address>
<entry name="AWS-NAT-ILB">
<ip-netmask>192.168.12.223</ip-netmask>
<description>ILB-IP-address</description>
</entry>
<entry name="AWS-NAT-UNTRUST">
<ip-netmask>192.168.11.115</ip-netmask>
<description>UNTRUST-IP-address</description>
</entry>
</address>

Related Documentation