security {
nat {
source {
rule-set VENDOR_NAT {
from zone VENDOR;
to zone WAN;
rule VENDOR_NO_NAT_DHCP {
match {
source-address 25.0.0.0/13;
destination-address [ 100.94.3.159/32 100.94.4.192/32 ];
destination-port {
67;
}
}
then {
source-nat {
off;
}
}
}
}
}
}
}