How does Secure Connect deal with NAT rules?

[Bucket]

If spokes receive a default route from the SC hubs, does that mean NAT (1:1, 1:many, port forwards) on the spoke stops working when SC is enabled?

[PhilipDAth]

I haven't tested this - but I would expect this to be the case (nat stops working).

You would need to change the device to being in hub mode so its Internet didn't go via SecureConnect.

BUT - could you configure it as a zero trust application and access it using that method?