Merge pull request #248687 from vhorne/fw-snat

change step order

Author: prmerger-automator[bot]

articles/firewall/snat-private-range.md

@@ -288,10 +288,10 @@ Use the portal to complete the following tasks:
 
 - Add a subnet named **RouteServerSubnet** to your existing firewall VNet. The size of the subnet should be at least /27.
 - Deploy a Route Server into the existing firewall VNet. For information about Azure Route Server, see [Quickstart: Create and configure Route Server using the Azure portal](../route-server/quickstart-configure-route-server-portal.md).
-- Modify your firewall policy to enable **Auto-learn IP prefixes (preview)** in the **Private IP ranges (SNAT)** section.
-   :::image type="content" source="media/snat-private-range/auto-learn.png" alt-text="Screenshot showing firewall policy Private IP ranges (SNAT) settings." lightbox="media/snat-private-range/auto-learn.png":::
 - Add the route server on the firewall **Learned SNAT IP Prefixes (preview)** page.
    :::image type="content" source="media/snat-private-range/add-route-server.png" alt-text="Screenshot showing firewall add a route server." lightbox="media/snat-private-range/add-route-server.png":::
+- Modify your firewall policy to enable **Auto-learn IP prefixes (preview)** in the **Private IP ranges (SNAT)** section.
+   :::image type="content" source="media/snat-private-range/auto-learn.png" alt-text="Screenshot showing firewall policy Private IP ranges (SNAT) settings." lightbox="media/snat-private-range/auto-learn.png":::
 - You can see the learned routes on the **Learned SNAT IP Prefixes (preview)** page.