Coming from other platforms, it's a bit of a disconnect that the firewall groups aren't usable universally. There might be other places where it could be appropriate to use them, but NAT is one that comes to mind.
For example:
set firewall group network-group PRIVATE-NETWORKS network '10.0.0.0/8' set firewall group network-group PRIVATE-NETWORKS network '192.168.0.0/16' set firewall group network-group PRIVATE-NETWORKS network '172.16.0.0/12'
It would be nice to have something like:
set nat source rule 102 outbound-interface 'eth0' set nat source rule 102 source network-group PRIVATE-NETWORKS set nat source rule 102 translation address 'masquerade'
Obviously the same could apply for port-groups, address-groups, etc.