Identity NAT: exempting traffic from a broader rule
Identity NAT translates an address to itself. It exists to carve an exemption out of a rule that would otherwise match — and it only works if it outranks that rule.
Cheat Sheets & Cards
Quick Reference
Cheat-sheet cards for the mechanisms every exam leans on — one mechanism per card, course-independent, growing as the library publishes.
NAT rule order: three sections, first match wins
The NAT rule table is one list, read top to bottom — the first rule that matches ends the search. Three sections decide where a rule lands: your own manual order, then the device's own object/auto rules, then your manual order again.
Reading a NAT ticket: verification lives in the scenario, packet-tracer is the tool
NAT troubleshooting starts from the same place on every platform: the box already told you which rule won, if you ask it with packet-tracer instead of guessing from the config.