Reading a NAT ticket: verification lives in the scenario, packet-tracer is the tool

Verification lives inside each scenario above — this section is for when the box misbehaves. A handful of symptoms cover the overwhelming majority of NAT tickets, and packet-tracer is the hero of all of them: it shows which rule a packet actually hits, not the one you believe it hits.

Enlarge figure: Two columns contrasting what reading a NAT configuration can tell you - first match across three sections, interleaved object and manual rules - against what packet-tracer reports: the rule the packet actually hit

Reading a NAT config and predicting the outcome is a guess. First match wins across three sections, object and manual rules interleave by their own ordering rules within a section, and a rule that looks right can still lose to one written earlier. packet-tracer skips the prediction and reports the verdict the box actually reached — read that before touching the configuration.