NAT on Layer 3 interfaces: source NAT (DIPP, dynamic IP, static), destination NAT, U-turn NAT, pre-NAT IP vs post-NAT zone in security rules

Network Address Translation (NAT) rewrites addresses as traffic crosses the firewall. PAN-OS handles NAT in its own rulebase (Policies > NAT), separate from security rules, and evaluates it top-down with the first match winning. Only one NAT rule applies to a session, so a rule can translate both source and destination at once if needed. NAT is normally done on Layer 3 interfaces; virtual wire supports some NAT too, but the exam focuses on Layer 3. Understanding NAT is essential because nearly every Internet-facing design uses it, and misreading how NAT and security policy interact is the most common cause of rules that never match.