NAT: who becomes whom, and why the reply comes back
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
NAT rewrites the addresses (and, with PAT, the ports) in the header of packets that cross from an inside interface to an outside one, remembers the pair in a table and uses it in reverse for the replies. Static is permanent and bidirectional; dynamic and PAT create the entry at the first packet from inside. Inside → outside, the router routes first and translates after; outside → inside, the other way around — hence the rule “ACL on inside with local addresses, on outside with global addresses”. Whatever carries addresses in the payload (FTP, SIP) needs an ALG, whatever has no ports (ESP, GRE) needs NAT-T, and VPN traffic must be excluded from the NAT ACL. The same ideas lead to NAT64 for IPv6 and to CGN at the ISP, where port blocks, logging and EIM / EIF behavior matter.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms and standards. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of a company's telephone switchboard: the employees have extension numbers, the company has a few public numbers, and the receptionist writes in her notebook who called on which line, so she can put people through when someone calls back. The director has a direct number, and when lines are scarce, each call gets a reference.
The model holds up to §9. From §10 on (NAT64, CGN, HA), it gets stretched; see the full analogy and its limits in §15.