An ASA checks NAT rules in three sections: manual rules first, then auto (object) rules, then manual rules marked after-auto. R1 now has a route back to 192.168.1.0/24, so traffic there can keep its real address. PC1 must reach R1’s 198.51.100.1 by a second address, 10.99.99.1, which only this firewall knows.
The simulator ticks each one as soon as the network meets it.
Identity NAT: traffic from the inside to 198.51.100.0/24 keeps its real address. Use objects IN-LAN (192.168.1.0/24) and R1-LAN (198.51.100.0/24) and a manual rule: source static IN-LAN IN-LAN destination static R1-LAN R1-LAN.
Twice NAT: PC1 reaches 10.99.99.1, which is really 198.51.100.1, from 203.0.113.50. Objects PC1, PC1-OUT, FAKE and REAL, and source static PC1 PC1-OUT destination static FAKE REAL.
show nat lists both rules in section 1, ahead of the auto PAT.
PC1 reaches 10.99.99.1, and the reply comes from R1.
