This is the sequence in which the translation commands are prioritized by the PIX Firewall:

1. nat 0 access-list (nat-exempt)
   
   
2. match against existing xlates
   
   
3. static statements
   
   
   1. static nat with and without access-list (first match)
      
      
   2. static pat with and without access-list (first match) 
      
      
4. nat  
   
   
   1. nat access-list (first match)  
      
      Note: The nat 0 access-list command is not part of this command.
      
      
   2. nat (best match)  
      
      Note: When choosing a global address from multiple pools with the same NAT ID, this order is attempted:   
      
      
      1. If the ID is 0, create an identity xlate.
         
         
      2. Use the global pool for the dynamic NAT.
         
         
      3. Use the global pool for the dynamic PAT.
         
         
5. Error
   
   NAT 0 STATEMENT:
   
   nat (inside_interface_name) 0 
   
   NAT 0 has two affects:
   
   
   1. nat (inside_interface_name) 0 access-list 101    
      
      This works exactly the same way as static, except it bypasses NAT.  It does not require the connection to be initiated from the higher security interface before the host on the lower security interface can create a connection to the host on the higher security level interface.
      
      
   2. nat (inside_interface_name) 0 0.0.0.0 0.0.0.0        
      
      This bypasses NAT, but requires the host on the higher security interface to first initiate a connection to the host on the lower security interface before the host on the lower security interface can initiate
      a connection.

Refer to these documents for more information on these commands:

• static
  
  
• nat
  
  
• NAT Order of Operation