A firewall (like Cisco ASA, FortiGate, Palo Alto) performs NAT during packet processing:
Step-by-step:
User sends request from private IP (Inside Local)
Firewall checks NAT rules
Translates IP:
Static → fixed public IP
Dynamic → picks from pool
PAT → uses single IP + port
Firewall stores mapping in NAT table
Packet goes to internet with public IP
Response comes back
Firewall uses NAT table to send back to correct internal user