by default, no traffic is NAT'ed. To FORCE all traffic to match any sort of NAT statement, enable 'nat-control'.
Once you enable nat-control, all traffic passing from a higher security interface to a lower security interface will need to match a nat statement - static command, nat/global, nat zero.
