The documentation on that part is OLD....
The ASA doesn't use the nat 0 syntax anymore since two years or more.
To explain why you need to disable nat for ipsec traffic.
On an ASA you configure NAT in network objects which is called AutoNAT and goes into section 2.
You also have manual NAT rules that go into section 1 (before AutoNAT) and section 3 (after AutoNAT).
So the NAT rules are processed just like firewall rules. First match is used as rule.
In both Auto and Manual NAT rules you have to specify the incoming and outgoing interface and the inverse rule is implicitly made.
This part is the most important part so pay attention to this:
In most cases you would use AutoNAT which uses a network object.
So you would define one of your inside networks in a network object and then inside that object say nat(inside,outside)dynamic interface.
That means if traffic coming FROM the matching subnet into the INSIDE interface and leaving the OUTSIDE interface it will get a dynamic PAT to the interface IP.
This means that ALL traffic would be translated. Also the IPsec traffic that happens to also leave through the outside interface. So you would send all your packets to the network on the other side of the IPsec tunnel but change the source IP to the outside interface IP. As a consequence, return traffic would not be sent back inside the tunnel and dropped at the ASA because of a lacking session.
So you need to make a manual NAT rule in section 1 that will take precedence over the AutoNAT rule that says for traffic coming from source network to destination network, inside interface to outside interface do not NAT.
So that one is matched first and traffic will not be natted.
