Stratix 5700 NAT

I was hoping to get some help with a Stratix 5700 switch and NAT. We are building a series of identical machines. Lots of remote I/O, etc. Each machine has a 5700 switch and talking to a single Wonderware PC on customer’s network. Drawing attached.

My switch is one big VLAN, all FA1/1 through FA1/18 and GI1/1.

The customer told me yesterday their switch is not doing any routing so it is actually layer 2 instead of layer 3 like they originally told me. So I added a public to private NAT table and got rid of the gateway settings. Pretty much followed steps in tech note 587792.

Then I was able to ping from public address to each of my 4 private address. Could also see the embedded web pages in my 1769-L33ER and Viewpoint screens from the PV+. But today it doesn’t work and I can’t figure out why. All my settings are still in the switch. Cables plugged in as they were yesterday.

Attached is network layout. Also my document with my settings. Any suggestions on how to troubleshoot this?

edit to add: Customer's public side network is using a subnet of 255.255.254 but I'm using 255.255.255.0 on the private side. I don't think this is an issue?

When I look at the NAT diagnostics it doesn’t look like any packets are hitting the switch…

follow-up

How does the subnet setting on the vlan configuration page work? (See attached.) Is it only for the private side or does it also interact with the NAT and the public to private table for layer 2 setup?

For example, assume the private ip of the switch is 192.168.1.8 and the subnet is 255.255.255.0

Then on the public to private tab, lets say I want to translate 10.99.156.100 to 192.168.1.100 and also translate 10.99.154.11 to 192.168.1.101 does the previously mentioned subnet affect anything or do I need to open it up to 255.255.248.0?