Hello Wonglili
These three statements are completely different, so this is why only the first one is working as expected with your NAT configuration.
The first statement matches all addresses ranging from 192.168.12.0 to 192.168.12.255.
The second statement matches only the single IP address of 192.168.12.0. When you don’t specify a wildcard mask, the command assumes a wildcard mask of 0.0.0.0. So, the following three commands are identical, since all three match and permit the single address of 192.168.12.0:
NAT(config)#access-list 1 permit 192.168.12.0
NAT(config)#access-list 1 permit 192.168.12.0 0.0.0.0
NAT(config)#access-list 1 permit host 192.168.12.0
Now the third statement is interesting. Remember that a wildcard mask indicates that wherever there is a “0” the bits of the address must remain the same. Wherever there is a “1” we can have anything. (This is the opposite of a subnet mask). With a wildcard mask of 255.255.255.0, where the last octet is all zeros in binary, this means that the last octet must remain the same and the first three octets can be anything.
Taking a look at 192.168.12.0, this means that the access list will match and permit any IPv4 address that has the last octet of zero. So it will match the following IPv4 addresses:
0.0.1.0
0.0.2.0
0.0.3.0
0.0.4.0
...
0.0.255.0
0.1.0.0
0.1.1.0
0.1.2.0
...
255.255.253.0
255.255.254.0
255.255.255.0
In other words, every combination of IPv4 address where the last octet is zero. This is not matching at all what you want for your NAT, so this is why it is not working. Take a look at this NetworkLessons note on ACL wildcard masks for more information.
I hope this has been helpful!
Laz