A question about Nat traversing

[Jerry Yao <jerryyao@mail.jl.cn>]

          +----+               
          |    |
          +----+ \
          Ari's   \
          Laptop   \
         10.1.2.3   \
          +----+    \ /                +----+         
          |    |-----+-----------------|    |
          +----+    / \                +----+          
          Bob's     NATDEV             Server            
          Laptop                                               
         10.1.2.4
what is the outbound SA on Server like?
the IP address in the SA is 10.1.2.* or the  address of NATDEV.
How did the ipsec on Server pick out the SA for Ari and Bob?