IP Services · Topic 1 of 9
Inside Source NAT: Static and Pools
Learn how inside source NAT works on a Cisco router, with static and pool translations, the four NAT address terms, and the commands to verify them.
- 6 min
- Exam objective 4.1
- Includes a diagram
- Inside source NAT changes the source address of traffic leaving the inside network.
- Inside local is the private address. Inside global is the public one.
- You need at least one
ip nat insideand oneip nat outsideinterface.
What it is
NAT swaps one IP address for another as a packet crosses a router.
Private addresses such as 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 cannot be routed on the internet. NAT replaces them with a public address on the way out and reverses the swap on the way back.
Inside source NAT changes the source address of packets that start inside your network. The inside host keeps its private address. Only the router rewrites it.
There are three styles:
- Static NAT: one fixed inside address maps to one fixed public address.
- Dynamic NAT with a pool: the router hands out public addresses from a range, one per host, as hosts need them.
- PAT (overload): many hosts share one public address, told apart by port number.
The objective names static and pools. PAT is closely related, so it gets a short section here.
How it works
Every NAT setup starts by marking which interface faces which way.
The four address terms
Think of two questions: is the host inside or outside, and whose view is it, local or global?
| Term | Meaning |
|---|---|
| Inside local | The inside host's real private address |
| Inside global | The public address that represents the inside host |
| Outside local | The outside host's address as seen from inside |
| Outside global | The outside host's real address |
In everyday inside source NAT, the two outside terms are the same address. The part that changes is inside local becoming inside global.
Marking the interfaces
interface GigabitEthernet0/0
ip address 192.168.10.1 255.255.255.0
ip nat inside
!
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.0
ip nat outsideIf you mark the LAN as outside and the internet side as inside, nothing translates correctly. Check this before anything else.
Static NAT
Static NAT adds one permanent mapping. The inside local address comes first and the inside global address second.
ip nat inside source static 192.168.10.10 203.0.113.10It works in both directions. An outside host can start a connection to 203.0.113.10 and reach the server at 192.168.10.10. That makes static NAT the usual choice for a server that must be reachable from outside.
Dynamic NAT with a pool
A pool needs three pieces: a range of public addresses, an access list that selects who may be translated, and one command that ties them together.
ip nat pool PUBLIC 203.0.113.20 203.0.113.30 netmask 255.255.255.0
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 pool PUBLICThe access list is not a security filter. It only selects which traffic is eligible for translation.
When a permitted host sends its first packet, the router takes the next free pool address and creates an entry. Idle dynamic entries are removed after a timeout, which is 24 hours by default. This pool has eleven addresses, so only eleven hosts can be translated at once.
PAT
PAT adds one word to the same command. The router records the inside address and port together, and keeps replies apart by translated port number.
! Option 1: share the outside interface address
ip nat inside source list 1 interface GigabitEthernet0/1 overload
! Option 2: share the addresses in a pool
ip nat inside source list 1 pool PUBLIC overloadVerifying
show ip nat translations
show ip nat statistics
clear ip nat translation *
debug ip natshow ip nat translationslists each entry with all four address columns.show ip nat statisticsshows inside and outside interfaces, entry counts and hit and miss counters.clear ip nat translation *removes dynamic entries so you can test again.debug ip natprints a line for every translated packet, so use it sparingly.
What to remember for the exam
Eight facts cover most NAT questions.
- Inside source NAT changes the source address of traffic leaving the inside network.
- Inside local is the private address. Inside global is the public one.
- You need at least one
ip nat insideand oneip nat outsideinterface. - Static NAT is a permanent one-to-one mapping and works for connections started from outside.
- Dynamic NAT takes addresses from a pool on demand. The access list picks who may be translated.
- When the pool runs out, later hosts cannot be translated until an entry frees up.
overloadturns dynamic NAT into PAT so many hosts share one address.- In
ip nat inside source static, the order is inside local first, then inside global.
Read the static command left to right as "private, then public". If the public address comes first, the translation is reversed.
Common mistakes
These five slips are the most common.
Swapping inside and outside. The LAN is inside and the internet link is outside.
Writing the static command backwards. The private address comes first.
Treating the ACL as a firewall. A host the ACL does not permit is simply not translated. Its private source address then leaves the router unchanged.
Mismatched pool mask. The netmask or prefix-length must match the subnet the pool addresses belong to.
Forgetting routing. NAT does not replace routing. The router still needs a route out, and the upstream network needs a route back to the pool.
Check yourself
Try these three prompts without looking back.
What is the difference between an inside local and an inside global address, and which one does an outside host see?
Inside local is the host's real private address and inside global is the public address that represents it. An outside host sees the inside global address.
What does a static NAT entry give you that a pool entry does not, and when would you choose it?
Static NAT is a permanent one-to-one mapping that also works for connections started from outside. It is the usual choice for a server that must be reachable from outside.
What happens to a new host when every pool address is in use, and which keyword changes that?
It cannot be translated until an entry frees up. The
overloadkeyword turns dynamic NAT into PAT so many hosts share one address.
Topic 1 of 9 in IP Services
Test yourself on IP Services
The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.