Infrastructure · Topic 10 of 13

Configuring NAT and PAT

Configure and verify static NAT, dynamic NAT and PAT on Cisco IOS XE, understand inside and outside address terms, and read the translation table.

5 min

In a nutshell

NAT replaces addresses. PAT also uses port numbers so many hosts share one address.
Inside local is the private address. Inside global is the translated, public address.
ip nat inside and ip nat outside mark the interfaces.

What it is

Network Address Translation (NAT) changes the addresses in packets as they pass through a router.

It is mainly used to let hosts with private addresses reach the internet. Private addresses cannot be routed on the internet, so the router replaces them with public ones. Port Address Translation (PAT) goes further, and lets many hosts share a single public address.

How it works

The router keeps a translation table, and it names addresses by where they are seen.

The four address terms

NAT uses four names, which depend on the point of view.

Term	Meaning
Inside local	The address of the inside host as seen on the inside network
Inside global	The address of the inside host as seen from the outside
Outside local	The address of the outside host as seen from the inside
Outside global	The address of the outside host as seen on the outside network

For a typical home or office, the inside local is the private address, and the inside global is the public one. In most cases the outside local and outside global are the same address.

The three types

Type	Mapping	Use
Static NAT	One to one, fixed	A server that must be reachable from outside
Dynamic NAT	Inside hosts take addresses from a pool	A pool of public addresses, as many as hosts that need it at once
PAT (overload)	Many to one, tracked by port	Most common, one public address for a whole site

Marking the interfaces

Every NAT configuration starts by marking which interface faces the inside and which faces the outside.

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside

Static NAT

R1(config)# ip nat inside source static 10.1.1.10 203.0.113.10

The mapping is always present in the table. It also works in the reverse direction, so an outside host can start a connection to 203.0.113.10. A static entry can name a port as well, which lets you share one public address among several servers.

R1(config)# ip nat inside source static tcp 10.1.1.10 80 203.0.113.10 8080

Dynamic NAT

R1(config)# ip nat pool PUBLIC 203.0.113.20 203.0.113.30 netmask 255.255.255.224
R1(config)# access-list 1 permit 10.1.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 pool PUBLIC

The access list says which inside addresses may be translated. The pool holds the addresses that they may use. When the pool runs out, new hosts cannot get a translation until an entry times out.

PAT

PAT adds the keyword overload. The router tells each conversation apart by its port numbers, so one public address serves many hosts.

R1(config)# access-list 1 permit 10.1.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

This form uses the address of the outside interface, which is useful when the provider assigns it by DHCP. You can use a pool as well, with ip nat inside source list 1 pool PUBLIC overload.

If two hosts use the same source port, the router changes one of them. That is how it keeps the entries apart.

Verifying

R1# show ip nat translations
R1# show ip nat statistics
R1# clear ip nat translation *
R1# debug ip nat

show ip nat translations lists each entry with its inside local, inside global, outside local and outside global addresses. show ip nat statistics shows the inside and outside interfaces, the number of hits and misses, and the pool use.

A rising count of misses with no new translations often means the access list does not match, or an interface is not marked. The command clear ip nat translation * removes dynamic entries, which is useful after you change the configuration.

Troubleshooting order

Check that the inside and outside interfaces are marked correctly.
Check that the access list matches the inside addresses, after any routing.
Check that the pool or interface for translation is valid.
Check routing on both sides, since NAT does not replace it.
Look at the table and the counters.

What to remember for the exam

Eight facts cover most questions on this topic.

NAT replaces addresses. PAT also uses port numbers so many hosts share one address.
Inside local is the private address. Inside global is the translated, public address.
ip nat inside and ip nat outside mark the interfaces.
Static NAT uses ip nat inside source static.
Dynamic NAT needs an access list and a pool.
PAT adds overload to the ip nat inside source list command.
show ip nat translations lists the table.
clear ip nat translation * removes dynamic entries.

Exam tip

To read a translation, first find the inside local address. The inside global shows what the outside world sees.

Common mistakes

These four mistakes appear often.

Swapping inside and outside. If the interfaces are marked the wrong way, nothing is translated.

Forgetting the overload keyword. Without it, each host needs its own public address from the pool.

Using the wrong wildcard mask in the access list. The list may not match the hosts that you want to translate.

Skipping routing. NAT does not help if the router has no route to the destination.

Watch out

Clearing the table with clear ip nat translation * drops active connections, so do it with care on a live router.

Check yourself

Work through these three questions.

Which keyword turns dynamic NAT into PAT?
The overload keyword, which lets many inside hosts share one address by using port numbers.
What is the inside global address?
It is the address of the inside host as seen from the outside, usually the public address.
Which command lists the NAT translation table?
show ip nat translations lists every entry with its four addresses.

Topic 10 of 13 in Infrastructure

Test yourself on Infrastructure

The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.