Network Implementation · Topic 2 of 8
NAT, Gateway Redundancy and Subinterfaces
Understand NAT and PAT address translation, first hop redundancy with a virtual IP using VRRP or HSRP, and router subinterfaces for inter VLAN routing.
- 5 min
- Includes a diagram
- Static NAT is one to one. Dynamic NAT uses a pool. PAT shares one public address using ports.
- PAT is also called NAT overload and is what most networks use for internet access.
- NAT conserves public IP version 4 (IPv4) addresses. It is not a firewall.
What it is
Three router features appear next to routing on the exam. Network Address Translation (NAT) changes Internet Protocol (IP) addresses as packets cross a router, first hop redundancy keeps the default gateway available, and subinterfaces let one physical port route for several Virtual Local Area Networks (VLANs).
Each one solves a practical problem. NAT saves public addresses, redundancy removes a single point of failure, and subinterfaces save ports.
How it works
Network Address Translation
NAT rewrites the source or destination address of a packet. It lets many private hosts, which use non routable addresses, reach the internet through a few public addresses.
| Type | Mapping | Typical use |
|---|---|---|
| Static NAT | One private address to one fixed public address | Publishing an internal server |
| Dynamic NAT | Private addresses to a pool of public addresses | Less common, needs many public addresses |
| Port Address Translation (PAT) | Many private addresses to one public address, told apart by port numbers | Home and office internet access |
PAT is also called NAT overload. The router keeps a translation table that records the inside address, the port, and the matching public address and port, so replies return to the right host.
NAT also hides internal addressing, but it is not a security control by itself. A firewall policy is still required.
First hop redundancy
Hosts have one default gateway address. If that router fails, hosts lose access to other networks even when a second router exists.
A first hop redundancy protocol (FHRP) lets two or more routers share a virtual IP (VIP) address. Hosts use the VIP as their default gateway, and one router answers for it while another stands by.
| Protocol | Notes |
|---|---|
| Virtual Router Redundancy Protocol (VRRP) | Open standard, a master router and backup routers |
| Hot Standby Router Protocol (HSRP) | Cisco protocol, an active router and a standby router |
If the active router stops sending hello messages, the standby router takes over the virtual address. Hosts do not need to change their configuration.
A priority value decides which router wins the election. A preemption setting decides whether a preferred router takes the role back after it returns.
Subinterfaces
A trunk link between a router and a switch can carry several VLANs using 802.1Q tags. The router splits its physical interface into logical subinterfaces, one for each VLAN.
Each subinterface is tagged with a VLAN ID and given an IP address that becomes the default gateway for that VLAN. This design is often called "router on a stick".
| Element | Purpose |
|---|---|
| Physical interface | One cable to a switch trunk port |
| Subinterface | A logical interface tied to one VLAN ID |
| IP address on the subinterface | The default gateway of that VLAN |
All inter VLAN traffic goes through the single link, so it can become a bottleneck. A Layer 3 switch routes between VLANs inside the switch and is faster.
What to remember for the exam
- Static NAT is one to one. Dynamic NAT uses a pool. PAT shares one public address using ports.
- PAT is also called NAT overload and is what most networks use for internet access.
- NAT conserves public IP version 4 (IPv4) addresses. It is not a firewall.
- An FHRP gives hosts a virtual IP as default gateway so a router failure is invisible to them.
- VRRP is an open standard. HSRP is Cisco proprietary.
- A subinterface is a logical interface for one VLAN on a trunk link.
- Router on a stick uses one physical link for inter VLAN routing and can become a bottleneck.
- Hosts keep the same gateway address when an FHRP fails over.
If a scenario says "publish an internal web server to the internet", think static NAT or port forwarding. If it says "many users share one public address", think PAT.
Common mistakes
Treating NAT as security. It hides addresses, but filtering still requires firewall rules.
Confusing static NAT and PAT. Static NAT is a fixed one to one mapping. PAT maps many hosts to one address using different ports.
Giving hosts a real router address as gateway. With an FHRP, hosts must use the virtual IP, not the address of one router.
Forgetting the trunk. Subinterfaces only work if the switch port is a trunk that carries the needed VLANs.
Expecting VRRP and HSRP to interoperate. They are different protocols and the routers in a group must run the same one.
The routers in a group must be able to exchange their hello messages. If those messages are blocked, each router may believe it is the master and both answer for the virtual IP.
Check yourself
Try these three.
Which NAT type lets many private hosts share one public address?
Port Address Translation (PAT), also called NAT overload.
What do hosts use as their default gateway when an FHRP is in place?
The virtual IP address shared by the routers.
What is a subinterface used for?
To route for several VLANs over a single physical trunk link by creating one logical interface per VLAN.
Topic 2 of 8 in Network Implementation
Test yourself on Network Implementation
The full CompTIA Network+ N10-009 question bank has 910 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.