Services
NAT
NAT translates private IPv4 addresses to public addresses for internet access, using static, dynamic, or PAT (NAT overload) methods.
What you need to know
- Inside local: private address of an inside host as seen inside the network.
- Inside global: translated public address of an inside host as seen outside the network.
- Outside local and outside global describe the destination address before and after translation, used less commonly.
- Static NAT is a permanent one-to-one mapping, typically used for servers needing consistent external addressability.
- Dynamic NAT maps a pool of inside local addresses to a pool of inside global addresses, one-to-one but not fixed.
- PAT (NAT overload) maps many inside local addresses to one inside global address using different port numbers.
- The ip nat inside and ip nat outside commands must be applied on the correct interfaces or no translation occurs.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| ip nat inside source static 192.168.1.10 203.0.113.10 | config | Creates a static NAT mapping for a single host. |
| access-list 1 permit 192.168.1.0 0.0.0.255 | config | Defines the inside local addresses eligible for dynamic NAT/PAT. |
| ip nat pool PUBLIC-POOL 203.0.113.1 203.0.113.5 netmask 255.255.255.248 | config | Defines the range of inside global addresses for dynamic NAT. |
| ip nat inside source list 1 pool PUBLIC-POOL | config | Binds the ACL to the pool for dynamic NAT translation. |
| ip nat inside source list 1 interface gigabitethernet0/1 overload | config | Configures PAT, translating many inside hosts to one outside interface address. |
| interface gigabitethernet0/0 | config | Enters the inside-facing interface. |
| ip nat inside | config-if | Marks the interface as the inside NAT interface. |
| interface gigabitethernet0/1 | config | Enters the outside-facing interface. |
| ip nat outside | config-if | Marks the interface as the outside NAT interface. |
Verify it
- show ip nat translations
- show ip nat statistics
- clear ip nat translation *
- show running-config | include ip nat
- debug ip nat
Common mistakes
- Forgetting to apply ip nat inside/outside on the respective interfaces, so no translation occurs at all.
- Swapping inside and outside on the interfaces, reversing translation direction.
- Using an ACL that is too permissive or too restrictive, translating unintended traffic or none at all.
- Forgetting the overload keyword when only one public address is available, exhausting the pool with dynamic NAT.
- Not clearing stale translations during testing, causing confusing show output.
Practise NAT in a real CLI
Generated labs, graded against the simulated network state.