NAT (Network Address Translation) translates IP addresses (and sometimes ports) between private and public networks.
Facts
| Term | Explanation |
|---|---|
| Inside local | The private IP address (before NAT) |
| Inside global | The public IP address (after NAT) |
| Outside global | The actual IP of the external destination |
| Outside local | How the external IP is seen internally |
| NAT table | Mapping table (local ↔ global) |
| Translation timeout | How long a NAT entry lives |
NAT types
| Property | Static NAT | Dynamic NAT | PAT (overload) |
|---|---|---|---|
| Mapping | 1:1 (fixed) | 1:1 (temporary) | many:1 |
| Uses ports | No | No | Yes |
| Public IPs needed | 1 per host | A pool | 1 (or few) |
| Incoming traffic | Yes | No | No |
| Scalability | Low | Medium | High |
| Typical use | Servers | Clients (older designs) | Clients / internet – the standard |
How NAT works
- Packet hits the NAT router
- Router matches inside/outside interfaces
- NAT rule is evaluated (static / dynamic / PAT)
- IP (and port) is translated
- A NAT entry is created
- Return traffic is matched against the NAT table
NAT solves: IPv4 address exhaustion, hiding internal IPs, making private networks internet-compatible.
PAT (NAT overload)
Many internal hosts share one public IP using port numbers. Each session gets a unique source port; the NAT table identifies flows by IP + port. Caveats: port exhaustion (rare), problems with some protocols (SIP, active FTP – solved with ALG).
Configuration
ip access-list standard INSIDE-NET
permit 192.168.1.0 0.0.0.255
!
interface g0/0
ip nat inside
interface g0/1
ip nat outside
!
ip nat inside source list INSIDE-NET interface g0/1 overload
! Classic ACL style:
access-list 1 permit 172.16.0.0 0.0.255.255
ip nat inside source list 1 interface Ethernet0/1 overload
! More internal networks: add lines to the ACL (e.g. permit 10.0.0.0 0.255.255.255)Static NAT maps a specific private IP to a specific public IP (for inbound-reachable servers); dynamic NAT uses a pool; PAT = overload.
Extra features (CCNP)
- NAT pools + overload combined · policy NAT (route-maps) · VRF-aware NAT · NAT64 / IPv6 transition · ALG (application layer gateway) · NAT redundancy (HSRP + NAT sync)
Verification & troubleshooting
show ip nat translations
show ip nat statistics
debug ip nat
clear ip nat translation *Typical faults: wrong inside/outside interface, ACL not matching, wrong routing before NAT, asymmetric routing.