4.1 Configure and verify inside source NAT using static and pools

Pro	Inside global	Inside local	Outside global
(no translations)

Why NAT exists

Network Address Translation (NAT) rewrites the IP addresses inside packets as they pass through a router. It was invented to slow the exhaustion of public IPv4 addresses. Private addresses (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are free to use inside any organization, but they are not routable on the Internet; an ISP will drop a packet whose source is 192.168.1.10. NAT lets a router swap that private source address for a public one on the way out, and swap it back on the way in. Hundreds of internal hosts can share a single public address.

Think of NAT as a company mailroom. Employees have desk numbers that mean nothing to the outside world. When a letter goes out, the mailroom stamps the company’s public street address on it and keeps a note of which desk sent it. When a reply arrives at the street address, the mailroom looks at its notes and delivers it to the right desk.

NAT also has a security side effect: outside hosts cannot initiate a connection to an inside host unless the router has a translation for it. This is not a firewall, but it hides the internal addressing scheme.

4.1 NAT terminology: inside, outside, local, global

Cisco NAT uses four terms that trip up many candidates. Two words describe where the host physically is, and two words describe from whose perspective the address is seen.

Inside: the network you own, behind the NAT router (usually private addresses).
Outside: everything beyond the NAT router (usually the Internet).
Local: the address as seen from inside the network (before translation, the “real” private view).
Global: the address as seen from outside the network (after translation, the public view).

Combine them and you get four address types:

Term	Meaning in plain English	Typical value
Inside local	The inside host’s address as seen by inside hosts (its real, private IP)	192.168.1.10
Inside global	The inside host’s address as seen from the outside (the public IP the router substituted)	203.0.113.5
Outside global	The outside host’s address as seen from the outside (its real public IP)	198.51.100.20
Outside local	The outside host’s address as seen from the inside (rarely translated; usually equals outside global)	198.51.100.20

Worked example. PC1 at 192.168.1.10 opens a web page on server 198.51.100.20. Router R1 does NAT with public address 203.0.113.5.

Packet stage	Source address	Destination address
PC1 to R1 (inside, before NAT)	192.168.1.10 (inside local)	198.51.100.20 (outside local)
R1 to server (outside, after NAT)	203.0.113.5 (inside global)	198.51.100.20 (outside global)
Server reply to R1 (outside)	198.51.100.20 (outside global)	203.0.113.5 (inside global)
R1 to PC1 (inside, after un-NAT)	198.51.100.20 (outside local)	192.168.1.10 (inside local)

With “inside source NAT” (the only kind on the CCNA blueprint), the router only rewrites the inside address. The outside local and outside global are the same number; the terms still exist because Cisco NAT can translate outside addresses too, but that is beyond the exam.

The three flavors of inside source NAT

Type	Mapping	Config keyword	When used
Static NAT	One inside local to one inside global, permanent	`ip nat inside source static`	Servers that must be reachable from outside
Dynamic NAT	Inside locals to a pool of inside globals, first come first served	`ip nat pool` + `ip nat inside source list`	Legacy; needs one public IP per active host
PAT (NAT overload)	Many inside locals to one (or few) inside globals, distinguished by port number	`overload` keyword	Almost every home and office router

Step zero for every NAT type: mark the interfaces

The router must know which interfaces are inside and which are outside. Without this, no NAT command does anything. On the LAN-facing interface use ip nat inside; on the Internet-facing interface use ip nat outside.

R1(config)# interface GigabitEthernet0/0
R1(config-if)# description LAN
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# description ISP
R1(config-if)# ip address 203.0.113.2 255.255.255.248
R1(config-if)# ip nat outside

4.1 Static NAT

Static NAT creates a permanent one-to-one mapping. It is used when an inside server (web, mail, VPN) must be reachable from the Internet at a fixed public address. Because the mapping is permanent, outside hosts can initiate connections to the inside server.

Syntax: ip nat inside source static <inside-local> <inside-global>.

! Web server 192.168.1.100 is always reachable as 203.0.113.5
R1(config)# ip nat inside source static 192.168.1.100 203.0.113.5

Verification:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.5        192.168.1.100      ---                ---
tcp 203.0.113.5:80     192.168.1.100:80   198.51.100.20:5123 198.51.100.20:5123

The first line, with --- in the outside columns, is the static entry itself; it exists even when no traffic is flowing. The second line appears while an outside host at 198.51.100.20 has an active TCP session to the web server.

You can also do static PAT (port forwarding), mapping a single public port to an inside host: ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80. This lets several inside servers share one public IP on different ports.

4.1 Dynamic NAT with a pool

Dynamic NAT hands out public addresses from a pool as inside hosts need them, and releases them when the translation times out (the default timeout for dynamic entries is 24 hours). It needs three pieces:

An access list that identifies which inside addresses are allowed to be translated.
A pool of inside global addresses.
A command that ties the list to the pool.

! 1. Which hosts may be translated
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
! 2. Pool of public addresses (name, first, last, netmask)
R1(config)# ip nat pool PUBLIC 203.0.113.10 203.0.113.14 netmask 255.255.255.240
! 3. Tie them together
R1(config)# ip nat inside source list 1 pool PUBLIC

The netmask (or prefix-length 28) must be given; it tells the router the pool addresses’ subnet. With five addresses in the pool, only five inside hosts can be translated at the same time. A sixth host’s packet is dropped, and the misses counter in show ip nat statistics increments.

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 203.0.113.10       192.168.1.10       ---                ---
--- 203.0.113.11       192.168.1.11       ---                ---

Note the entries have no protocol or port: dynamic NAT is address-to-address, just like static, but temporary.

4.1 PAT (NAT overload)

Port Address Translation, which Cisco calls NAT overload, is the workhorse of the real world. Many inside hosts share one inside global address. The router keeps them apart by also translating the source port number. Each TCP or UDP session gets a unique (address, port) pair on the outside, so the router can match replies to the right inside host. Because there are about 64,000 usable ports, one public IP can in theory support tens of thousands of simultaneous sessions.

There are two ways to specify the shared address.

Overload using the outside interface’s address (most common, works even if the ISP gives you a DHCP address):

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

Overload using a pool (when you own several public addresses and want all of them used):

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat pool PUBLIC 203.0.113.10 203.0.113.11 netmask 255.255.255.248
R1(config)# ip nat inside source list 1 pool PUBLIC overload

The only difference from dynamic NAT is the word overload. Without it, the pool is used one address per host; with it, ports are translated too.

R1# show ip nat translations
Pro Inside global      Inside local        Outside local       Outside global
tcp 203.0.113.2:49152  192.168.1.10:49152  198.51.100.20:443   198.51.100.20:443
tcp 203.0.113.2:1024   192.168.1.11:49152  198.51.100.20:443   198.51.100.20:443
udp 203.0.113.2:53001  192.168.1.10:53001  8.8.8.8:53          8.8.8.8:53
icmp 203.0.113.2:1     192.168.1.12:1      198.51.100.20:1     198.51.100.20:1

Notice two inside hosts both used source port 49152; the first kept it, and the router changed the second one to 1024 on the outside. The router tries to keep the original port if it is free and picks a new one only when there is a conflict. ICMP has no ports, so the router uses the ICMP identifier field in the same role.

4.1 Verifying and clearing NAT

show ip nat statistics gives the big picture: how many translations exist, which interfaces are inside and outside, and hit and miss counts.

R1# show ip nat statistics
Total active translations: 4 (1 static, 3 dynamic; 3 extended)
Peak translations: 12, occurred 00:31:15 ago
Outside interfaces:
  GigabitEthernet0/1
Inside interfaces:
  GigabitEthernet0/0
Hits: 2145  Misses: 0
CEF Translated packets: 2145, CEF Punted packets: 0
Expired translations: 38
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 interface GigabitEthernet0/1 refcount 3

“Extended” translations are ones that include port numbers, that is, PAT entries. A “hit” means a packet matched an existing translation; a “miss” means a packet needed a new translation to be created (or could not get one).

To wipe dynamic translations, for example after changing the configuration or to force a stuck session to rebuild:

R1# clear ip nat translation *

This clears only dynamic entries. Static entries are configuration and remain. Also useful: debug ip nat shows each translation in real time (use with care on busy routers).