NAT and PAT Fundamentals

Watch first

Plain-English explanation

NAT (Network Address Translation) rewrites IP addresses crossing a router — typically private inside to public outside. PAT (Port Address Translation), also called NAT overload, maps many inside hosts to one public IP using different source ports.

Most home and enterprise Internet access uses PAT — one public IP, many private clients.

Deep dive

NAT overview — translating private inside addresses to public outside.
Supplementary figure from Panagiss CCNAmd

PAT (overload) — many hosts share one public IP using unique ports.
Supplementary figure from Panagiss CCNAmd

Additional topic reference

NAT & IPv6 — Panagiss CCNAmd notes

Four terms (memorize with examples):

| Term | Meaning | Example | |------|---------|---------| | Inside local | Real private address on LAN | 192.168.1.10 | | Inside global | Public face of inside host | 203.0.113.5:50001 | | Outside global | Real address of outside host on Internet | 8.8.8.8 | | Outside local | Outside as seen from inside (rare) | varies |

Static NAT: One private ↔ one public — servers needing inbound access.

Dynamic NAT: Pool of public IPs — first-come mapping without port multiplexing.

PAT overload: Many insiders → one public IP + unique ports.

Step-by-step — PAT overload config

Inside LAN: 192.168.1.0/24 on Gi0/0. Outside WAN: Gi0/1 toward ISP.

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload

Inside host browses web — router creates translation entry.

Commands to know

NAT verification

show ip nat translations show ip nat statistics clear ip nat translation * debug ip nat

Static NAT example

ip nat inside source static 192.168.1.50 203.0.113.10

Troubleshooting

| Issue | Check | |-------|-------| | No Internet from inside | inside/outside on wrong interfaces | | Works briefly then stops | Translation timeout — normal for idle | | Inbound to server fails | Need static NAT or port forward | | ACL blocks NAT return | ACL applied outside interface |

NAT doesn't help if routing or default route is broken — fix L3 first.

Exam relevance

Exam trap

ip nat inside and ip nat outside must be on correct interfaces — exam diagrams label inside/outside networks; match carefully.

Overload keyword

PAT requires overload keyword on ip nat inside source statement — without it, dynamic pool only without port translation.

Practice checklist

Label inside local/global on a diagram with PAT
Configure PAT overload in lab and verify translation table
Configure one static NAT for internal server
Explain why return traffic needs translation entry
Identify NAT vs routing issue from symptoms

Which NAT type allows many inside hosts to share one public IP using ports?

Which command marks an interface as the inside NAT domain?

Learning objectives