NAT & PAT

Overview

NAT and PAT translate private inside addresses to public outside addresses so many hosts share limited IPv4 space. CCNA covers static/dynamic NAT, overload (PAT), inside/outside interfaces, and NAT terminology.

Why NAT exists

Private RFC 1918 addresses are not globally routable. Network Address Translation (NAT) rewrites addresses (and often ports) as packets cross a router boundary — typically from an inside private network to an outside public Internet.

PAT (Port Address Translation), also called NAT overload, is the most common form: many inside hosts share one public IP using unique source port numbers.

NAT overview — translating private inside addresses to routable outside addresses.
Supplementary figure from Panagiss CCNAmd

Four NAT address terms

Memorize these with a concrete example: inside host 192.168.1.10 accessing web server 8.8.8.8 through a NAT router with public 203.0.113.5.

Term	Meaning	Example
Inside local	Address as configured on the inside host	192.168.1.10
Inside global	Public representation of the inside host	203.0.113.5:50001
Outside global	Real address of the outside destination	8.8.8.8
Outside local	Outside address as seen from inside (rare)	8.8.8.8 (often same as global)

Info

Local = address as seen from the inside network perspective. Global = address as seen from the outside (Internet) perspective.

Three NAT types for CCNA

Static NAT

One-to-one permanent mapping — inside local ↔ inside global.

Use case: Internal servers that must be reachable from the Internet (web, mail, VPN endpoint).

Static NAT — permanent one-to-one mapping between private and public addresses.
Supplementary figure from Panagiss CCNAmd

interface GigabitEthernet0/0
 ip nat inside
!
interface GigabitEthernet0/1
 ip nat outside
!
ip nat inside source static 192.168.1.50 203.0.113.10

Dynamic NAT

Pool of public addresses — inside hosts receive a temporary one-to-one mapping from the pool when they initiate traffic. Mappings expire when idle.

Limitation: Pool size caps concurrent inside hosts — no port multiplexing.

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool PUBLIC

PAT (NAT overload)

Many inside local addresses → one inside global address, differentiated by TCP/UDP port numbers. This is how most home and enterprise Internet access works.

PAT overload — many inside hosts share one public IP using unique port numbers.
Supplementary figure from Panagiss CCNAmd

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload

The overload keyword enables port translation — without it, ip nat inside source list performs dynamic pool NAT only.

Configuration workflow

Every NAT setup follows the same sequence:

Mark interfaces — ip nat inside on LAN-facing, ip nat outside on WAN-facing
Define what to translate — ACL (most common), or static statement
Define how to translate — static mapping, pool, or interface overload
Verify — translation table and statistics

Complete PAT overload example

interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside ! interface GigabitEthernet0/1 ip address 203.0.113.2 255.255.255.252 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet0/1 overload

Inside/outside placement

NAT is applied based on interface role, not compass direction. The inside interface faces private hosts; outside faces the public/untrusted network. Exam topologies label subnets — match carefully.

Static NAT for inbound access

When an outside host initiates traffic to an inside server, the router must have a static mapping (or pre-existing dynamic entry — static is the reliable choice).

ip nat inside source static tcp 192.168.1.50 80 203.0.113.10 80

Extended static NAT can map specific protocol/port pairs.

Verification commands

NAT verification

show ip nat translations show ip nat translations verbose show ip nat statistics clear ip nat translation * debug ip nat

Translation table fields:

Inside local / Inside global addresses and ports
Outside local / Outside global addresses and ports
Protocol and idle timer

Statistics show:

Hits and misses (misses may indicate ACL or routing issues)
Expired translations
Interface inside/outside assignment

Return traffic and the translation table

Outbound flow:

Inside host sends packet to outside destination
Router matches ACL, creates translation entry, rewrites source to inside global (+ port for PAT)
Outside server responds to inside global address
Router looks up translation table, rewrites destination back to inside local, forwards to host

Without a translation entry, return traffic cannot reach the inside host.

Troubleshooting

Symptom	Check
No Internet from inside	`ip nat inside` / `outside` on correct interfaces?
ACL denying NAT	ACL must permit sources to be translated
Routing broken	NAT does not fix missing default route
Inbound to server fails	Static NAT or port forward required
Translations expire quickly	Normal idle timeout — new session creates new entry
Works outbound, not inbound	Expected for PAT — need static for initiated-from-outside

Fix Layer 3 routing first — NAT cannot compensate for missing routes or wrong default gateway.

NAT and IPv6 (awareness)

IPv6 was designed with ample address space — NAT is not required for address conservation in native IPv6 deployments. CCNA may reference IPv6 addressing from the same Panagiss NAT-IPv6 source file, but IPv4 NAT/PAT is the configuration focus.

OSPFv3 and EIGRP for IPv6 run without NAT in dual-stack or IPv6-only internal networks.

Exam checklist

PAT keyword

overload on ip nat inside source list … interface … is mandatory for port-based sharing of one public IP.

Dynamic NAT pool exhaustion

Dynamic NAT without overload assigns one pool address per inside host session — a small pool exhausts quickly. PAT solves this with port multiplexing.

ACL direction vs NAT

The standard ACL in ip nat inside source list identifies inside local sources to translate — it is not applied as an interface ACL unless separately configured.

Quick review

Inside local = real private address; inside global = public face after translation
Static NAT = 1:1 permanent; dynamic NAT = pool with temporary 1:1; PAT = many:1 with ports
Always configure ip nat inside and ip nat outside on correct interfaces
PAT command ends with overload
Verify with show ip nat translations and show ip nat statistics
Inbound-initiated traffic to inside hosts requires static NAT (or port-specific static)

How the sources were combined