Cisco NAT Configuration: Static NAT, Dynamic NAT and PAT

Cisco NAT Configuration Made Easy: Static NAT,: Quick Summary

NAT is the reason many devices in a home, office, or campus network can use the internet even when the ISP provides only one or a small set of public IPv4 addresses. Your router rewrites the source address of outbound packets, remembers the translation in a NAT table, and sends the return traffic back to the correct inside device.

Cisco NAT Configuration Made Easy: Static NAT,: Table of Contents

1. What is NAT?
2. Why NAT is used
3. Static NAT vs Dynamic NAT vs PAT
4. Lab topology and addressing
5. Lab 1: Configure Static NAT
6. Lab 2: Configure Dynamic NAT
7. Lab 3: Configure PAT Overload
8. Cisco NAT terminology cheat sheet
9. Verification and troubleshooting
10. NAT, security, and firewall differences
11. Frequently Asked Questions

1. What is NAT?

Network Address Translation (NAT) is a router feature that changes IP address information in packet headers as traffic moves between an inside private network and an outside public network. In most small networks, the inside devices use private IPv4 ranges such as 192.168.0.0/16, 10.0.0.0/8, or 172.16.0.0/12.

When those private devices access the internet, the NAT router translates their private addresses into one or more public addresses. Return traffic is matched against the NAT table and forwarded back to the original inside host.

2. Why Do We Need NAT?

• IPv4 address conservation: Many internal devices can share a small number of public IPv4 addresses.
• Private addressing: You can design your LAN with private IP ranges without depending on ISP-provided addressing for every host.
• Operational flexibility: Internal addressing can remain stable even if the ISP public IP changes.
• Basic exposure reduction: Internal private IP addresses are not directly visible to internet hosts.

3. Types of NAT Explained Simply

4. Lab Topology and Addressing

The examples below use a simple inside LAN, one NAT router, and one outside server. You can reproduce the same idea in Cisco Packet Tracer, GNS3, EVE-NG, or physical routers.

Host(config)#no ip routing
Host(config)#ip default-gateway 192.168.12.2

Web1(config)#no ip routing
Web1(config)#ip default-gateway 192.168.23.2

5. Lab 1: Configure Static NAT on Cisco IOS

Static NAT permanently binds one inside private address to one outside public address. Use it when a device must always be reachable through the same public IP.

Step 1: Define inside and outside interfaces

NAT(config)#interface FastEthernet1/0
NAT(config-if)#ip nat inside
NAT(config-if)#exit

NAT(config)#interface FastEthernet0/0
NAT(config-if)#ip nat outside
NAT(config-if)#exit

Step 2: Create the static NAT rule

NAT(config)#ip nat inside source static 192.168.12.1 192.168.23.2

Step 3: Test and verify

Host#ping 192.168.23.3

NAT#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.168.23.2       192.168.12.1       ---                ---

Here, the inside local address 192.168.12.1 is represented to the outside network as 192.168.23.2.

6. Lab 2: Configure Dynamic NAT on Cisco IOS

Dynamic NAT is useful when you have multiple inside hosts and a public IP pool. The router assigns an available public IP only when a permitted inside host sends traffic.

Step 1: Permit inside addresses with an ACL

NAT(config)#access-list 1 permit 192.168.123.0 0.0.0.255

Step 2: Create the public IP pool

NAT(config)#ip nat pool MYPOOL 192.168.23.10 192.168.23.20 prefix-length 24

Step 3: Bind the ACL to the pool

NAT(config)#ip nat inside source list 1 pool MYPOOL

Step 4: Verify dynamic translations

NAT#show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
icmp 192.168.23.10:3   192.168.123.1:3    192.168.23.3:3     192.168.23.3:3
icmp 192.168.23.11:2   192.168.123.2:2    192.168.23.3:2     192.168.23.3:2

In this example, Host 1 receives 192.168.23.10 and Host 2 receives 192.168.23.11 from the NAT pool.

7. Lab 3: Configure PAT Overload

PAT, also called NAT overload, is the most common NAT design. It lets many private hosts share one public interface address by adding port information to the translation table.

NAT(config)#access-list 1 permit 192.168.1.0 0.0.0.255
NAT(config)#interface FastEthernet1/0
NAT(config-if)#ip nat inside
NAT(config-if)#exit
NAT(config)#interface FastEthernet0/0
NAT(config-if)#ip nat outside
NAT(config-if)#exit
NAT(config)#ip nat inside source list 1 interface FastEthernet0/0 overload

The public IP is the same, but the router uses unique port entries to send each reply back to the correct private host.

8. Cisco NAT Terminology Cheat Sheet

9. Verification and Troubleshooting Commands

After configuring NAT, generate traffic first. A ping, DNS lookup, HTTP request, or TCP connection will create translations that you can verify.

NAT#show ip nat translations
NAT#show ip nat statistics
NAT#debug ip nat
NAT#clear ip nat translation *

• No translations appear: Check the ACL, inside/outside interface roles, and whether traffic is actually leaving the inside network.
• Ping fails after translation appears: Check routing on the outside network and the return route back to the NAT public address.
• Dynamic NAT pool is exhausted: Add more public IPs, reduce stale translations, or use PAT overload.
• Internal server is unreachable from outside: Use static NAT or port forwarding, then allow the traffic in the firewall policy.

10. NAT, Security, and Firewall Differences

NAT hides private addressing and usually blocks unsolicited inbound sessions unless a static mapping or port forward exists. That behavior can reduce accidental exposure, but NAT does not replace a firewall.

Limitations of NAT

• NAT can complicate end-to-end connectivity and peer-to-peer applications.
• Some protocols, including VoIP, may need NAT traversal or application inspection.
• Hosting internal services requires static NAT, destination NAT, or port forwarding.
• IPv6 networks usually avoid traditional NAT because IPv6 has a much larger address space.

Cisco NAT Configuration Made Easy: Static NAT,: Frequently Asked Questions

What is NAT in networking?

NAT stands for Network Address Translation. It translates private internal IP addresses to public IP addresses so LAN devices can communicate with outside networks such as the internet.

Which NAT type is most common?

PAT, or NAT overload, is the most common type because it allows many inside devices to share one public IP address by using different port numbers.

What is the difference between static NAT and dynamic NAT?

Static NAT is a permanent one-to-one mapping. Dynamic NAT assigns public addresses from a pool only when an inside host creates traffic.

Is NAT the same as a firewall?

No. NAT translates addresses. A firewall enforces security policy. Many routers and firewalls perform both functions, but the concepts are different.

Can NAT be used with IPv6?

Traditional NAT is usually not required in IPv6 because IPv6 has a very large address space. Some networks use NPTv6 for prefix translation, but it is not the same design goal as IPv4 NAT overload.

Related IP Tools and Routing Labs

Use the IP Location Finder to inspect the approximate location, ASN, ISP and organization behind a public address used in a NAT translation. Continue with the networking tools hub for subnet, DNS and header checks.

For routing practice, open the Cisco routing labs hub or follow the OSPF labs and study path. The OSPF index includes OSPF overview, areas, neighbor states, authentication, and DR/BDR election.

Cisco NAT Configuration Made Easy: Static NAT,: Tags and Keywords

Cisco NAT configuration, static NAT, dynamic NAT, PAT overload, NAT overload, Network Address Translation, inside local, inside global, outside local, outside global, show ip nat translations, Cisco IOS NAT commands, Packet Tracer NAT lab, GNS3 NAT lab, CCNA NAT tutorial, NAT vs firewall, port forwarding, IPv4 address translation.