24 Network Address Translation · CCNA

Exam topics covered

4.1 Configure and verify inside source NAT using static and pools

Foundation. Almost every home and business network uses private IPv4 addresses internally, yet every packet that crosses the Internet must carry a public source address. Network Address Translation (NAT) is the router feature that rewrites addresses at the boundary so that both can be true. This chapter explains why NAT exists, defines the four address terms that confuse many candidates (inside local, inside global, outside local, outside global), and then configures the three forms of inside source NAT the exam expects: static NAT, dynamic NAT with a pool, and Port Address Translation (PAT, also called NAT overload). For each one you will follow a packet through the router and read the verification output. The chapter ends with the most common NAT mistakes and how to spot them.

24.1 Why NAT Exists

The IPv4 address space holds about 4.3 billion addresses, far too few for every device in the world. RFC 1918 reserves three private ranges that anyone may use internally but that are never routed on the public Internet:

Table 24-1 RFC 1918 private IPv4 address ranges

Range Prefix Typical use

10.0.0.0 – 10.255.255.255 10.0.0.0/8 Large enterprises

172.16.0.0 – 172.31.255.255 172.16.0.0/12 Medium networks, cloud VPCs 192.168.0.0 – 192.168.255.255 192.168.0.0/16 Homes and small offices Because thousands of organisations reuse the same private addresses, Internet routers drop or cannot route packets that carry them. NAT on the edge router replaces the private source address with a public one on the way out and reverses the change on replies. PAT goes further, letting an entire network share a single public address, which is what has kept IPv4 usable decades after the free pool ran out. NAT also hides internal addressing from the outside, though it is not a substitute for a firewall. Its costs: it breaks true end-to-end addressing, complicates some protocols (such as those that embed IP addresses in their payload), and makes inbound connections impossible unless you configure static mappings.

24.2 Inside, Outside, Local and Global

Cisco describes NAT with two pairs of words. Inside and outside say which host an address belongs to: a host in your network (inside) or a host elsewhere (outside). Local and global say where the address is seen: local is the address as seen in the inside network, global is the address as seen in the outside network. Combining them gives four terms, shown on the chapter topology in Figure 24-1.

Inside outside

Figure 24-1 The four NAT address terms for a packet from PC1 to an Internet web server. With inside source NAT, outside local and outside global are the same.

All CCNA NAT configuration is inside source NAT: the router translates the source address of packets coming from inside hosts, and the destination address of the replies. The outside host's address is never changed, which is why outside local equals outside global in every example you will meet.

Tip

Read the term in two halves. The first word answers "whose address?" (inside host or outside host). The second answers "from where is it seen?" (local = from inside, global = from outside). "Inside global" is therefore "my host's address as the Internet sees it", the public address.

Throughout the chapter R1's G0/0 (192.168.10.1/24) faces the inside LAN with PC1 (.10), PC2 (.11) and a web server (.100). G0/1 (203.0.113.2/29) faces the ISP, which has routed the block 203.0.113.0/29 to R1 (usable .1 to .6; the ISP uses .1). Every NAT configuration has three parts: mark interfaces inside or outside, define what to translate, and define what to translate it to.

24.3 Static NAT

Static NAT creates a permanent one-to-one mapping between an inside local and an inside global address. Because the mapping always exists, outside hosts can initiate connections to the inside host, which makes static NAT the right tool for publishing an internal server. Here the internal web server 192.168.10.100 is published as 203.0.113.3.

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside
R1(config-if)# exit
R1(config)# ip nat inside source static 192.168.10.100 203.0.113.3

The syntax reads naturally: for packets arriving on an inside interface, translate the source address, statically, from inside local 192.168.10.100 to inside global 203.0.113.3. Each additional server needs its own static line and its own public address. (A variant, ip nat inside source static tcp 192.168.10.100 443 203.0.113.2 443 , maps a single port so that a server can share the interface address; this is called static PAT or port forwarding.) 192.168.10.100

198.51.100.20

1. Request arrives

S 198.51.100.20 D 203.0.113.3

2. D translated to inside local

S 198.51.100.20 D 192.168.10.100

3. Reply from server

S 192.168.10.100 D 198.51.100.20

4. S translated to inside global

Figure 24-2 Static NAT packet walk: an outside client reaches the published server through its inside global address.

Verify with show ip nat translations . A static entry is always present, shown with dashes in the protocol and outside columns; each active connection through it adds a more specific entry.

R1 — console

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global

--- 203.0.113.3 192.168.10.100 --- ---

tcp 203.0.113.3:443 192.168.10.100:443 198.51.100.20:52114 198.51.100.20:52114 Total number of translations: 2

Figure 24-3 The permanent static entry and one active HTTPS session to the server. Output is illustrative of IOS 15/IOS XE.

Column order in show ip nat translations is Inside global, Inside local, Outside local, Outside global. Many candidates expect "inside local" first. Practise reading which address is which before the exam.

24.4 Dynamic NAT with a Pool

Dynamic NAT maps inside hosts to public addresses taken from a pool, one-to-one, on demand. A translation is created when an inside host first sends traffic that matches an ACL, and it is removed after a period of inactivity (24 hours by default for simple entries; shorter timeouts apply to TCP, UDP and ICMP flows). Outside hosts cannot initiate connections to an inside host unless a translation for it already exists. Configuration adds two parts to the inside/outside interface commands:

1. A standard ACL that permits the inside local addresses to be translated. The ACL is used only to match traffic; it does not filter anything.
2. A NAT pool of inside global addresses, defined with a start address, end address and a netmask (or prefix-length ).

R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
R1(config)# ip nat pool PUBLIC 203.0.113.4 203.0.113.6 netmask 255.255.255.248
R1(config)# ip nat inside source list 1 pool PUBLIC

! ip nat inside / ip nat outside are already set on G0/0 and G0/1 The final command ties them together: translate the source of packets from inside interfaces that match ACL 1, using addresses from pool PUBLIC. The pool's netmask must be consistent with the addresses (they must fall within one subnet of that mask); a mismatch is rejected with "%Start and end addresses on different subnets".

Figure 24-4 Dynamic NAT allocates one pool address per inside host; when the pool is empty, further hosts cannot get out.

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global

icmp 203.0.113.4:3 192.168.10.10:3 198.51.100.10:3 198.51.100.10:3 --- 203.0.113.4 192.168.10.10 --- ---

tcp 203.0.113.5:50211 192.168.10.11:50211 198.51.100.10:443 198.51.100.10:443 --- 203.0.113.5 192.168.10.11 --- ---

Total number of translations: 4

Figure 24-5 Dynamic NAT: each host has a simple address entry (highlighted) plus entries for its active flows. The port numbers are unchanged.

Dynamic NAT conserves no addresses: three pool addresses serve at most three inside hosts at a time. That is why, in practice, dynamic NAT on its own is rare and PAT is the norm.

24.5 Port Address Translation (NAT Overload)

PAT lets many inside hosts share one inside global address by also translating, when necessary, the transport-layer source port. Each flow is identified by the combination of address and port, so the router can tell replies apart: up to about 65,000 simultaneous flows per public address. Add the keyword overload to the dynamic NAT command. There are two forms.

24.5.1 PAT using the outside interface address

The most common form, used on virtually every home and branch router, translates to whatever address the outside interface has, even one learned by DHCP:

R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

24.5.2 PAT using a pool

When one public address is not enough, or you want to keep the interface address separate, overload a pool instead. The router uses the first pool address until its ports are exhausted, then moves to the next:

R1(config)# ip nat inside source list 1 pool PUBLIC overload

PC2

R1 pat

Figure 24-6 PAT keeps the original source port when it is free and picks a new one when it would clash.

R1 — console

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global

tcp 203.0.113.2:49152 192.168.10.10:49152 198.51.100.10:443 198.51.100.10:443 tcp 203.0.113.2:1024 192.168.10.11:49152 198.51.100.10:443 198.51.100.10:443 udp 203.0.113.2:51007 192.168.10.11:51007 8.8.8.8:53 8.8.8.8:53 Total number of translations: 3

Figure 24-7 PAT translations: every entry has a port, and all share inside global 203.0.113.2. There are no address-only entries.

show ip nat statistics summarises the NAT configuration and counters: which interfaces are inside and outside, how many translations exist, how many packets were translated (hits) and how many had no matching entry and needed a new one (misses), and the state of each dynamic mapping and pool.

R1 — console

R1# show ip nat statistics

Total active translations: 3 (0 static, 3 dynamic; 3 extended)

Figure 24-8 show ip nat statistics with PAT to the interface. "Extended" translations are those that include ports.

Table 24-2 Comparing the three forms of inside source NAT

initiate?

Yes Only while a
translation exists
No (except static port mappings)

Typical use Publishing servers Rare today Internet access for users

24.6 Clearing and Debugging NAT

Dynamic translations persist until they time out. When you change a NAT configuration, or need to free pool addresses immediately, clear them with clear ip nat translation * (note the singular translation). Static entries are not removed by this command. IOS also refuses to remove a dynamic NAT rule or pool while translations are using it, printing "%Pool PUBLIC in use, cannot destroy"; clear the translations first.

To watch translations happen, use debug ip nat . Each line shows the source and destination, with the arrow marking the address that was rewritten. An asterisk after NAT means the packet was translated in the fast (CEF) path.

R1 — console

R1# clear ip nat translation *
R1# debug ip nat

IP NAT debugging is on
NAT*: s=192.168.10.10->203.0.113.4, d=198.51.100.10 [21734]
NAT*: s=198.51.100.10, d=203.0.113.4->192.168.10.10 [40211]
NAT*: s=192.168.10.10->203.0.113.4, d=198.51.100.10 [21735]

R1# undebug all

Figure 24-9 debug ip nat : the outbound source and the inbound destination are translated.

24.7 Troubleshooting NAT

When inside hosts cannot reach the Internet through NAT, check these in order: that traffic matches the ACL, that inside and outside are on the correct interfaces, that the pool is not exhausted, and that the ISP routes the inside global addresses back to you. The first three are configuration errors you can see on R1.

24.7.1 ACL does not match the inside hosts

An engineer wrote access-list 1 permit 192.168.1.0 0.0.0.255 (a typo for 192.168.10.0). Inside traffic matches no NAT rule, so it leaves with its private source address and replies never return. Symptoms: show ip nat translations stays empty, and show access-lists shows no matches.

R1 — console

R1# show ip nat translations
R1# show access-lists 1

Standard IP access list 1

10 permit 192.168.1.0, wildcard bits 0.0.0.255

R1# show ip nat statistics | include Hits

Hits: 0 Misses: 0

Figure 24-10 No translations and no hits: the ACL never matches the 192.168.10.0/24 hosts.

Fix: correct the ACL to permit 192.168.10.0 0.0.0.255. Remember that an ACL used for NAT must permit the hosts to translate; a deny (or the implicit deny) means "do not translate".

24.7.2 Inside and outside reversed

If ip nat inside is on G0/1 and ip nat outside on G0/0, the router looks for inside traffic arriving on the wrong interface, so user traffic is never translated. show ip nat statistics makes this obvious: the "Inside interfaces" list shows the ISP-facing G0/1. A related mistake is forgetting one of the two commands entirely; NAT needs at least one inside and one outside interface.

Fix: no ip nat inside / ip nat outside on G0/1 and the reverse on G0/0, then clear ip nat translation * .

24.7.3 Pool exhausted

With dynamic NAT (no overload ), the fourth user in the morning cannot browse. The pool has three addresses and all are allocated. The statistics show the allocation at 100% and a growing misses counter for the pool.

R1# show ip nat statistics

Total active translations: 9 (0 static, 9 dynamic; 6 extended)

type generic, total addresses 3, allocated 3 (100%), misses 12

Figure 24-11 A fully allocated dynamic pool; "misses 12" counts hosts that could not get an address.

Fix: add overload to the NAT rule (after clearing translations) so the three addresses can be shared, or obtain more public addresses. Lowering the translation timeout with ip nat translation timeout helps only marginally.

Watch out

NAT happens after routing for inside-to-outside traffic and before routing for outside-to-inside traffic. An inbound ACL on the outside interface therefore sees the inside global (public) destination, while an inbound ACL on the inside interface sees inside local (private) sources. Write ACLs with this order in mind.

LAB Configure Static NAT and PAT on an Edge Router

Goal: Give all users in 192.168.10.0/24 Internet access by sharing R1's outside address, and publish the internal web server 192.168.10.100 as 203.0.113.3.

Topology: Figure 24-1. R1 G0/0 192.168.10.1/24 (inside), G0/1 203.0.113.2/29 (outside), default route to 203.0.113.1. An ISP router simulates the Internet with a loopback 198.51.100.10 and routes 203.0.113.0/29 to R1.

Steps:

1. Mark the interfaces: ip nat inside on G0/0, ip nat outside on G0/1.
2. Create the server mapping: ip nat inside source static 192.168.10.100 203.0.113.3 .
3. Create the user ACL and PAT rule: access-list 1 permit 192.168.10.0 0.0.0.255 and ip nat inside source list 1 interface GigabitEthernet0/1 overload .
4. From PC1 and PC2, ping and browse to 198.51.100.10. From the ISP router, browse to 203.0.113.3.

Verify:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global

icmp 203.0.113.2:1 192.168.10.10:1 198.51.100.10:1 198.51.100.10:1 icmp 203.0.113.2:1024 192.168.10.11:1 198.51.100.10:1 198.51.100.10:1 --- 203.0.113.3 192.168.10.100 --- ---

tcp 203.0.113.3:80 192.168.10.100:80 203.0.113.1:33012 203.0.113.1:33012 Total number of translations: 4

Figure 24-12 Lab result: two PAT entries sharing 203.0.113.2 (the ICMP identifier acts as the port), the static entry, and an inbound session to the server.

Expected results: Both PCs reach 198.51.100.10 with their traffic sourced from 203.0.113.2; the server is reachable from outside at 203.0.113.3, and its own outbound traffic uses 203.0.113.3 because the static entry takes precedence over the PAT rule. show ip nat statistics lists G0/0 as inside and G0/1 as outside.

Chapter review

Key terms

Nat

Rfc 1918

Pat

1. A PC with address 10.1.1.5 sends a packet to the Internet; the router translates its source to 198.51.100.7. What is 10.1.1.5 called?

A. Inside global
B. Inside local
C. Outside local
D. Outside global

2. In the same scenario, what is 198.51.100.7 called?

A. Inside global
B. Inside local
C. Outside local
D. Outside global

3. Which type of NAT allows an Internet host to initiate a connection to an internal server at any time?

A. Dynamic NAT
B. PAT using the interface
C. Static NAT
D. PAT using a pool

4. Which command translates all hosts permitted by ACL 1 to the address of G0/1, sharing it among them?

A. ip nat inside source list 1 interface g0/1
B. ip nat inside source list 1 interface g0/1 overload
C. ip nat outside source list 1 interface g0/1 overload
D. ip nat inside source static list 1 g0/1

5. Which two commands are required on the router interfaces for any NAT to work? (Choose two.)

A. ip nat inside
B. ip nat enable
C. ip nat outside
D. ip nat pool
E. ip nat overload

6. What is the purpose of the ACL in ip nat inside source list 1 pool PUBLIC ?

A. To block traffic from outside
B. To identify which inside local addresses are translated
C. To define the public addresses
D. To permit return traffic

7. A dynamic NAT pool contains 5 addresses and no overload . How many inside hosts can access the Internet simultaneously?

A. 1
B. 5
C. 254
D. About 65,000

8. Which command removes all dynamic NAT translations?

A. clear ip nat translations all
B. clear ip nat translation *
C. no ip nat inside
D. reset nat table

9. show ip nat translations is empty, and show ip nat statistics shows Hits 0, Misses 0, while users report no Internet access. Which two are likely causes? (Choose two.)

A. The ACL does not permit the users' subnet.
B. The pool is exhausted.
C. The inside and outside interface commands are reversed.
D. The static NAT entry is wrong.
E. The translation timeout is too long.

10. In show ip nat translations , which column appears first?

A. Inside local
B. Inside global
C. Outside local
D. Outside global

11. How does PAT distinguish return traffic for two inside hosts that share one public address?

A. By their MAC addresses
B. By the TCP/UDP port numbers (or ICMP identifiers) in the translation table
C. By the IP TTL value
D. By the DSCP marking

12. Which two statements about static NAT are true? (Choose two.)

A. It requires an ACL.
B. It creates a permanent one-to-one mapping.
C. Its entries are removed by clear ip nat translation *.
D. It is commonly used to publish internal servers.
E. It translates the destination of outbound packets.

Answers

1. B. The inside host's address as seen on the inside network is the inside local address.
2. A. The inside host's address as seen from outside is the inside global address.
3. C. Static NAT keeps a permanent mapping, so outside hosts can initiate connections. Dynamic NAT and PAT create entries only for inside-initiated traffic.
4. B. The overload keyword enables PAT. Without it (A), only one host could use the address at a time.
5. A, C. Every NAT design needs inside and outside interfaces marked. The other options are not valid interface commands.
6. B. The ACL only selects the inside local addresses eligible for translation.
7. B. Dynamic NAT is one-to-one, so five addresses serve five hosts at a time.
8. B. The command is clear ip nat translation * , singular, with an asterisk.
9. A, C. Both prevent any translation from being attempted. An exhausted pool would show misses and existing translations.
10. B. The order is Inside global, Inside local, Outside local, Outside global.
11. B. PAT tracks address-plus-port pairs, rewriting the source port when needed to keep each flow unique.
12. B, D. Static NAT is a permanent one-to-one mapping used for servers; it needs no ACL and is not cleared by the clear command.