Dynamic NAT Configuration and Operation for CCNA

Learn Dynamic NAT terminology, address pools, ACL selection, Cisco IOS configuration, verification, capacity planning, and troubleshooting.

Network Address Translation (NAT) translates IPv4 addresses between network realms. At a network boundary, a router can translate private inside addresses into addresses that can be routed on an external or public network.

This lesson focuses on Dynamic NAT: temporary, automatic, one-to-one translation from an eligible inside host to an available address in a configured public address pool.

Why NAT Is Used

Private IPv4 addresses are intended for use inside networks and are not normally routed across the public Internet. Common private ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. NAT allows many organizations to use these addresses internally while translating selected traffic at the network boundary.

Address conservation: Internal hosts can use private addresses, reducing the number of public IPv4 addresses required.
Internal-address hiding: External networks normally see a translated address instead of the original private address.
Overlapping networks: NAT can help connect or migrate networks that use the same private address space, although overlapping designs require careful planning and may need additional translation rules.

NAT is not a complete security solution. It does not replace firewall policy, access control, endpoint security, logging, or proper routing. A translation may permit return traffic for an established flow while a separate firewall still needs to decide which traffic is allowed.

Dynamic NAT Definition

Dynamic NAT automatically creates a one-to-one mapping between an eligible inside local address and one available address from a NAT pool. The router normally creates the mapping when qualifying traffic starts from the inside network.

While the mapping is active, that inside host uses the assigned inside global address when represented on the outside network. When the translation ages out because of inactivity, or an administrator clears it, the pool address becomes available for reuse.

Every active inside host requires its own available pool address. Therefore, a Dynamic NAT pool with five usable addresses can support at most five simultaneous one-to-one host translations, regardless of how many total hosts exist internally.

NAT Address Terminology

NAT terminology describes an address from the perspective of the inside and outside network realms. “Local” means how an address is represented in one realm; “global” means the address used to represent it in the other realm.

Address type	Meaning	Typical location	Example
Inside local	The address assigned to an inside host, typically a private IPv4 address.	Inside network	192.168.10.25
Inside global	The translated address that represents the inside host to the outside network.	Outside-facing representation of the inside host	203.0.113.10
Outside local	The outside host address as represented from the inside perspective.	Inside view of an outside host	198.51.100.20
Outside global	The globally routable address assigned to the outside host.	Outside network	198.51.100.20

In a simple Internet connection, outside local and outside global are often identical. They differ when the outside address is also translated by a NAT device.

Inside host                         NAT router                 External server
192.168.10.25  -- outbound -->  203.0.113.10  -->  198.51.100.20
inside local                    inside global       outside global

Return traffic to 203.0.113.10 matches the active translation and is
translated back to 192.168.10.25.

NAT Interface Roles and Packet Direction

A NAT rule alone is not sufficient. The router must also know which interfaces face the internal and external network realms.

NAT inside: Mark the interface connected toward the internal LAN.
NAT outside: Mark the interface connected toward the ISP or external network.

For outbound traffic, a packet enters the router through the inside interface. If its source address matches the NAT selection policy and a pool address is available, the router translates the source before forwarding the packet through the outside interface.

For return traffic, the packet enters through the outside interface with the inside global address as its destination. The router looks up the active translation, changes the destination back to the inside local address, and forwards the packet through the inside interface.

NAT Pools and Capacity

A NAT pool is a configured range of addresses that Dynamic NAT can allocate as inside global addresses. The pool has a starting address, an ending address, and a subnet mask or prefix-length design that identifies the public block.

The number of usable addresses in the pool determines the maximum number of simultaneous dynamic one-to-one host mappings. A pool does not need to contain an address for every employee or every device if translations are temporary; it should be sized for expected concurrent use.

Public pool size	Active inside hosts requesting translation	Expected result	Reason
5	3	3 hosts receive mappings	Two pool addresses remain available.
5	5	All 5 hosts receive mappings	The pool is fully allocated.
5	6	One host cannot receive a mapping	Pool exhaustion prevents another one-to-one translation.

When the pool is exhausted, a new qualifying host cannot access external destinations through this Dynamic NAT rule until an existing mapping ages out, is cleared, or more public addresses are allocated. PAT is often more practical when many users must share a small public address allocation.

Selecting Traffic with a Standard ACL

A standard ACL commonly identifies which inside local source addresses are eligible for translation. A permit entry selects addresses for NAT matching; it does not by itself filter packets on an interface.

For the subnet 192.168.10.0/24, the ACL wildcard mask is 0.0.0.255:

access-list 10 permit 192.168.10.0 0.0.0.255

A wildcard mask uses a zero where the corresponding address bit must match and a one where the bit can vary. Thus, the command selects all addresses from 192.168.10.0 through 192.168.10.255. The selected network must match the actual internal addressing plan. An ACL for 192.168.1.0/24 will not select hosts in 192.168.10.0/24.

Basic Dynamic NAT Topology

Consider a router with a LAN on GigabitEthernet0/0 and an ISP-facing connection on GigabitEthernet0/1. The LAN is 192.168.10.0/24, and the organization has documentation-only public examples from 203.0.113.10 through 203.0.113.14.

LAN host 192.168.10.25
        |
Gi0/0: 192.168.10.1, NAT inside
        |
     Cisco router
        |
Gi0/1: 198.51.100.2, NAT outside
        |
ISP next hop: 198.51.100.1

Do not use documentation addresses as production public addresses. Replace them with ranges actually allocated and routed to your organization.

Dynamic NAT Configuration Workflow

Configure host addressing and the router interfaces.
Ensure inside hosts use the LAN interface address as their default gateway.
Ensure the router has a route to the external network, commonly a default route.
Mark the LAN-facing interface as NAT inside.
Mark the WAN-facing interface as NAT outside.
Create a standard ACL that selects eligible inside local addresses.
Create a named NAT pool.
Bind the ACL to the pool with an inside-source Dynamic NAT rule.
Generate traffic from an eligible inside host and verify the translation.

access-list 10 permit 192.168.10.0 0.0.0.255

ip nat pool PUBLIC_POOL 203.0.113.10 203.0.113.14 netmask 255.255.255.248
ip nat inside source list 10 pool PUBLIC_POOL

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
 no shutdown

interface GigabitEthernet0/1
 ip address 198.51.100.2 255.255.255.252
 ip nat outside
 no shutdown

ip route 0.0.0.0 0.0.0.0 198.51.100.1

The exact interface names, addresses, mask, and upstream next hop depend on the topology. The pool mask must correspond to the public address block design, and the provider must route that public range toward the router.

Component	Purpose	Typical Cisco IOS configuration element	Common error
Standard ACL	Selects eligible inside local source addresses.	`access-list 10 permit ...`	Wrong subnet or wildcard mask.
NAT pool	Provides possible inside global addresses.	`ip nat pool ...`	Invalid range, mask, or insufficient addresses.
Binding rule	Connects the ACL to the pool.	`ip nat inside source list 10 pool PUBLIC_POOL`	Rule omitted or references the wrong ACL or pool.
Inside role	Identifies the LAN-facing NAT boundary.	`ip nat inside`	Configured on the wrong interface or omitted.
Outside role	Identifies the external-facing NAT boundary.	`ip nat outside`	WAN interface is not marked outside.

Translation Lifecycle

When a host such as 192.168.10.25 sends qualifying traffic, the router checks the ACL and selects an unused pool address, for example 203.0.113.10. It records a binding between the two addresses.

While active, packets from that host are represented externally as 203.0.113.10. Return packets addressed to that public address are matched against the translation table and delivered to 192.168.10.25.

Dynamic mappings are temporary. Aging removes inactive entries, allowing the public address to be reused by another inside host. The command clear ip nat translation * removes active translations immediately, which can interrupt sessions. Use it carefully during testing or maintenance.

Static NAT behaves differently: a manually configured mapping remains present until the configuration is removed. Dynamic NAT does not guarantee that a host will receive the same pool address after its old mapping expires.

Dynamic NAT Compared with Static NAT and PAT

Feature	Dynamic NAT	Static NAT	PAT/NAT overload
Mapping	Automatic temporary one-to-one mapping.	Manual permanent one-to-one mapping.	Many flows or hosts share one or a small number of addresses using Layer 4 ports.
Pool requirement	Requires an available address for each active host.	Requires a reserved address for each fixed mapping.	Can use an interface address or a small address pool.
Typical use	Inside hosts that need temporary public representation and have enough public addresses.	Servers or devices requiring a predictable address.	General outbound access when public IPv4 addresses are limited.
Address conservation	Moderate.	Low for each permanently mapped host.	High.
Inbound initiation	Usually not predictable because mappings are created by inside traffic.	Suitable for predictable inbound destination mapping.	Usually requires port forwarding or another explicit destination rule.

Destination NAT and port forwarding translate an incoming destination address or port to an internal service. They are conceptually different from this lesson’s inside-source Dynamic NAT rule, which translates traffic originating from the inside.

For a business with 100 internal users and only two public IPv4 addresses, plain Dynamic NAT can support only two simultaneous active host mappings. PAT using an interface address or a small pool can support many simultaneous connections because ports distinguish individual flows.

Verification and Monitoring

Verify the complete forwarding path, not only the NAT rule. The router needs operational interfaces, correct addressing, a reachable next hop, appropriate routing, a matching ACL, valid pool addresses, and traffic that actually crosses from inside to outside.

Command	What it verifies	Expected evidence	Troubleshooting implication
`show ip interface brief`	Interface addresses and operational state.	Inside and outside interfaces are up/up with expected addresses.	Down interfaces prevent forwarding and NAT processing.
`show running-config \| section interface`	Interface roles and interface configuration.	`ip nat inside` and `ip nat outside` appear on the correct interfaces.	Missing or reversed roles can prevent translations.
`show ip route`	Connected and learned routes.	A route to the external destination and a usable default route exist.	Translation alone cannot provide reachability.
`show running-config \| include ip nat`	Configured NAT rules and pool statements.	The pool and inside-source binding are present.	Missing or incorrect statements identify configuration errors.
`show access-lists 10`	ACL entries and match counters.	The correct permit entry has increasing matches.	Zero matches often indicate a wrong subnet, wildcard, or source address.
`show ip nat statistics`	NAT counters, interfaces, rules, and pool use.	Inside/outside roles, hits, misses, and pool utilization are visible.	Misses or an exhausted pool explain failed allocations.
`show ip nat translations`	Active translation table.	An inside local address is paired with an inside global address.	No entry means traffic has not qualified, has not started, or could not allocate a pool address.
`ping 198.51.100.1`	Basic reachability to the upstream next hop.	Successful replies from the router.	Failure indicates an addressing, link, VLAN, or upstream problem before NAT is investigated.

Translation output commonly displays inside local, inside global, outside local, and outside global addresses, along with the protocol or translation type. The exact formatting varies by IOS release.

show ip nat translations
show ip nat statistics
show access-lists 10

During controlled testing, debug ip nat can show translation events. Use debugging cautiously because it can generate substantial output and affect device operation, especially on production routers. Stop debugging after the test.

Troubleshooting Dynamic NAT

No translation entry appears

Confirm the client is generating traffic toward an external destination.
Check that the client’s default gateway is the router’s inside address.
Use show access-lists to confirm the actual source address matches a permit entry.
Check the wildcard mask. For 192.168.10.0/24, use 0.0.0.255, not a wildcard for another subnet.
Confirm the LAN interface has ip nat inside and the WAN interface has ip nat outside.
Confirm the NAT pool and binding statement are present.

The ACL does not match the LAN

If the real LAN is 192.168.10.0/24 but the ACL permits 192.168.1.0 0.0.0.255, no host in the real LAN is selected. Correct the ACL and test again:

no access-list 10
access-list 10 permit 192.168.10.0 0.0.0.255

An interface role is missing

A correct ACL, pool, and binding rule still cannot work if the packet does not cross interfaces identified as inside and outside. Inspect the interface configuration and apply the missing designation:

interface GigabitEthernet0/1
 ip nat outside

Some users work and later users fail

This commonly indicates pool exhaustion. Compare the number of active translations with the number of pool addresses using show ip nat statistics and show ip nat translations. Increase the pool if public addresses are available, or use PAT when many users must share limited IPv4 space. Clear stale test entries only when disrupting active sessions is safe.

A pool is rejected or behaves unexpectedly

Verify that the starting address is not greater than the ending address.
Confirm the mask represents the intended public block.
Check for overlap with interface addresses or other translation configuration.
Confirm the provider routes the public range toward the NAT router.

A translation exists but communication fails

NAT translation does not guarantee end-to-end reachability. Check the default route, upstream return routing, interface status, firewalls, ACLs, host security software, and destination service availability. Use ping and traceroute from appropriate points and review upstream filtering.

Rule order and interactions

Review all NAT statements when several translation policies exist. A different rule, an overlapping ACL, or a static mapping may affect which traffic is selected. Keep NAT policies specific, document their intended source networks, and avoid overlapping designs unless the behavior is understood and tested.

Design and Operational Considerations

Size a Dynamic NAT pool for expected concurrent translated hosts, not necessarily the total number of internal users.
Use only public addresses allocated to the organization in production. Documentation ranges such as 203.0.113.0/24 and 198.51.100.0/24 are for examples and documentation.
Document inside subnets, pool ranges, masks, interface roles, upstream routes, ACL names or numbers, and NAT policies.
Use PAT when the public pool is too small for the expected concurrency.
Remember that Dynamic NAT is primarily an IPv4 mechanism. IPv6 normally uses end-to-end routing and does not generally require conventional IPv4 NAT.

Exam-Relevant Notes

Dynamic NAT is automatic and temporary; Static NAT is manually configured and permanent.
Dynamic NAT uses one public address per active inside host.
PAT allows many flows to share an address by distinguishing them with Layer 4 ports.
The ACL attached to a NAT rule selects addresses for translation; it is not automatically an interface traffic filter.
Both ip nat inside and ip nat outside interface roles are required.
Pool exhaustion prevents new dynamic mappings.
Clear translations with care because existing sessions may be interrupted.

For related fundamentals, review the Computer Network Explained lesson and the OSI Reference Model. Routing knowledge is also essential when verifying NAT behavior; see Configure OSPF for a dynamic-routing example.