CCNA online course

Network Address Translation (NAT): Definition, Types, and Cisco Configuration

Learn how IPv4 NAT works, compare static NAT, dynamic NAT, and PAT, and configure and troubleshoot NAT on Cisco IOS routers.

What Is Network Address Translation?

Network Address Translation (NAT) is a router or firewall function that changes IP addressing information as traffic passes between network address domains. The most common example is translating private IPv4 addresses inside an organization into publicly routable IPv4 addresses used on an external network.

NAT primarily helps conserve scarce IPv4 address space and allows private networks to communicate with external networks. A NAT device records the translation so that return traffic can be sent to the correct internal host.

For example, a workstation using 192.168.10.25 might access a web server on the Internet. The NAT router can replace the workstation's private source address with its public address before forwarding the packet. When the reply returns, the router reverses the translation.

Why IPv4 Networks Use NAT

IPv4 public-address scarcity

IPv4 uses 32-bit addresses, providing a finite address space. The number of devices needing network connectivity is much larger than the number of convenient globally routable IPv4 addresses. Assigning a unique public address to every workstation, phone, printer, and server is therefore impractical.

Private IPv4 addressing

Private IPv4 addresses are intended for internal networks and are not routed across the public Internet. The RFC 1918 ranges are:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

Organizations can reuse these ranges in separate networks. Because Internet routers do not normally forward private addresses, an internal host needs NAT or another translation mechanism to communicate with a public IPv4 service.

NAT lets many internal hosts share one or more public addresses. It also commonly produces an address-hiding effect: an external service sees the translated address rather than the original private address. This effect does not replace a firewall policy because NAT alone does not define which traffic is permitted.

NAT Address-Direction Model

The inside network is the organization-controlled side, usually containing private hosts. The outside network is the external or service-provider side. On a Cisco router, interfaces are assigned an inside or outside NAT role.

Inside host                         NAT router                         Outside server
192.168.10.25:49152  ---->  [inside | outside]  ---->  198.51.100.20:443
       private source             translates address/port          public destination

Return traffic:
198.51.100.20:443  ---->  translated public address/port  ---->  192.168.10.25:49152

For outbound traffic, the source fields commonly change: the inside local address and, with PAT, the source port become an inside global address and translated port. For inbound traffic to a published service, the destination fields may be translated from a public address to an internal address. The exact fields depend on the traffic direction and NAT design.

NAT Terminology

The NAT translation table stores active mappings. A PAT entry generally includes the protocol, inside-local address and port, inside-global address and translated port, and outside address and port.

The terms local and global describe the address view, not whether the address is always private or public. In common deployments, inside local is private and inside global is public, but the terminology is based on perspective.

Main NAT Types

Static NAT

Static NAT creates a fixed one-to-one mapping between an inside local address and an inside global address. The mapping remains configured even when the server is idle.

A typical use is publishing an internal web server. If 192.168.10.50 is represented externally by 203.0.113.50, external clients can use the public address to reach the server, subject to routing and security policy.

ip nat inside source static 192.168.10.50 203.0.113.50

Static NAT consumes one public IPv4 address per mapping. The mapping alone does not guarantee reachability: the upstream network must route the public address to the NAT device, filtering must allow the service, and the server must have a correct return path.

Dynamic NAT

Dynamic NAT allocates an inside global address from a configured public-address pool when an eligible internal host starts communicating. The mapping is temporary rather than permanently assigned.

access-list 1 permit 10.1.1.0 0.0.0.255
ip nat pool PUBLIC_POOL 203.0.113.100 203.0.113.105 netmask 255.255.255.0
ip nat inside source list 1 pool PUBLIC_POOL

The standard ACL identifies which inside source addresses may be translated. The pool contains six public addresses in this example. If six concurrent hosts consume the available addresses, another host cannot obtain a dynamic translation until an existing mapping ages out or is removed.

Dynamic NAT normally provides one public address per active inside host. It does not use port sharing unless the overload keyword is added.

PAT and NAT Overload

Port Address Translation (PAT) is many-to-one NAT. It allows multiple internal sessions to share one public IPv4 address by distinguishing sessions with TCP or UDP port numbers and other protocol identifiers. Cisco IOS commonly calls PAT NAT overload.

PAT is the most common Internet-edge NAT design because a small office can connect many hosts through one ISP-assigned address. For example, two hosts can use the same public source address while the router assigns different source ports to their sessions.

access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload

This configuration uses the address configured on GigabitEthernet0/1 as the inside global address. PAT can also use a pool:

ip nat inside source list 1 pool PUBLIC_POOL overload

Unlike static NAT, PAT does not require a dedicated public address for each internal host. Unlike ordinary dynamic NAT, it can support many simultaneous internal hosts per public address, subject to available ports, protocol behavior, and device capacity.

Configuring NAT on a Cisco Router

Step 1: Identify the interfaces

Determine which interface faces the internal LAN and which faces the ISP or external network. In this example, the LAN uses GigabitEthernet0/0 and the WAN uses GigabitEthernet0/1.

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
interface GigabitEthernet0/1
 ip address 203.0.113.2 255.255.255.252
 ip nat outside

Step 2: Match inside source addresses

For common source NAT configurations, a standard ACL identifies the internal source subnet. An ACL used for NAT selection does not automatically act as a complete security policy; its purpose here is to select addresses for translation.

access-list 1 permit 192.168.10.0 0.0.0.255

Step 3: Select the NAT method

For a small office with one public WAN address, use PAT:

ip nat inside source list 1 interface GigabitEthernet0/1 overload

For a permanent server mapping, use static NAT instead:

ip nat inside source static 192.168.10.50 203.0.113.50

For temporary one-to-one mappings from a range, configure a pool:

ip nat pool PUBLIC_POOL 203.0.113.100 203.0.113.105 netmask 255.255.255.0
ip nat inside source list 1 pool PUBLIC_POOL

Step 4: Confirm routing and gateways

NAT does not replace routing. Internal hosts need the NAT router as their default gateway. The router needs a route toward the external network, commonly a default route to the ISP. The upstream network also needs a valid return path for addresses used by static NAT or public pools.

How NAT Translations Behave

Suppose 192.168.10.25:49152 opens an HTTPS session to 198.51.100.20:443. With PAT, the router may create an entry similar to:

tcp 192.168.10.25:49152  203.0.113.2:62001  198.51.100.20:443  198.51.100.20:443

The first pair represents the inside local address and port. The second pair represents the inside global address and translated port. The destination information identifies the outside host and service. Cisco output formatting can label these fields as inside local, inside global, outside local, and outside global.

On the outbound path, the router checks whether the packet matches a NAT rule, creates or updates a translation, changes the required fields, and forwards the packet. On the return path, the destination address and port match the existing entry. The router restores the internal destination and forwards the packet toward the inside host.

Many dynamic and PAT entries are temporary. Their aging timers remove inactive entries so that addresses and ports can be reused. Static mappings remain because they are configured rather than learned from a session.

Practical Example: PAT for a Small Office

A LAN uses 192.168.10.0/24, and the Cisco router's WAN interface has one public address. Hosts 192.168.10.25 and 192.168.10.26 can both connect to the Internet through the same WAN address. The router differentiates their sessions with translated source ports.

access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload

If the ACL matches the hosts, both interfaces have the correct NAT roles, and routing is valid, active entries appear after the hosts generate traffic.

Practical Example: Static NAT for a Web Server

An internal web server at 192.168.10.50 is represented by 203.0.113.50:

ip nat inside source static 192.168.10.50 203.0.113.50

This creates a permanent one-to-one identity. A separate firewall or ACL rule should permit only the required web service, such as TCP port 443. The public address must be routed to the NAT router, and the server must send replies through a valid gateway.

Verifying Cisco NAT

Generate traffic from an inside host before checking translations. A configured rule may not create a dynamic or PAT entry until matching traffic is processed.

Common NAT Failures

Limitations and Design Considerations

• NAT changes the original end-to-end addressing model, which can make packet tracing and troubleshooting more difficult.
• Some application protocols embed IP addresses or port numbers inside their payloads. These protocols may require NAT-aware application handling, an application gateway, or additional configuration.
• NAT is not a replacement for firewall policy, access control, authentication, or network segmentation.
• Static NAT can publish services, but publishing should be combined with restrictive inbound policy and host hardening.
• IPv6 provides a much larger address space and generally reduces the need for address-conservation NAT. IPv4 NAT remains common because many existing networks and Internet connections still use IPv4.

Exam-Relevant Notes

• Static NAT is fixed and one-to-one.
• Dynamic NAT assigns temporary one-to-one mappings from a NAT pool.
• PAT or NAT overload allows many internal hosts to share an address by using transport-layer ports or other identifiers.
• Inside local is usually the private address assigned to the internal host.
• Inside global is the public address representing that host externally.
• The NAT router must have correctly designated inside and outside interfaces.
• NAT does not repair missing routes or replace security controls.

Related Cisco Networking Topics

Review the Computer Network Explained lesson for foundational networking concepts, and study Configure OSPF and Configure Router on a Stick for routing and interface design context.