CCNA online course

Cisco PAT Configuration and NAT Overload

Learn Cisco IOS PAT configuration using an outside interface or NAT pool, including ACLs, verification commands, troubleshooting, and design limits.

What PAT Does

Port Address Translation (PAT) is a form of dynamic Network Address Translation (NAT) that allows many private IPv4 hosts to share one or more public IPv4 addresses. Cisco IOS commonly calls PAT NAT overload because the router overloads a public address by using different source port mappings for separate connections.

Private addresses, such as 192.168.10.0/24, 172.16.0.0/12, and 10.0.0.0/8, are intended for internal networks and are not routed across the public Internet. A public address, such as an address assigned by an ISP, is globally routable. PAT translates private source addresses and ports into a public source address and unique translated ports before traffic leaves the network.

PAT is commonly used when a small office, branch network, or lab has many internal devices but only one public IPv4 address. It provides outbound IPv4 connectivity and conserves public address space. PAT is not, by itself, a complete firewall or security policy.

How Address and Port Sharing Works

Suppose two inside hosts start simultaneous TCP sessions to an external server. The router can translate both source addresses to the same public address while assigning different source ports:

Host A: 192.168.10.10:49152  -> 203.0.113.2:30001
Host B: 192.168.10.11:49153  -> 203.0.113.2:30002

The translation table records each mapping. When return traffic arrives at 203.0.113.2 and a translated port, the router uses the table to send the packet to the correct private host and original port. TCP and UDP sessions use transport-layer port numbers. For ICMP, the router can use an ICMP identifier when creating a translation.

NAT Terminology and Traffic Direction

NAT terminology describes an address from the perspective of the inside or outside network. “Local” means the address as seen from the local side, while “global” means the address used on the other side of the NAT boundary.

NAT Address Terminology

Term | Meaning | Example Address | Where It Is Used

Inside local | The private address assigned to an inside host | 192.168.10.10 | Inside LAN

Inside global | The public address representing an inside host to outside networks | 203.0.113.2 | Outside-facing traffic

Outside local | The outside host address as it appears to the inside network | 198.51.100.20 | Inside view of an outside host

Outside global | The globally routable address assigned to an outside host | 198.51.100.20 | Outside network

The interface connected to the private LAN is marked with ip nat inside. The interface connected to an ISP, upstream router, or other external network is marked with ip nat outside. These labels describe the NAT boundary; they do not replace normal routing.

Translations are normally created when traffic travels from an inside interface toward an outside interface and matches the NAT rule. Return traffic is matched against the translation table. The router reverses the address and port changes, then forwards the response toward the inside host.

Prerequisites Before Configuring PAT

PAT depends on working addressing, interfaces, and routing. Configure and test those foundations first.

  1. Give each host a correct IPv4 address and subnet mask.
  2. Set the NAT router's inside interface as the hosts' default gateway.
  3. Configure the router's inside and outside interface addresses.
  4. Activate the interfaces with no shutdown.
  5. Ensure the router can reach the inside LAN and the upstream next hop.
  6. Install a default route toward the upstream router or ISP.
  7. Test basic connectivity before enabling NAT.
interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 no shutdown
interface GigabitEthernet0/1
 ip address 203.0.113.2 255.255.255.252
 no shutdown
ip route 0.0.0.0 0.0.0.0 203.0.113.1

In this example, an inside host should use 192.168.10.1 as its default gateway. The router's default route sends destinations that are not in its routing table to 203.0.113.1.

Using a Standard ACL to Select Inside Hosts

A standard IPv4 ACL matches source addresses. For PAT, it identifies which inside sources are eligible for translation. It does not necessarily act as an interface traffic-filtering policy. The ACL is referenced by the NAT rule, so its purpose here is source selection.

A wildcard mask uses the opposite logic of a subnet mask: a zero bit must match, and a one bit may vary. Therefore, the wildcard mask for a /24 network is 0.0.0.255.

access-list 1 permit 192.168.10.0 0.0.0.255

A named standard ACL is easier to maintain and can include multiple inside networks:

ip access-list standard NAT_INSIDE
 permit 192.168.10.0 0.0.0.255
 permit 192.168.20.0 0.0.0.255

Only include networks that should use this NAT policy. Check the actual client addresses rather than assuming that the client is in the expected VLAN or subnet.

Configure PAT with the Outside Interface Address

Interface-based PAT uses the public IPv4 address currently configured on the outside interface. This is convenient when the ISP assigns one public address directly to the router or when the outside address can change.

  1. Match inside source addresses with a standard ACL.
  2. Mark every LAN-facing interface with ip nat inside.
  3. Mark the WAN-facing interface with ip nat outside.
  4. Reference the ACL and outside interface in an overload rule.
access-list 1 permit 192.168.10.0 0.0.0.255
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside
ip nat inside source list 1 interface GigabitEthernet0/1 overload

For two internal networks, use the named ACL created earlier:

ip nat inside source list NAT_INSIDE interface GigabitEthernet0/1 overload

The complete rule means: translate inside sources permitted by the ACL, use the address on GigabitEthernet0/1, and allow many translations to share that address through port translation.

Configure PAT with a NAT Pool

A NAT pool is a range of public IPv4 addresses that the router can use for translations. Pool-based PAT is appropriate when an organization has several public addresses and wants to distribute translations across them, or when the public addresses are separate from the interface address.

ip nat pool PUBLIC_POOL 198.51.100.10 198.51.100.14 netmask 255.255.255.248
access-list 10 permit 10.10.10.0 0.0.0.255
ip nat inside source list 10 pool PUBLIC_POOL overload

The pool has a start address, an end address, and a subnet mask. The ACL selects 10.10.10.0/24. The overload keyword permits multiple hosts and sessions to share the addresses in the pool. Without overload, the available addresses are allocated as ordinary dynamic NAT mappings and can be exhausted by concurrent hosts.

Interface-Based PAT vs Pool-Based PAT

Characteristic | Outside Interface Address | NAT Pool

Public address source | Address configured on the outside interface | Defined start-to-end public range

Typical use | One public address or dynamically assigned WAN address | Several assigned public addresses

Primary command | interface GigabitEthernet0/1 overload | pool PUBLIC_POOL overload

Address changes | Follows the outside interface address | Requires a valid configured pool

Sharing behavior | Many hosts share one interface address | Many hosts share one or more pool addresses

Verifying PAT Operation

Translations are generally created only after matching inside-to-outside traffic is generated. Start a ping, DNS lookup, web request, or another permitted application session from an inside host. Then inspect the router.

PAT Verification Commands

Command | What It Verifies | Expected Evidence

show ip nat translations | Active address and port mappings | Inside local and global entries, outside addresses, protocols, and ports

show ip nat statistics | NAT configuration and operation counters | Inside/outside interfaces, ACL or pool association, hits, misses, and active translations

show access-lists | ACL contents and match counters | The NAT ACL has matches from real inside source addresses

show ip access-lists | Detailed ACL entries and counters | Correct networks and wildcard masks

show ip interface brief | Interface state and addresses | Relevant interfaces are up/up with expected addresses

show ip route | Routing and default route | A gateway of last resort or appropriate outside route

ping 203.0.113.1 | Reachability to the upstream next hop | Successful replies from the router's outside side

A representative translation might look conceptually like this:

Protocol  Inside global        Inside local         Outside local       Outside global
tcp       203.0.113.2:30001    192.168.10.10:49152   198.51.100.20:443   198.51.100.20:443

Read the entry from left to right for the translated outbound flow. The inside local value is the original private host and port. The inside global value is the public address and translated port. The outside local and outside global values identify the remote host as viewed on each side of the NAT boundary.

Ping is useful for a basic test, but ICMP does not behave exactly like TCP or UDP. A successful ICMP test does not prove that every application will work, and a failed ping may reflect ICMP filtering rather than a PAT failure. Test the actual TCP or UDP application when possible.

Troubleshooting PAT

Common PAT Failures

Symptom | Likely Cause | Verification Step | Correction

No translations appear | Missing NAT interface role or no matching traffic | Inspect interfaces and generate traffic; run show ip nat translations | Add the correct inside/outside commands and test from an inside host

No translations appear | ACL has the wrong network or wildcard mask | Run show access-lists and compare client addresses | Correct the source network or wildcard mask

Translations appear but traffic fails | Missing default route or upstream return routing | Run show ip route and ping the next hop | Add the default route and correct upstream routing

Translations appear but link fails | Outside interface is down or incorrectly addressed | Run show ip interface brief | Correct addressing, cabling, or interface state

One host works but concurrent sessions fail | overload is missing or a pool is exhausted | Review the NAT rule and active translations | Add overload when address sharing is required, or provide more addresses

ACL has zero matches | Clients use another subnet or another forwarding path | Compare host configuration, VLANs, and routing | Update the NAT ACL and validate the topology

Old entries affect a retest | Dynamic translations remain active | Run show ip nat translations | During controlled maintenance or lab testing, clear dynamic entries

Ordered Diagnostic Method

  1. Check host addressing, subnet mask, and default gateway.
  2. Use show ip interface brief to confirm that inside and outside interfaces are up and have the expected addresses.
  3. Confirm each LAN-facing interface has ip nat inside and the external interface has ip nat outside.
  4. Compare the actual client source subnet with the NAT ACL and wildcard mask.
  5. Confirm the NAT rule contains overload.
  6. Confirm the outside interface has a usable address, or confirm that the NAT pool is valid and available.
  7. Use show ip route to verify the default route and test the upstream next hop.
  8. Generate new inside-to-outside traffic and check whether translations are created.
  9. Inspect ACL counters and NAT statistics. An ACL with zero matches usually indicates a source-address, wildcard-mask, VLAN, or forwarding-path problem.
  10. For controlled testing after configuration changes, remove dynamic entries with clear ip nat translation *, then generate fresh traffic.

Practical Scenarios

One Private LAN and One Public Address

For 192.168.10.0/24 behind a router whose outside address is 203.0.113.2, use an ACL for the private subnet and an interface-based overload rule. All eligible hosts share 203.0.113.2, while their translated ports keep sessions distinct.

Multiple Inside Networks

When both 192.168.10.0/24 and 192.168.20.0/24 need outbound access, add both networks to a standard named ACL. Ensure both LAN interfaces are marked inside. One outside-interface PAT rule can then translate both networks.

ACL Mismatch

If clients actually use 192.168.10.0/24 but the ACL permits 192.168.1.0 0.0.0.255, the ACL counter remains at zero and no translations are created. Correct the ACL to match the real source subnet and test again.

Missing Default Route

A translation can exist even when the remote network is unreachable. If show ip nat translations contains entries but users cannot reach external destinations, separate NAT from routing: verify the default route, outside interface state, next-hop reachability, and upstream return behavior.

PAT Limitations and Design Considerations

  • PAT depends on available transport ports and router resources. A very large user population or many simultaneous sessions may require multiple public addresses, additional routers, or another architecture.
  • Some protocols and applications carry IP addresses or port information inside their payloads. Such applications may need application-aware translation, a gateway, or special configuration.
  • PAT primarily conserves IPv4 addresses and hides internal addresses. It should not be treated as a substitute for firewall rules, segmentation, authentication, or endpoint security.
  • Outbound PAT is different from inbound static NAT or port forwarding. Publishing an internal web server or other service normally requires a static mapping or destination port-forwarding rule.
  • Document inside networks, public pools, interface roles, and exceptions. Avoid overlapping inside and outside address ranges because ambiguous addressing can prevent correct routing and translation.

Related Cisco IOS Topics

Review computer networking fundamentals for forwarding concepts, router-on-a-stick configuration for multiple VLAN interfaces, and OSPF configuration for dynamic routing that may provide internal reachability. Static NAT and inbound service publishing should be studied separately from outbound PAT.