CCNA online course

Configure and Verify Static NAT on Cisco Routers

Learn how static NAT creates fixed one-to-one IPv4 mappings, then configure, verify, and troubleshoot static NAT on a Cisco IOS router.

Static Network Address Translation (NAT) creates a permanent one-to-one relationship between an internal private IPv4 address and a public IPv4 address. This lesson explains the address terminology, packet flow, Cisco IOS configuration, verification commands, and common troubleshooting steps.

Before starting, you should understand IPv4 addressing, router interfaces, default gateways, basic routing, Cisco IOS configuration modes, and IOS show commands. For related networking foundations, review the Computer Network Explained lesson and the OSI Reference Model.

What Static NAT Does

NAT is the process of changing IP addressing information as packets pass through a network device. With static NAT, an administrator manually configures a fixed mapping between one internal address and one external address.

The internal host keeps its private address on the LAN. External networks do not use that private address to reach the host. Instead, the NAT router represents the host with its configured public address.

• Inside-local address: the private address assigned to the internal host.
• Inside-global address: the public address that represents the internal host to outside networks.

For example, a host using 10.0.0.100 internally can be represented externally as 155.4.12.1. The mapping remains fixed until an administrator changes or removes it.

Because the mapping is permanent, static NAT supports both outbound connections from the internal host and inbound connections initiated toward its public address, provided routing, security policies, and the host service also permit the traffic.

When to Use Static NAT

Static NAT is useful when a particular internal device needs a predictable public identity. Common examples include publishing an internal web server, mail server, or other service, and giving a specific internal system a stable public IPv4 address.

Static NAT consumes public addresses inefficiently compared with PAT. Every permanently mapped internal host needs its own public address. If ten hosts each require dedicated public identities, the design needs ten public addresses.

Static NAT is therefore usually not the best choice when many internal clients only need occasional Internet access. PAT, also called NAT overload, allows many internal hosts to share one or a small number of public addresses by distinguishing flows with transport-layer port numbers.

Static NAT Address Terminology

Outside local and outside global often contain the same address in a simple design because no translation is being performed for the external host. They can differ when outside translation is configured.

Topology and Traffic Flow

A basic static NAT topology contains an inside host, a NAT-capable router, a LAN-facing router interface, a WAN-facing router interface, and an external server or Internet host.

• Host A: internal device at 10.0.0.100.
• R1: router performing NAT and routing.
• Inside interface: R1 interface connected to the private LAN.
• Outside interface: R1 interface connected to the ISP or public network.
• S1: external server reached through the outside network.

Outbound Traffic

Host A sends a packet toward S1. The packet initially uses 10.0.0.100 as its source address. When R1 receives the packet on its NAT inside interface, it changes the source address to 155.4.12.1 and forwards the packet through the NAT outside interface.

Return Traffic

S1 sends its reply to 155.4.12.1, because that is the address it saw as the source. R1 matches the static NAT entry, changes the packet's destination from 155.4.12.1 back to 10.0.0.100, and forwards the packet to Host A.

NAT does not replace routing. R1 must have a route toward the external destination, the upstream network must know how to reach the public address, and the internal host must have R1 as an appropriate default gateway.

Packet Flow Before and After Translation

Configure Static NAT on Cisco IOS

The configuration workflow is:

1. Confirm the internal and public addresses used by the design.
2. Create the permanent inside-local-to-inside-global mapping in global configuration mode.
3. Mark the LAN-facing interface as NAT inside.
4. Mark the WAN-facing interface as NAT outside.
5. Verify interface status, addressing, routing, and the translation table.

Example Topology Values

• Inside host: 10.0.0.100
• Public inside-global address: 155.4.12.1
• LAN-facing interface: GigabitEthernet0/0
• WAN-facing interface: GigabitEthernet0/1

IOS Configuration

R1> enable
R1# configure terminal
R1(config)# ip nat inside source static 10.0.0.100 155.4.12.1
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside
R1(config-if)# end

In the static mapping command, the first address is the inside-local address and the second address is the inside-global address. Use the actual interface names and addressing from your topology.

The public address must be valid for the design and routable through the upstream network. Interfaces also need correct IP addresses, appropriate subnet masks, and an operational up/up state.

Configuration Plan

Verify Static NAT

Display the Translation Table

R1# show ip nat translations

A representative entry may look conceptually like this:

Pro  Inside global       Inside local        Outside local       Outside global
---  155.4.12.1          10.0.0.100          ---                  ---

The static entry can appear before Host A generates traffic because it is configured permanently. Outside address fields may be populated or displayed differently when relevant traffic exists and depending on the IOS output format.

• Inside global: 155.4.12.1, the address external devices use for Host A.
• Inside local: 10.0.0.100, Host A's private address.
• Outside local: the outside host's address as represented from the inside perspective.
• Outside global: the actual address of the external host.

Confirm NAT Statements and Roles

R1# show running-config | include ip nat

Confirm that the output includes the static mapping and both interface roles. A typical result includes the equivalent of:

ip nat inside source static 10.0.0.100 155.4.12.1
 ip nat inside
 ip nat outside

Check Interfaces and Routing

R1# show ip interface brief

Check that the relevant interfaces have the intended IP addresses and show an operational status of up/up. Also verify that R1 can route toward S1 and that the upstream network can route the public address to R1. NAT table verification and end-to-end connectivity verification are separate tasks.

Practical Example: Host A Accesses an External Web Server

Host A at 10.0.0.100 uses R1 as its default gateway and contacts external server S1. R1 has a static mapping to 155.4.12.1.

1. Host A creates a packet with source 10.0.0.100 and destination S1.
2. R1 receives the packet on its NAT inside interface.
3. R1 changes the source to 155.4.12.1.
4. S1 sends the reply to 155.4.12.1.
5. R1 translates that destination back to 10.0.0.100 and forwards the packet to Host A.

The address selection is not temporary. R1 does not choose an unused address from a pool; it always uses the configured public address for this host.

Practical Example: Publishing an Internal Server

An organization can use a stable inside-global address when an internal web server must be predictably reachable from an external network. External clients connect to the public address, and R1 translates the destination to the server's inside-local address.

Static NAT alone does not guarantee access. The public address must be routed to R1, the server must be available and listening, and ACLs, firewalls, service-port restrictions, and server configuration must permit the connection.

Static NAT, Dynamic NAT, and PAT

Static NAT is selected for predictable reachability, not efficient public IPv4 address sharing. Dynamic NAT and PAT are generally better suited to large groups of clients that do not need dedicated public identities.

Troubleshoot Static NAT

Inside Traffic Does Not Translate

• Confirm that the LAN-facing interface has ip nat inside.
• Confirm that the WAN-facing interface has ip nat outside.
• Check that inside and outside roles were not assigned to the wrong interfaces.
• Verify Host A's default gateway.
• Verify that R1 has a route toward the outside destination.

R1# show running-config | include ip nat
R1# show ip interface brief

External Clients Cannot Reach the Internal Server

• Check that the upstream network routes 155.4.12.1 to R1.
• Confirm the static mapping in show ip nat translations.
• Check ACLs, firewall policies, and service-port restrictions.
• Verify that the internal server is powered on, correctly addressed, using the correct gateway, and listening for the requested service.
• Confirm that the mapping references the correct inside-local address.

The Expected Mapping Is Missing

• Inspect the running configuration to ensure the static command was entered.
• Check that the addresses were not reversed or mistyped.
• Confirm the command was entered in global configuration mode.
• Generate test traffic and inspect the table again. Outside fields may not be populated until relevant traffic exists.
• Verify that 10.0.0.100 appears as inside local and 155.4.12.1 appears as inside global.

NAT Looks Correct but Communication Still Fails

Separate NAT troubleshooting from end-to-end troubleshooting. Check both directions of routing, interface operational state, subnet masks, host addressing, default gateways, and security policies. A correct static NAT entry cannot fix a missing route, a down link, or a blocked packet.

Key Takeaways

• Static NAT creates a fixed one-to-one mapping between an inside-local private address and an inside-global public address.
• The NAT inside interface faces the private LAN; the NAT outside interface faces the public or external network.
• Outbound traffic has its source translated, and return traffic has its destination translated.
• A static entry can appear in the translation table before traffic occurs.
• NAT requires correct routing, interface status, host gateways, and security policy.
• Static NAT provides predictable reachability but consumes one public address per mapped host.