VMware ESXi and vSphere Cluster Management

Dynamic NAT Configuration and Operation on Cisco Routers

Learn how Dynamic NAT maps private IPv4 hosts to a public address pool on Cisco IOS. Configure, verify, and troubleshoot Dynamic NAT step by step.

Dynamic Network Address Translation (Dynamic NAT) temporarily maps eligible private inside IPv4 addresses to available addresses from a shared public address pool. The router creates a translation when qualifying traffic begins, maintains it while the traffic is active, and removes it after the translation ages out.

This conserves routable IPv4 addresses while allowing internal hosts to communicate with external networks. Unlike PAT, Dynamic NAT assigns a separate public IPv4 address to each active translated host.

How Dynamic NAT Works

1. An inside host sends traffic toward an outside destination.
2. The router identifies the ingress interface as NAT inside and checks whether the source address matches the NAT selection ACL.
3. If the source qualifies, the router selects an unused inside-global address from the configured NAT pool.
4. The router rewrites the packet's source address and forwards it through the NAT outside interface.
5. For return traffic, the router consults its NAT translation table and changes the destination from the inside-global address back to the original inside-local address.
6. When traffic stops, the translation remains for a timeout period. After it ages out, the pool address becomes available for another host.

Without overload, each active translated host requires one usable address from the pool. A three-address pool can therefore support at most three simultaneous host translations. A fourth host must wait until an address is released, unless the design uses a larger pool or PAT.

Dynamic NAT Address Terminology

Outside local and outside global can differ when outside NAT is configured. In the basic inside-source Dynamic NAT example, they normally contain the same address.

Inside and Outside NAT Interfaces

NAT interface roles define the direction in which the router interprets addresses:

• NAT inside: normally the LAN-facing interface connected to private hosts.
• NAT outside: normally the WAN- or Internet-facing interface connected to the external network.

These labels are logical roles, not descriptions of security zones. Assign them according to the actual topology. Reversing them or applying them to the wrong interfaces can prevent translations from being created.

Example Topology

Host A uses private address 192.168.1.10. R1 connects the inside LAN through GigabitEthernet0/0 and the outside network through GigabitEthernet0/1. R1's public pool contains 155.4.12.1 through 155.4.12.3. External server S1 is reachable through the outside network.

When Host A connects to S1, R1 might allocate 155.4.12.1. The outbound packet changes from source 192.168.1.10 to source 155.4.12.1. A reply addressed to 155.4.12.1 is translated back to destination 192.168.1.10.

Selecting Inside Sources with an ACL

A standard ACL identifies the inside source addresses eligible for translation. In this use case, the ACL is a NAT match criterion; it is not automatically a complete packet-filtering policy.

For the subnet 192.168.1.0/24, the wildcard mask is 0.0.0.255. A zero means the corresponding address bit must match, while a one means that bit may vary. Therefore, the following entry matches every address from 192.168.1.0 through 192.168.1.255:

access-list 1 permit 192.168.1.0 0.0.0.255

Use a narrower ACL when only selected hosts or subnets should be translated. An overly broad wildcard mask can allocate public addresses to unintended sources.

Creating the NAT Pool

A NAT pool is a named, contiguous range of public IPv4 addresses. Configure the first and last addresses and the subnet mask:

ip nat pool MY_POOL 155.4.12.1 155.4.12.3 netmask 255.255.255.0

The number of addresses in an inclusive range is:

last address - first address + 1

For 155.4.12.1 through 155.4.12.3, the pool contains three addresses. Confirm that every address is valid for the subnet, available for NAT, and routed toward R1 by the upstream provider or external network. The upstream network must know how to return traffic for the pool; merely configuring the addresses on R1 is not enough.

Dynamic NAT Configuration Workflow

1. Configure host and router addressing.
2. Configure basic routing, including a route toward the outside destination and any required upstream route back to the public pool.
3. Mark the LAN interface as NAT inside.
4. Mark the WAN interface as NAT outside.
5. Create a standard ACL matching the intended inside source range.
6. Create the named public NAT pool.
7. Associate the ACL with the pool using an inside-source Dynamic NAT rule.
8. Generate traffic from an eligible inside host.
9. Inspect the translation table, pool use, counters, and configuration.

1. Configure the NAT Interfaces

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 no shutdown

interface GigabitEthernet0/1
 ip address 155.4.12.254 255.255.255.0
 ip nat outside
 no shutdown

2. Match the Inside Network

access-list 1 permit 192.168.1.0 0.0.0.255

3. Define the Public Pool

ip nat pool MY_POOL 155.4.12.1 155.4.12.3 netmask 255.255.255.0

4. Bind the ACL to the Pool

ip nat inside source list 1 pool MY_POOL

The ACL selects the inside-local sources, the pool supplies inside-global addresses, the NAT rule connects those two objects, and the interface roles tell IOS where translation begins and where it ends.

Practical Pool Allocation Example

Generating Traffic and Verifying Operation

Dynamic translations are normally created only after qualifying traffic is generated. From an eligible inside host, send a ping, open a web page, or create another connection to a reachable external destination.

Use these commands on R1:

show ip nat translations
show ip nat statistics
show running-config | include ip nat
show access-lists 1

Interpreting the Translation Table

A typical entry pairs an inside-local address with an inside-global address. In the example, the important relationship is 192.168.1.10 to 155.4.12.1. The outside-local and outside-global columns identify the destination from the relevant perspectives.

R1# show ip nat translations
Pro  Inside global       Inside local        Outside local       Outside global
---  155.4.12.1          192.168.1.10        203.0.113.20        203.0.113.20

Use show ip nat statistics to review configured pools, active translation counts, and NAT activity counters. Use show running-config | include ip nat to confirm the pool, rule, and interface-related NAT statements. Use show access-lists 1 to confirm that the ACL is matching traffic.

Dynamic NAT Compared with Other NAT Types

PAT is more common in many networks because it allows many internal hosts to share one public IPv4 address. Dynamic NAT is useful when each active host needs its own public address and a suitable pool is available.

Troubleshooting Dynamic NAT

No NAT Entries Appear

• Generate real traffic from an eligible inside host; an unused configuration does not create a translation.
• Check that the source address matches the ACL with show access-lists 1.
• Confirm the LAN interface has ip nat inside and the WAN interface has ip nat outside.
• Verify the host's default gateway and R1's route toward the outside destination.
• Inspect the NAT statements with show running-config | include ip nat.

Traffic Reaches R1 but External Access Fails

• Verify that the upstream network routes the public pool subnet back toward R1.
• Check the outside interface, next hop, and routing table.
• Test reachability from R1 to the next hop and the external destination.
• Investigate filtering or routing problems beyond NAT.

Some Hosts Work but Additional Hosts Fail

The pool may be exhausted. Compare the number of active translations with the number of pool addresses using show ip nat translations and show ip nat statistics. Wait for inactive entries to age out, enlarge the pool, or use PAT when the design permits.

The Wrong Internal Addresses Are Translated

Review the ACL and its match counters. An overly broad ACL or incorrect wildcard mask may include unintended networks. Restrict the ACL to the required inside subnet or hosts.

Return Traffic Does Not Reach the Host

• Confirm that the external network routes the pool addresses through R1.
• Inspect the translation while traffic is active; it may have expired before the response arrived.
• Check for asymmetric routing that causes return traffic to bypass the NAT router.

Clearing Lab Translations

For controlled testing, you can remove current translations:

clear ip nat translation *

Exam- and Operations-Relevant Notes

• Dynamic NAT uses a pool; static NAT uses a manually configured persistent mapping.
• Dynamic NAT does not use port numbers to let many hosts share one address. That behavior belongs to PAT or NAT overload.
• The NAT ACL identifies sources for translation in this configuration. It should not be assumed to provide complete security filtering.
• Inside-local means the internal address before translation; inside-global means the public representation after translation.
• The pool must be reachable from the outside network, and the NAT router must have working routes in both directions.
• Pool capacity limits simultaneous translated hosts when overload is not configured.

For related study, review Dynamic NAT configuration and operation alongside static NAT and PAT concepts.