VMware ESXi and vSphere Cluster Management

NAT Definition and Types: Static NAT, Dynamic NAT, and PAT

Learn how Network Address Translation rewrites IPv4 addresses and ports, why NAT is used, and how static NAT, dynamic NAT, and PAT work on Cisco IOS.

Network Address Translation (NAT) is a function that rewrites IPv4 addressing information as packets pass through a router, firewall, or other translation device. NAT can change source addresses, destination addresses, and, in many-to-one translations, TCP or UDP port numbers.

NAT is widely used at the boundary between a private internal network and the public Internet. It lets many internal hosts use private IPv4 addresses while sharing one public IPv4 address or a smaller public address pool.

What NAT Does

A NAT device examines packets crossing between network domains and changes selected fields in those packets. For outbound traffic, it commonly replaces a private source IPv4 address with a public source address. For return traffic, it replaces the translated destination address with the original internal address.

NAT may also rewrite transport-layer port numbers. A transport-layer port identifies an application conversation, such as a web connection or DNS query. Rewriting ports allows several internal hosts to use the same public IPv4 address at the same time.

• Source NAT: changes the source address, commonly when an internal client accesses an external service.
• Destination NAT: changes the destination address, commonly when an external client accesses a published internal service.
• Port translation: changes TCP or UDP port values so multiple flows can share an address.

Routers and firewalls are common NAT devices. NAT does not replace routing. The device still needs valid routes, correct interface roles, and appropriate security policies to forward packets successfully.

Why NAT Is Used

• IPv4 address conservation: Public IPv4 addresses are limited. NAT allows many devices to share one public address or a small group of addresses.
• Internet access for private hosts: Hosts using private IPv4 addresses can initiate connections to Internet services after their traffic is translated.
• Separation of addressing domains: Internal addressing does not need to match the provider's public addressing scheme.
• Reduced direct exposure of private addresses: Internet hosts normally see the translated public address rather than the internal private source address.

Private and Public IPv4 Addresses

A private IPv4 address is intended for internal use and is not globally routed on the public Internet. RFC 1918 defines these standard private ranges:

A public IPv4 address is globally routable and can represent a device or translation point on the Internet. An inside or private address identifies a host within the internal network. An outside or public address identifies a host or translation point from the perspective of external networks.

An Internet router cannot use a private source address as a normal globally reachable identity. If a packet leaves a private network with a source such as 192.168.10.10, an Internet server cannot normally send a reply through the public Internet to that private address. NAT replaces the private source with a public address before the packet is sent upstream. The NAT device records the association so it can reverse the translation when the reply arrives.

Basic Outbound NAT Packet Flow

Consider this example:

• Client A: 192.168.10.10
• NAT router R1 public address: 203.0.113.10
• Internet server S1: 198.51.100.20

Client A sends a request to S1. Assume the client uses source port 49152 and the service uses destination port 443.

1. Client A creates a packet with source 192.168.10.10:49152 and destination 198.51.100.20:443.
2. R1 receives the packet on its NAT-inside interface and identifies it as traffic moving toward the NAT-outside interface.
3. R1 replaces the private source address with a public address. With PAT, it also selects a translated source port, such as 53001.
4. S1 receives traffic from 203.0.113.10:53001 and sends its reply to that address and port.
5. R1 looks up the reply in its translation table. It changes the destination back to 192.168.10.10:49152 and forwards the packet to Client A.

The translation table is state maintained by the NAT device. It associates original addresses and ports with translated addresses and ports. Without this state, a shared public address could not identify which internal host should receive a reply.

NAT Address Terminology

Cisco and networking courses use four terms to describe addresses from different perspectives.

For ordinary outbound Internet access, source NAT changes the inside local source into an inside global source. Return traffic is translated in the reverse direction. Destination translation uses the same general idea in the opposite direction: a public destination can be changed to the private address of an internal server. This is often called publishing a service or port forwarding.

Static NAT

Static NAT creates a permanent one-to-one association between one inside local address and one public inside global address. For example:

192.168.10.50  <--permanent mapping-->  203.0.113.50

The public mapping remains consistent whenever the translation is active. This makes static NAT appropriate for an internal web server, mail server, VPN endpoint, or other service that must be represented by a predictable public IPv4 address.

A remote client can target 203.0.113.50, and the NAT device can translate the destination to 192.168.10.50, provided that routing, firewall rules, and the server's service configuration permit the connection.

Static NAT generally reserves one public IPv4 address for each mapped internal host. It provides predictable addressing but does not conserve public addresses as efficiently as PAT.

Dynamic NAT

Dynamic NAT creates temporary one-to-one translations from a configured NAT pool. A NAT pool is a range of public addresses available for dynamic assignments.

For example, internal addresses in 192.168.10.0/24 might be eligible to use 203.0.113.100 through 203.0.113.110. When an eligible host creates traffic, the NAT device assigns an available public address. The address is released when the translation expires or is removed.

• The mapping is temporary rather than permanently tied to the host.
• A later session may receive a different public address.
• The relationship is usually one internal address to one public address at a time.
• If every pool address is in use, new translations cannot be created. This condition is called pool exhaustion.

Dynamic NAT uses public addresses more flexibly than static NAT, but it still needs enough pool addresses for the simultaneous one-to-one translations. Unlike PAT, it does not normally depend on translating source ports to let many hosts share one address.

Port Address Translation (PAT)

Port Address Translation (PAT) is many-to-one translation. Multiple internal hosts share one public IPv4 address, or a small set of public addresses, while the NAT device uses distinct TCP or UDP source ports to distinguish simultaneous flows. Cisco commonly calls PAT NAT overload.

For example, two clients may use the same original source port:

192.168.10.10:49152  ->  203.0.113.10:53001
192.168.10.11:49152  ->  203.0.113.10:53002

The public IP address is the same, but the translated ports differ. R1 records both mappings and uses the destination port on returning packets to select the correct internal host.

PAT is the typical approach for outbound access from homes, schools, and businesses because many users can share one public address. PAT supports many more concurrent sessions than one-to-one translation with the same public-address allocation, although available port space, device capacity, protocol behavior, and policy still impose limits.

Static NAT, Dynamic NAT, and PAT Compared

Static and dynamic NAT are normally one-to-one. PAT is many-to-one or many-to-few. Static mappings are predictable and can support inbound reachability, dynamic mappings are temporary and pool-dependent, and PAT is optimized for large numbers of outbound sessions. None of these characteristics automatically replaces firewall policy.

Basic Cisco IOS NAT Configuration Concepts

On Cisco IOS, mark the interface connected to the private network as NAT inside. Mark the interface connected toward the provider or Internet as NAT outside.

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 203.0.113.10 255.255.255.248
 ip nat outside

The inside interface is the LAN-facing interface. The outside interface is the upstream-facing interface. These labels describe the NAT device's perspective; they do not by themselves create a translation.

Static NAT Configuration

This command permanently maps the internal server address to a public address:

ip nat inside source static 192.168.10.50 203.0.113.50

The command can support translation in both directions, but inbound access still requires a route to the public address, a listening service, and suitable firewall or access-control rules.

Dynamic NAT with a Public Pool

First, use a standard ACL to identify inside source addresses. Then define the public pool and connect the ACL to the pool:

access-list 1 permit 192.168.10.0 0.0.0.255
ip nat pool PUBLIC_POOL 203.0.113.100 203.0.113.110 netmask 255.255.255.0
ip nat inside source list 1 pool PUBLIC_POOL

The ACL selects eligible internal sources. The pool provides temporary public addresses for one-to-one translations. An ACL used for NAT selection should match the intended inside subnet accurately; it is not automatically a complete security policy.

PAT Using the Outside Interface Address

PAT can use the address already configured on the outside interface:

access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload

The overload keyword enables port-based sharing. The interface address becomes the public address used by the translated flows.

Verification and Clearing Commands

Generate test traffic before checking the table. Then use these commands:

show ip nat translations
show ip nat statistics
show running-config | include ip nat

show ip nat translations displays active mappings. show ip nat statistics helps reveal interface roles, configured rules, counters, and pool availability. The running-configuration command confirms that the expected NAT commands are present.

During testing, dynamically created entries can be cleared with:

clear ip nat translation *

NAT Troubleshooting

Internal Users Cannot Reach Internet Destinations

• Check that the LAN interface has ip nat inside and the upstream interface has ip nat outside.
• Confirm that the NAT ACL matches the actual client subnet.
• Verify that the device has a default route toward the upstream network.
• Confirm that the outside interface has valid provider connectivity and an appropriate public address.
• Generate traffic, then inspect show ip nat translations and show ip nat statistics.

Always verify routing separately from NAT. A correct translation cannot deliver a packet when the device lacks a route.

No Dynamic Translation Is Created

• Inspect whether the source ACL excludes the client address.
• Confirm that traffic enters an inside interface and exits an outside interface.
• Check whether the dynamic pool is exhausted.
• Verify that the client uses the NAT device as its default gateway.

PAT Return Traffic Fails

• Inspect the active translation while the session is running.
• Check whether translation state was cleared or timed out.
• Verify routes to and from the internal subnet.
• Review upstream filters and local firewall rules.
• Do not assume that a NAT problem is the cause when an access-control policy may be blocking the flow.

Inbound Connection to a Static Mapping Fails

• Confirm that the static mapping uses the correct inside and public addresses.
• Confirm that external clients or DNS target the mapped public address.
• Verify that the public address is routed to the NAT device.
• Check the server's default gateway and confirm that the service is listening on the expected port.
• Review inbound ACLs and firewall policies.

Exam-Relevant Summary

• NAT rewrites IPv4 addressing information; PAT also rewrites TCP or UDP port information.
• Private RFC 1918 addresses are for internal use and are not globally routed on the public Internet.
• Static NAT is a predictable, permanent one-to-one mapping.
• Dynamic NAT assigns temporary one-to-one mappings from a public pool and can fail when the pool is exhausted.
• PAT, also called NAT overload, lets many inside hosts share one public address by using unique translated ports.
• The NAT device keeps a translation table so return traffic reaches the correct internal host.
• Inside local is the internal host address; inside global is its public translated representation.
• NAT does not replace routing or firewall security controls.

For a concise reference to this subject, see NAT definition and types.