Configure PAT (NAT Overload) on a Cisco Router

Learn how PAT works, configure NAT overload on Cisco IOS, verify translations, and troubleshoot common connectivity problems.

What PAT Does

Port Address Translation (PAT) allows many private IPv4 hosts to share one public IPv4 address. PAT changes the source address and usually the source TCP or UDP port of outbound traffic. Cisco IOS commonly calls PAT NAT overload.

PAT is widely used at home, branch, and enterprise network edges because public IPv4 addresses are limited. Internal hosts can use private addresses such as 10.0.0.100 and 10.0.0.101, while external networks see a shared public address.

Method	Address relationship	Port translation	Typical use case
Static NAT	One private address maps permanently to one public address	Not normally required	Publishing a server with a stable public address
Dynamic NAT	Private addresses are temporarily mapped to addresses from a public pool	Not normally required	Translating hosts when several public addresses are available
PAT/NAT overload	Many private addresses share one public address, or a small set of addresses	Yes; ports distinguish sessions	General outbound Internet access

How PAT Translations Work

When an inside host starts a connection, the router records a translation in its NAT translation table. The table associates the original private address and source port with the public address and a unique translated port.

For example, host 10.0.0.100 might send a TCP packet with source 10.0.0.100:49152. R1 can rewrite it as 155.4.12.1:1056. A second host can use the same public address with another translated port, such as 155.4.12.1:1057. The protocol and port information distinguish the two sessions.

An inside host sends traffic to an external destination using R1 as its default gateway.
R1 checks whether the traffic comes from an eligible inside address and crosses from an inside interface to an outside interface.
R1 creates or finds a PAT entry, rewrites the source address and source port, and forwards the packet.
The external server replies to the shared public address and translated port.
R1 looks up the reply in the translation table, reverses the translation, and forwards the packet to the correct inside host.

Stage	Source address and port	Destination	Router action
Original packet from 10.0.0.101	`10.0.0.101:49153`	External server, for example `203.0.113.20:443`	R1 receives the packet on its inside interface
Packet after PAT on R1	`155.4.12.1:1057`	`203.0.113.20:443`	R1 replaces the source address and port
Reply received on public interface	`203.0.113.20:443`	`155.4.12.1:1057`	R1 finds the matching translation entry
Packet forwarded to inside host	`203.0.113.20:443`	`10.0.0.101:49153`	R1 reverses the translation and sends the reply inside

NAT Address Terminology

NAT terminology describes an address from the perspective of the inside and outside networks.

NAT term	Meaning	Example value
Inside local	The private address used by an internal host inside the local network	`10.0.0.101`
Inside global	The public address that represents an inside host to external networks	`155.4.12.1`
Outside local	The address of an external host as it appears from the inside network	`203.0.113.20`
Outside global	The actual globally routable address of the external host	`203.0.113.20`

In a simple Internet-access scenario, outside local and outside global are often identical. PAT mainly changes the inside source address and source port. The outside destination normally remains unchanged.

PAT Topology and Prerequisites

Use this example topology:

Inside LAN: 10.0.0.0/24
Inside hosts: 10.0.0.100 and 10.0.0.101
R1 LAN interface: 10.0.0.1/24, marked ip nat inside
R1 WAN interface: 155.4.12.1/24, marked ip nat outside
Shared inside global address: 155.4.12.1
Upstream next hop: 155.4.12.254
External destination: an Internet server or other reachable external host

NAT does not replace routing. Before configuring PAT, verify Layer 3 connectivity, correct subnet masks, working router interfaces, and a route toward the external network. Inside clients must use 10.0.0.1 as their default gateway, and R1 needs a usable route, commonly a default route, toward the upstream router.

Cisco IOS PAT Configuration Workflow

1. Mark the inside and outside interfaces

The inside interface faces the private source network. The outside interface faces the public or external network. Interface names and WAN addressing must match the actual topology.

enable
configure terminal
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
 no shutdown
interface GigabitEthernet0/1
 ip address 155.4.12.1 255.255.255.0
 ip nat outside
 no shutdown

2. Create a standard ACL for eligible inside addresses

A standard ACL matches source IPv4 addresses. In this design, ACL 1 identifies the subnet whose traffic may be translated.

access-list 1 permit 10.0.0.0 0.0.0.255

The wildcard mask 0.0.0.255 matches all addresses in 10.0.0.0/24. A wildcard mask uses zero bits for positions that must match and one bits for positions that may vary.

Prefer a subnet-specific ACL over an unrestricted permit any. An overly broad NAT ACL can translate traffic from unintended internal networks.

3. Enable PAT with the WAN interface address

Associate the ACL with the outside interface address and add overload. The address currently configured on GigabitEthernet0/1 becomes the shared inside global address.

ip nat inside source list 1 interface GigabitEthernet0/1 overload

The complete rule means: translate inside source addresses permitted by ACL 1, use the address on the specified interface, and allow many flows to share that address through port translation.

4. Add an external route when required

ip route 0.0.0.0 0.0.0.0 155.4.12.254

Use the real upstream next-hop address for the network. PAT cannot provide reachability if R1 cannot route packets to the external network.

Complete Example Configuration

enable
configure terminal
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
 no shutdown
interface GigabitEthernet0/1
 ip address 155.4.12.1 255.255.255.0
 ip nat outside
 no shutdown
access-list 1 permit 10.0.0.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 155.4.12.254
end

Verify PAT Operation

Dynamic PAT entries generally appear only after matching inside-to-outside traffic crosses the router. From one or more inside hosts, generate traffic such as a ping or an application connection to an external destination.

Inspect translation entries

show ip nat translations

Look for separate entries containing the inside local addresses, a common inside global address, protocol information, and different translated port values. For example, both 10.0.0.100 and 10.0.0.101 may appear with inside global address 155.4.12.1, while their TCP or UDP ports differ.

Inspect NAT statistics

show ip nat statistics

Use this output to confirm the configured inside and outside interfaces, the ACL association, translation counts, and other evidence that NAT is active.

Review the configuration and supporting state

show running-config | section ip nat
show access-lists
show ip interface brief
show ip route

Command	Purpose	Expected evidence
`show ip nat translations`	Display active address and port mappings	Inside local entries, shared inside global address, protocols, and translated ports
`show ip nat statistics`	Display NAT configuration and activity	Inside/outside interfaces, ACL association, and translation counts
`show running-config \| section ip nat`	Review NAT commands	Correct interface roles and overload rule
`show access-lists`	Review ACL contents and hit counts	Correct source subnet and increasing matches after test traffic
`show ip interface brief`	Check interface status and addressing	Correct IP addresses and interfaces in an up/up state
`show ip route`	Check routing	A route toward the external network, often a default route

Interpreting PAT Output

Two hosts can retain different inside local addresses while sharing one inside global address:

Pro  Inside global         Inside local          Outside local          Outside global
 tcp 155.4.12.1:1056       10.0.0.100:49152      203.0.113.20:443       203.0.113.20:443
 tcp 155.4.12.1:1057       10.0.0.101:49153      203.0.113.20:443       203.0.113.20:443

The two entries are distinct because their translated source ports differ. When a reply arrives for 155.4.12.1:1057, R1 uses the protocol, address, and port information to return it to 10.0.0.101:49153. The other reply is mapped to 10.0.0.100:49152.

Troubleshoot Common Problems

No external access and no translations

Check for incorrect inside or outside interface roles, an ACL that does not match the client subnet, an incorrect host default gateway, or missing router routes.

show running-config | section ip nat
show access-lists
show ip interface brief
show ip route

Correct the interface designations, ACL, client gateway, or routing. Also verify that the client can reach its default gateway.

Only one host works or sharing is not occurring

The NAT rule may lack overload, or another NAT rule may conflict with the intended rule.

show running-config | include ip nat inside source
show ip nat translations

Ensure the intended rule includes overload and review existing NAT statements.

The translation table is empty

No entry may exist because no qualifying traffic has been generated. Other possibilities include an ACL mismatch or traffic that is not crossing from an interface marked inside to one marked outside.

show access-lists
show ip nat statistics

Generate a ping or application connection from an inside host, then inspect the table again. Check ACL hit counts and interface assignments.

Translations exist but communication still fails

Successful translation does not prove end-to-end connectivity. Check the default route and upstream return path, WAN addressing, ACL or firewall policies, upstream filtering, and the availability of the external destination.

show ip route
ping 155.4.12.254

Resolve routing, WAN, filtering, or destination problems separately from the NAT rule.

Exam-Relevant Notes

PAT is also called NAT overload in Cisco IOS.
ip nat inside belongs on the private LAN-facing interface.
ip nat outside belongs on the external-facing interface.
The standard ACL selects inside source addresses; it does not by itself perform NAT.
The overload keyword enables many-to-one port-based sharing.
A dynamic translation may not appear until matching traffic is sent.
PAT does not fix missing routes, incorrect default gateways, failed interfaces, or filtering policies.

For related study, see PAT configuration and verification.