VMware ESXi and vSphere Cluster Management
Static NAT Configuration on Cisco Routers
Learn static NAT on Cisco IOS: understand address terminology, configure one-to-one mappings, verify translations, and troubleshoot routing, interfaces, and ACLs.
What Static NAT Does
Network Address Translation (NAT) modifies IP addressing as packets move between network domains. Static NAT creates a permanent, manually configured one-to-one association between an internal private IPv4 address and an externally routable IPv4 address.
For example, a router can always represent internal host 10.0.0.100 by public address 155.4.12.1. The mapping exists even when the host is not currently generating traffic.
Static NAT is useful when an internal system must have a consistent public identity. Common examples include publishing an internal web server, mail server, VPN endpoint, or another service that external clients must reach.
Static NAT Compared with Other NAT Types
| Feature | Static NAT | Dynamic NAT | PAT/NAT Overload |
|---|---|---|---|
| Address relationship | Fixed one-to-one mapping | Temporary allocation from a pool | Many internal addresses share one or more public addresses using port numbers |
| Public address consumption | One public address per mapped host | One public address is needed for each simultaneously translated host | Many hosts can share a public address |
| Typical use case | Publishing a server or preserving a fixed public identity | Providing limited outbound access to a group of hosts | General Internet access for many users |
| Persistence of mapping | Always configured and available | Usually created when traffic requires it and removed according to timers | Created as sessions begin and maintained while sessions are active |
The main tradeoff is public-address consumption. A dedicated public address is required for every internally mapped host, so static NAT is normally selected for a limited number of systems rather than every workstation.
NAT Address Terminology
NAT terminology describes an address from the perspective of the inside or outside network. In a typical static NAT configuration, the important relationship is between the inside local and inside global addresses.
| Term | Network Perspective | Example Address | Purpose |
|---|---|---|---|
| Inside local | Inside/private network | 10.0.0.100 | The private address assigned to the internal host. |
| Inside global | Outside/public network | 155.4.12.1 | The public address that represents the inside host externally. |
| Outside global | Outside network | External server address | The real address of the external destination as known on the outside network. |
| Outside local | Inside perspective of the outside host | Usually the external server address | The address used to represent the outside host to the inside network. It commonly matches outside global when no outside translation exists. |
For a basic static mapping:
inside local 10.0.0.100 <-- static association --> inside global 155.4.12.1Network Roles and Traffic Flow
The NAT device is usually a router or firewall positioned between a private inside network and a public outside or upstream network.
- The inside interface faces the private LAN.
- The outside interface faces the provider, upstream router, or Internet.
- The internal host should use the NAT router as its default gateway.
- Routing must exist in both directions. NAT alone does not create routes.
| Traffic Direction | Packet Source Before NAT | Packet Source After NAT | Packet Destination | Translation Action |
|---|---|---|---|---|
| Inside host to external server | 10.0.0.100 | 155.4.12.1 | External server address | R1 changes the source from the inside local address to the inside global address. |
| External server reply to inside host | External server address | Unchanged | Initially 155.4.12.1 | R1 changes the destination from the inside global address back to 10.0.0.100 and forwards the packet inside. |
Example: Host A Reaches an External Server
Host A has private address 10.0.0.100 and sends traffic to its default gateway, R1. When R1 forwards the packet through its outside interface, it changes the source address to 155.4.12.1. The external server replies to 155.4.12.1. R1 identifies the static mapping, changes the reply destination to 10.0.0.100, and forwards it through the inside interface.
Cisco IOS Static NAT Configuration Workflow
Cisco IOS is Cisco's network operating system and command-line environment. The configuration requires three related tasks: create the mapping, identify the inside interface, and identify the outside interface.
| Step | IOS Command or Action | Purpose | Example |
|---|---|---|---|
| 1. Create the one-to-one translation | Global configuration command | Associates the inside local address with the inside global address. | ip nat inside source static 10.0.0.100 155.4.12.1 |
| 2. Identify the inside interface | Enter interface mode and use ip nat inside | Marks the LAN-facing interface. | interface GigabitEthernet0/0 ip nat inside |
| 3. Identify the outside interface | Enter interface mode and use ip nat outside | Marks the WAN- or Internet-facing interface. | interface GigabitEthernet0/1 ip nat outside |
| 4. Verify translations | show ip nat translations | Confirms the configured relationship and operational entries. | show ip nat translations |
The address mapping by itself is insufficient. If the interfaces do not have the correct NAT roles, IOS cannot determine where packets enter and leave the NAT boundary.
Complete Example
R1# configure terminal
R1(config)# ip nat inside source static 10.0.0.100 155.4.12.1
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip address 10.0.0.1 255.255.255.0
R1(config-if)# ip nat inside
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip address 155.4.12.1 255.255.255.0
R1(config-if)# ip nat outside
R1(config-if)# no shutdown
R1(config-if)# endVerification and Interpretation
Display the Translation Table
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- 155.4.12.1 10.0.0.100 --- ---The translation table is Cisco IOS operational output listing configured and active NAT relationships. In this example, 10.0.0.100 is the inside local address and 155.4.12.1 is the inside global address.
- Inside local: the internal host's private address.
- Inside global: the public address representing that host.
- Outside local: the external host's address as represented inside.
- Outside global: the external host's actual outside address.
For static NAT, outside address fields may be empty in the output until traffic has been initiated. Their appearance and formatting can also vary by Cisco IOS platform and command output. Do not treat empty outside fields as proof that the static mapping is missing.
Useful Verification Commands
R1# show ip nat translations
R1# show running-config | include ip nat
R1# show ip interface brief
R1# show ip routeUse show running-config | include ip nat to check the static mapping and the inside/outside role commands. Use show ip interface brief to confirm that both intended interfaces have the expected addresses and are up/up. Use show ip route to verify routes to the external network and the internal LAN.
Generate test traffic from the inside host, such as a ping or connection to an appropriate external service. When publishing a server, also test the intended service from an external host. A translation entry alone does not prove that routing, ACLs, server software, and return traffic are working.
Publishing an Internal Web Server
An internal web server with a fixed private address can receive a dedicated public identity through static NAT. The design must include:
- A static one-to-one mapping for the server.
- Outside routing that sends the public address to the NAT router.
- A correct default gateway on the server pointing toward the NAT router.
- An access-control policy permitting only intended services, such as TCP port 80 or TCP port 443.
- A web service that is running and listening on the expected interface and port.
Verify external reachability separately from the NAT table. The table confirms address translation, while an external connection test confirms the complete path and service policy.
Design and Security Considerations
- Use static NAT selectively: dedicating one public address per host is usually appropriate for servers or special-purpose systems, not ordinary user workstations.
- NAT is not a firewall: a static mapping can make an internal system reachable from outside when routing and filtering permit it. Pair NAT with ACLs, firewall policies, or zone-based controls.
- Check the default gateway: the internal device must send remote traffic to the NAT router. A wrong gateway can prevent both outbound communication and correct return traffic.
- Avoid overlap: the inside global address must not conflict with an interface address, another host, another translation, or a dynamic NAT pool allocation.
- Check return routing: external routers must know how to reach the public address, and the NAT router must know how to reach the internal address.
Troubleshooting Static NAT
The Static Entry Is Missing
Possible causes include an incorrectly entered command, a configuration applied to the wrong device, a removed configuration, or a platform-specific display difference.
- Review the exact mapping with
show running-config | include ip nat. - Confirm the inside local and inside global addresses.
- Re-enter the mapping if necessary.
- Use the NAT display command appropriate for the Cisco IOS version.
The Internal Host Cannot Reach an Outside Destination
- Confirm that the LAN-facing interface has
ip nat inside. - Confirm that the WAN-facing interface has
ip nat outside. - Check the host's IP address, subnet mask, and default gateway.
- Check for a route or default route to the external network.
- Inspect ACLs, firewall policies, and provider filtering.
- Test hop by hop to identify whether the failure is on the host, router, upstream path, or destination.
External Clients Cannot Reach the Internal Server
- Confirm that upstream routing sends traffic for the inside global address to the NAT router.
- Check that the outside interface is correctly addressed and operational.
- Verify that the server is powered on, listens on the intended service port, and uses the correct default gateway.
- Review inbound ACLs, firewall policies, and provider filters.
- Test the service locally before testing it from outside.
An Unexpected Public Address Appears
An inside global address may overlap an interface address, another static mapping, or a dynamic NAT pool allocation. A competing NAT rule may also change the intended behavior.
- Inventory all NAT statements and public-address assignments.
- Remove or correct conflicting entries.
- Retest after the configuration change.
- Inspect the translation table to confirm the resulting mapping.
Exam- and Practice-Relevant Notes
- Static NAT is a fixed one-to-one mapping; PAT allows many hosts to share an address by using transport-layer ports.
- The private host address is the inside local address, while its public representation is the inside global address.
- Both NAT interface roles are required:
ip nat insideon the LAN side andip nat outsideon the WAN side. - NAT does not replace routing. The host needs a valid default gateway, and the router needs paths to both networks.
- A static public mapping does not automatically permit every service. Filtering and firewall policy should limit exposure.
For a related configuration reference, see Static NAT Configuration.