NAT (Network Address Translation) is a process that modifies IP address information in packet headers while in transit across a routing device. NAT was primarily developed to address IPv4 address exhaustion by allowing multiple devices on a private network to share a single or small pool of public IP addresses for Internet access.
NAT operates on a router or firewall, translating private (RFC 1918) IP addresses used internally to public IP addresses used on the Internet. This translation happens transparently to end devices.
These private addresses cannot be routed on the Internet and must be translated to public IPs.
Example Scenario:
There are four main types of NAT, each serving different use cases:
One-to-one mapping between a private IP and a public IP. The mapping is permanent and always uses the same public IP for a specific private IP.
Use Case: Servers that need to be accessible from Internet (web servers, mail servers)
Example: 192.168.1.10 always translates to 203.0.113.10
Maps private IP addresses to a pool of public IP addresses on a first-come, first-served basis. The mapping is temporary and changes.
Use Case: When you have fewer public IPs than internal devices, but not all devices access Internet simultaneously
Example: 192.168.1.10 might translate to 203.0.113.10 now, but 203.0.113.11 later
Maps multiple private IP addresses to a single public IP address using different port numbers. This is the most common type of NAT.
Use Case: Home networks, small businesses with one public IP
Example: Multiple devices (192.168.1.10, 192.168.1.11, 192.168.1.12) all share 203.0.113.5 but use different source ports
Translation based on specific criteria such as source IP, destination IP, source port, or destination port. Allows granular control.
Use Case: Complex networks requiring different translation rules for different traffic types
Static NAT provides a permanent one-to-one mapping between a private IP address and a public IP address.
configure terminal ! Define inside and outside interfaces interface GigabitEthernet 0/0 description *** Inside Interface *** ip address 192.168.1.1 255.255.255.0 ip nat inside no shutdown exit interface GigabitEthernet 0/1 description *** Outside Interface (ISP) *** ip address 203.0.113.1 255.255.255.252 ip nat outside no shutdown exit ! Create static NAT mapping ip nat inside source static 192.168.1.10 203.0.113.10 end write memory
When external users access 203.0.113.10, router translates it to 192.168.1.10. When the web server (192.168.1.10) sends traffic out, source IP is translated to 203.0.113.10.
! Map multiple servers ip nat inside source static 192.168.1.10 203.0.113.10 ip nat inside source static 192.168.1.11 203.0.113.11 ip nat inside source static 192.168.1.12 203.0.113.12
Dynamic NAT uses a pool of public IP addresses and assigns them dynamically to inside devices as needed.
configure terminal ! Define inside and outside interfaces interface GigabitEthernet 0/0 description *** Inside Interface *** ip address 192.168.1.1 255.255.255.0 ip nat inside no shutdown exit interface GigabitEthernet 0/1 description *** Outside Interface (ISP) *** ip address 203.0.113.1 255.255.255.252 ip nat outside no shutdown exit ! Create access list to define which internal IPs can use NAT access-list 1 permit 192.168.1.0 0.0.0.255 ! Define NAT pool ip nat pool PUBLIC_POOL 203.0.113.10 203.0.113.20 netmask 255.255.255.0 ! Link access list to NAT pool ip nat inside source list 1 pool PUBLIC_POOL end write memory
When a device from 192.168.1.0/24 tries to access the Internet, router assigns an available IP from the pool (203.0.113.10-20). If all 11 IPs are in use, the 12th device cannot access Internet until one IP becomes available.
PAT allows thousands of internal devices to share a single public IP address by using unique port numbers.
configure terminal ! Define interfaces interface GigabitEthernet 0/0 description *** Inside Interface *** ip address 192.168.1.1 255.255.255.0 ip nat inside no shutdown exit interface GigabitEthernet 0/1 description *** Outside Interface (ISP) *** ip address 203.0.113.5 255.255.255.252 ip nat outside no shutdown exit ! Define which internal IPs can use NAT access-list 1 permit 192.168.1.0 0.0.0.255 ! Configure PAT using the outside interface IP ip nat inside source list 1 interface GigabitEthernet 0/1 overload end write memory
configure terminal ! Define access list access-list 1 permit 192.168.1.0 0.0.0.255 ! Create NAT pool (can be just one IP) ip nat pool PAT_POOL 203.0.113.10 203.0.113.10 netmask 255.255.255.0 ! Configure PAT with overload ip nat inside source list 1 pool PAT_POOL overload end write memory
Multiple internal devices share the same public IP but use different source ports:
Router maintains a NAT translation table tracking which internal IP:port combination maps to which external port.
Forwards external requests on specific ports to internal servers. Essential for hosting services behind NAT.
configure terminal ! Define interfaces interface GigabitEthernet 0/0 ip address 192.168.1.1 255.255.255.0 ip nat inside exit interface GigabitEthernet 0/1 ip address 203.0.113.5 255.255.255.252 ip nat outside exit ! Forward HTTP (port 80) to web server ip nat inside source static tcp 192.168.1.10 80 203.0.113.5 80 ! Forward SSH (port 22) to SSH server ip nat inside source static tcp 192.168.1.11 22 203.0.113.5 22 ! Forward HTTPS (port 443) to web server ip nat inside source static tcp 192.168.1.10 443 203.0.113.5 443 end write memory
! Forward external port 8080 to internal port 80 ip nat inside source static tcp 192.168.1.10 80 203.0.113.5 8080
Users would access http://203.0.113.5:8080 which routes to 192.168.1.10:80
configure terminal ! Inside Interface interface GigabitEthernet 0/0 description *** LAN Interface *** ip address 192.168.1.1 255.255.255.0 ip nat inside no shutdown exit ! Outside Interface interface GigabitEthernet 0/1 description *** WAN Interface (ISP) *** ip address 203.0.113.5 255.255.255.252 ip nat outside no shutdown exit ! Static NAT for Web Server ip nat inside source static 192.168.1.10 203.0.113.10 ! Port Forwarding for Web Server ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 ip nat inside source static tcp 192.168.1.10 443 203.0.113.10 443 ! Access List for internal users access-list 100 permit ip 192.168.1.100 0.0.0.99 any ! PAT for internal users using primary public IP ip nat inside source list 100 interface GigabitEthernet 0/1 overload ! Route to Internet ip route 0.0.0.0 0.0.0.0 203.0.113.6 end write memory
show ip nat translations
Displays all current NAT translation entries
show ip nat statistics
Shows NAT statistics including total translations, hits, misses
show ip nat translations verbose
Detailed translation table with timestamps
clear ip nat translation *
Clears all dynamic NAT translations (static entries remain)
clear ip nat translation inside 192.168.1.10
Clears translations for specific inside address
debug ip nat debug ip nat detailed
Warning: Use carefully in production. Stop with:
no debug ip nat undebug all
! Translate only HTTP/HTTPS traffic access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80 access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 443 ip nat inside source list 101 interface GigabitEthernet 0/1 overload
! Change timeout values ip nat translation timeout 300 ip nat translation tcp-timeout 86400 ip nat translation udp-timeout 300 ip nat translation finrst-timeout 60
! Different NAT for different destinations access-list 1 permit 192.168.1.0 0.0.0.255 route-map NAT_ISP1 permit 10 match ip address 1 match interface GigabitEthernet 0/1 ip nat inside source route-map NAT_ISP1 interface GigabitEthernet 0/1 overload
! Don't NAT traffic to specific destinations access-list 100 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 access-list 100 permit ip 192.168.1.0 0.0.0.255 any ip nat inside source list 100 interface GigabitEthernet 0/1 overload
Check:
show ip nat statistics show ip nat translations show ip interface brief
Verify:
Causes:
Solution:
! Check available translations show ip nat statistics ! Expand access list or use PAT access-list 1 permit 192.168.1.0 0.0.0.255
Check:
show ip nat translations | include 192.168.1.10 show access-lists
Verify:
Solution:
! Clear all dynamic translations clear ip nat translation * ! Reduce timeout values ip nat translation timeout 300
| NAT Type | Mapping | Public IPs Required | Best Use Case |
|---|---|---|---|
| Static NAT | One-to-one (permanent) | Equal to inside hosts | Servers accessible from Internet |
| Dynamic NAT | One-to-one (temporary) | Pool of IPs (fewer than hosts) | Limited public IPs, not all devices simultaneous |
| PAT (Overload) | Many-to-one (with ports) | One IP (or small pool) | Most common, home/small business |
| Port Forwarding | Port-specific | One IP | Hosting services behind NAT |
! Interface Configuration interface GigabitEthernet 0/0 ip nat inside interface GigabitEthernet 0/1 ip nat outside ! Static NAT ip nat inside source static 192.168.1.10 203.0.113.10 ! Dynamic NAT access-list 1 permit 192.168.1.0 0.0.0.255 ip nat pool POOL_NAME 203.0.113.10 203.0.113.20 netmask 255.255.255.0 ip nat inside source list 1 pool POOL_NAME ! PAT (Overload) access-list 1 permit 192.168.1.0 0.0.0.255 ip nat inside source list 1 interface GigabitEthernet 0/1 overload ! Port Forwarding ip nat inside source static tcp 192.168.1.10 80 203.0.113.5 80 ! Verification show ip nat translations show ip nat statistics clear ip nat translation * ! Debug debug ip nat undebug all
NAT is a fundamental technology that enables efficient use of public IP addresses while providing security benefits by hiding internal network structure. Understanding the different types of NAT—Static NAT, Dynamic NAT, PAT, and Port Forwarding—allows you to choose the right solution for your specific requirements.
PAT (NAT Overload) is the most commonly used NAT type in modern networks, allowing thousands of internal devices to share a single public IP address. Static NAT and Port Forwarding are essential for hosting services that need to be accessible from the Internet. Dynamic NAT provides a middle ground when you have a limited pool of public IPs.
Proper NAT configuration, combined with thorough testing and monitoring, ensures that your network maintains both Internet connectivity and security. Always document your NAT mappings, especially port forwards, and regularly review NAT translations to identify and resolve potential issues.
