4.1 Static NAT, Dynamic NAT Pools, and PAT

Lesson Overview

Enterprise networks commonly use private IPv4 addressing internally while Internet-facing traffic requires globally routable addressing. NAT changes IPv4 address information at a boundary router so inside devices can communicate with outside networks while preserving the internal addressing plan.

This lesson compares one-to-one Static NAT, temporary one-to-one Dynamic NAT using a public address pool, and PAT (NAT overload), where many inside hosts share one or a small number of public addresses by using unique Layer 4 port mappings. It also covers NAT terminology, inside/outside interface roles, translation-table behavior, verification, and common failure conditions.

Learning Objectives

• Explain why IPv4 NAT is used and distinguish address translation from normal routing and packet forwarding.
• Identify and interpret inside local, inside global, outside local, and outside global IPv4 addresses.
• Compare Static NAT, Dynamic NAT pools, and PAT/NAT overload, including the mapping behavior and common use case for each.
• Configure Cisco IOS interfaces with ip nat inside and ip nat outside in the correct traffic direction.
• Configure and verify a one-to-one inside-source Static NAT mapping.
• Configure Dynamic NAT by defining the inside source addresses, creating a global address pool, and binding the ACL to the pool.
• Configure PAT using either an outside-interface address or a NAT pool with the overload keyword.
• Explain how PAT distinguishes simultaneous sessions by using transport-layer port numbers and maintains entries in the NAT translation table.
• Verify operation with show ip nat translations, show ip nat statistics, ping, traceroute, and appropriate clear/debug commands when required.
• Troubleshoot common NAT/PAT problems including incorrect inside/outside placement, ACL mismatches, pool exhaustion, missing overload, routing/return-path issues, and stale translations.

1. What is NAT?

Network Address Translation (NAT) lets a router or firewall rewrite the source and/or destination IP address (and often the port) of packets as they cross a boundary — typically between a private internal network and the public internet. NAT was originally developed to conserve public IPv4 addresses, but it also provides a degree of address-hiding and topology obscurity.

Three main flavors are covered here:

2. NAT Fundamentals and Why NAT Is Used

Network Address Translation (NAT) changes IPv4 address information as traffic crosses a NAT-capable device, most commonly an enterprise edge router or firewall. Inside-source NAT translates the source address of packets originating from an inside network before those packets are forwarded toward an outside network.

• Conserves public IPv4 addresses by allowing private RFC 1918 networks to communicate with public networks.
• Separates internal addressing from public-facing addressing, allowing enterprises to use private address plans internally.
• Provides predictable public mappings for selected inside services through static NAT.
• Allows temporary one-to-one public address allocation with dynamic NAT pools.
• Allows many simultaneous inside sessions to share one or a few public addresses through PAT (NAT overload).

Important: NAT is not a security policy by itself. A firewall/ACL still determines which traffic is permitted. NAT changes addresses and, with PAT, Layer 4 identifiers.

Figure 2. NAT terminology and the inside/outside address perspectives.

3. NAT Address Terminology

Inside and outside are interface roles

Cisco IOS NAT uses `ip nat inside` and `ip nat outside` on interfaces to identify which side of the translation boundary traffic is entering or leaving. These commands do…