Lesson 2 — NAT and PAT Fundamentals

Week 6Lesson 2Required59 min estimated0% progress

NAT and PAT Fundamentals

Configure static NAT, dynamic NAT, and PAT overload; mark inside and outside interfaces by role; read show ip nat translations field by field; and isolate a NAT failure to interface role, ACL, or routing.

What you'll learn (5 objectives)~59 min: video → lesson → check → apply → lab prep

Learning objectives

Explain why NAT exists and define inside local, inside global, outside global, and outside local with one worked example
Mark the inside and outside interfaces and choose static NAT, dynamic NAT, or PAT overload for a given requirement
Configure PAT overload so many private hosts share one public address, and read the port numbers in the translation table
Interpret every field of show ip nat translations and show ip nat statistics
Diagnose a NAT that does not translate by checking interface role, the ACL, and Layer 3 routing in order

Terms you will see

NATPAT / overloadInside localInside globalOutside globalOutside localStatic NATDynamic NATip nat inside / ip nat outsideRFC 1918

Time breakdown

Read the notes26 min
Walk the PAT configuration and translation table14 min
Work the three-case decision practice9 min
Work the troubleshooting scenario10 min

Opens on YouTube

NAT Part 1 (Day 44)

By Jeremy's IT Lab · Opens externally on YouTube

Assigned watch: ~8 min

Where to stop

PAT overload and reading the translation table are developed in the written sections below, not in this video.

The source marks this segment timestampStatus="unresolved" with no start or end, so no bounds are shown here.

Watch on YouTube

The link opens in a new browser tab. Return here when you finish watching.

Watch for these concepts

That inside and outside are read from interface role, not diagram direction
A static one-to-one mapping being built

Go beyond the video

The assigned video introduces the idea. CCNA Practice Labs completes the learning path: clarify core concepts, explore how each device behaves, visualize the communication path, check your understanding, and prepare for hands-on lab work.

Watch the concept → understand it → visualize it → practice it → apply it.

Why NAT exists, and the four address terms

RFC 1918 reserved 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for internal reuse. Every organisation can use 10.10.10.0/24 precisely because those addresses never appear on the public internet — an ISP drops a packet sourced from them. NAT is the translation at the edge that rewrites the private source address, and for PAT the source port too, as packets cross from inside to outside, then rewrites the reply on the way back in.

The four address terms are pure exam vocabulary, so anchor them to one concrete flow: inside host 192.168.1.10 reaching web server 8.8.8.8 through a NAT router whose public address is 203.0.113.5.

The four NAT address terms in one flow

Term	Meaning	In this example
Inside local	The inside host's real, private address	192.168.1.10
Inside global	The public address the inside host appears as after translation	203.0.113.5 (plus a port such as :50001 for PAT)
Outside global	The real public address of the outside destination	8.8.8.8
Outside local	The outside host as seen from inside (usually identical)	8.8.8.8

The mnemonic that actually holds up

Inside and outside say *whose* device it is. Local and global say *from which side you are looking*: local is the address as seen from the inside network's point of view, global is the address as seen from the internet's. Once you split the two words apart like that, the four combinations stop needing memorisation. And inside global is so often the router's own WAN address because the standard branch design translates everyone to the single public IP you own.

Three types, and the interface roles that make any of them work

Choosing between the three NAT types

Type	Mapping	Use it when
Static NAT	Permanent one-to-one	An inside server must be reachable from the internet at a stable public address — only a permanent mapping is reliably reachable from outside
Dynamic NAT	Temporary one-to-one from a pool	You need real distinct public source addresses per host and have a pool to spend; pool size caps concurrent hosts
PAT (overload)	Many-to-one, kept apart by source port	Many inside hosts just need to reach the internet behind one address — the normal case

Work that table top to bottom and the first match wins. Must an outside host initiate to a specific inside host? Static. Do you genuinely need distinct public sources and own a pool? Dynamic. Otherwise — and this is the overwhelming default — PAT overload on the outside interface address.

Role, not direction

You tag the LAN-facing interface ip nat inside and the WAN-facing interface ip nat outside, and NAT only translates traffic moving between an inside interface and an outside one. The exam likes topologies drawn so the "outside" link points left, or up, or into the middle of the page. Direction on the diagram is irrelevant — the interface that faces the untrusted public side is outside, every time.

Configure PAT overload and read the translation table

Topology: R1 is the edge router. Gi0/0 faces the private LAN 10.10.10.0/24 (R1 = 10.10.10.1). Gi0/1 faces the ISP with public 203.0.113.2/30 and a default route to the provider. Hosts 10.10.10.11 and 10.10.10.12 need internet access, sharing R1's single public address.

PAT overload in three steps

! 1. Mark interfaces by role
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat inside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat outside

! 2. Define which inside sources to translate (standard ACL)
R1(config)# access-list 1 permit 10.10.10.0 0.0.0.255

! 3. Translate them to the outside interface address, overloaded
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload

Generate traffic from both hosts, then verify

R1# show ip nat translations
Pro  Inside global          Inside local        Outside local     Outside global
tcp  203.0.113.2:50001      10.10.10.11:50001   8.8.8.8:443       8.8.8.8:443
tcp  203.0.113.2:50002      10.10.10.12:51544   8.8.8.8:443       8.8.8.8:443
icmp 203.0.113.2:12         10.10.10.11:12      8.8.8.8:12        8.8.8.8:12

R1# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces:  GigabitEthernet0/0
Hits: 148  Misses: 3

Pro — the transport protocol of the flow. PAT keys on protocol plus port, so each flow is a distinct row.
Inside global — both TCP rows share the same address 203.0.113.2 but carry different ports, :50001 and :50002. That port is the whole trick: it is how the router demultiplexes returning traffic back to the right inside host.
Inside local — the real private socket. Host .12 used source port 51544 internally and was given :50002 on the outside; the router keeps the original port when it can and rewrites it when it must stay unique.
Outside local and Outside global — both 8.8.8.8:443, identical because the server is genuinely public and no outside translation is in play.
show ip nat statistics confirms the interface roles and the translation counts.

Reading Hits and Misses correctly

A hit is a lookup that found an existing translation. A miss is a lookup that did *not* find one and therefore had to create one. So misses are not an error counter — building those three translations is exactly what incremented Misses to 3, and a busy PAT router accumulates misses continuously as new flows open. That matters because the fault signature is not "misses are climbing" on its own; it is misses climbing while active translations stay at 0 and hits stay at 0. Traffic is arriving, no entry exists, and none is being created.

For an internal server that must accept connections *from* the internet, PAT alone is not enough — an outside host needs a permanent target, so add a static mapping: ip nat inside source static tcp 10.10.10.50 80 203.0.113.2 80.

A PAT that installs nothing

Symptom: inside hosts cannot reach the internet, show ip nat translations shows nothing, and the statistics show misses climbing with zero active translations and zero hits. An empty table means traffic is not matching a NAT rule, so walk the pipeline in order.

The two commands that isolate it

R1# show ip nat statistics
Total active translations: 0 (0 static, 0 dynamic; 0 extended)
Outside interfaces: GigabitEthernet0/1
Inside interfaces:  GigabitEthernet0/0
Hits: 0  Misses: 212

R1# show access-lists 1
Standard IP access list 1
    10 deny   10.10.10.0, wildcard bits 0.0.0.255
    20 permit any

Troubleshooting — the ACL is a selector, not a filter

The interfaces are correctly marked inside and outside, so that is not the fault. The ACL is: line 10 denies 10.10.10.0/24, so the NAT source list never selects the inside hosts and every packet is a miss with nothing created. This is the single most common NAT failure, and it is conceptually slippery — in ip nat inside source list, permit means "translate this" and deny means "leave this alone". Fix it by rewriting the ACL to permit the inside subnet, then clear ip nat translation * to drop stale state. If the ACL had been correct, the next suspect is a missing default route to the ISP — NAT cannot forward what routing cannot reach — and only then the NAT statements themselves.

The fix

R1(config)# no access-list 1
R1(config)# access-list 1 permit 10.10.10.0 0.0.0.255
R1# clear ip nat translation *

What you should retain

NAT rewrites non-routable private addresses to public ones at the edge; PAT/overload shares one public IP using unique source ports.
Inside local = real private, inside global = public face; local and global name the side you are looking from.
Static = permanent 1:1 and reachable from outside; dynamic = temporary 1:1 from a pool; PAT = many:1 with ports, the default for user internet.
Roles first — ip nat inside and ip nat outside by interface function — then the source ACL, then the source rule ending in overload.
Verify with show ip nat translations (rows are flows; watch the port column) and show ip nat statistics.
Misses count lookups that had to create a translation, so they rise on a healthy router. The fault signature is misses rising with 0 active translations and 0 hits.
Troubleshoot in order: interface role, then the source ACL permits the inside subnet, then Layer 3 routing to the ISP.

Pause and predictNot scored — nothing is recorded

Before you read on

Three cases on the R1 edge above. (1) Forty inside users need internet through R1's one public IP — which NAT type? (2) You configure ip nat inside source list 1 interface Gi0/1 but omit overload — what happens to the second and later hosts? (3) An outside customer must reach an inside web server at a fixed public IP — which NAT type?

Interactive tool

See it happen

Required~14 min

NAT/PAT Lab

Step through the translation illustrator and watch inside local, inside global, and the port field rewrite as you switch between static, dynamic, and PAT modes — the port column is the one to keep your eye on.

Open the tool

Section quiz

Check this section before moving on

Required8 questions~10 min

Addressing Services & NAT

The quiz opens on its own page so you can focus on it. It is a Week 1 milestone, tracked separately from this lesson's own completion.

Topics covered

• The DORA exchange and which messages are broadcast
• DHCP relay and when it is required
• The four NAT address terms
• PAT overload and the port field
• Isolating a NAT that installs no translations

Start the quiz

Study deeper

Topic guides extend this lesson — they do not replace the first-party walkthrough above.

NAT

For the full four-term table with the local/global mnemonic and additional worked translation examples

Open guide

Lesson orientation