If you have ever wondered how your entire home or office network reaches the internet using just one public IP address, the answer is NAT. I have configured NAT more times than I can count, on everything from lab routers to production edge devices, and it never stops being one of the most practical skills a network engineer can have. In this guide, I am going to walk you through everything you need to know about NAT on Cisco routers, from the basic theory to full CLI configuration, verification, troubleshooting, and real-world deployment.
What Is NAT and Why Do We Need It?
Network Address Translation is a method that allows a router to translate private IP addresses (the ones used inside your local network) into public IP addresses (the ones used on the internet), and vice versa. NAT was originally introduced to solve the problem of IPv4 address exhaustion. There simply are not enough public IPv4 addresses for every device in the world to have its own, so NAT lets an entire organization share one or a handful of public addresses.
Beyond conserving address space, NAT also provides a layer of obscurity. Since internal addressing is hidden behind a translated public address, it becomes harder for an outsider to map your internal network structure just by looking at traffic.
There are three main types of NAT that you will work with on Cisco routers:
- Static NAT – a fixed, one-to-one mapping between a private IP and a public IP
- Dynamic NAT – a pool-based mapping where private IPs are translated to available public IPs from a pool
- PAT (Port Address Translation) – also called NAT overload, where many private IPs share a single public IP by using different port numbers
How NAT Works: The Protocol Fundamentals
When a packet leaves your internal network, the router examines the packet as it crosses from the “inside” interface to the “outside” interface. It rewrites the source IP address (and possibly the source port, in the case of PAT) in the IP header. The router keeps a translation table so that when a return packet comes back from the internet, it knows how to translate the destination address back to the correct internal host.
Here is the general packet flow:
- Internal host (10.0.0.10) sends a packet to a web server on the internet.
- Router receives the packet on the inside interface.
- Router checks its NAT table and rewrites the source address to the public IP (or a pooled/PAT address).
- Packet leaves through the outside interface with the new source address.
- Return traffic arrives addressed to the public IP.
- Router looks up the NAT table and rewrites the destination address back to the internal host.
- Packet is forwarded to the internal host.
Cisco routers refer to interfaces as either “inside” or “outside” in the context of NAT, and this designation is critical — NAT will not function correctly if interfaces are not marked properly.
Beginner Concepts You Should Understand First
Before diving into configuration, it helps to understand a few terms that Cisco uses in its NAT terminology:
- Inside local address – the private address of a host as seen from inside the network
- Inside global address – the address that represents the inside host as seen from the outside network (the translated address)
- Outside local address – the address of an outside host as seen from inside the network
- Outside global address – the actual address of the outside host as it exists in its own network
For most small and mid-sized deployments, you will primarily deal with inside local and inside global addresses, since outside NAT is far less common.
Lab Topology
For this guide, I am using a simple topology:
[PC/LAN 10.0.0.0/24] --- G0/0 [Router R1] G0/1 --- [ISP/Internet 203.0.113.0/30]
- G0/0 is the inside interface facing the LAN
- G0/1 is the outside interface facing the ISP
Static NAT Configuration
Static NAT is used when you need a permanent, predictable mapping — for example, when you are hosting an internal web server that needs to be reachable from the internet at a fixed public IP.
Router> enable
Router# configure terminal
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip address 10.0.0.1 255.255.255.0
Router(config-if)# ip nat inside
Router(config-if)# exit
Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip address 203.0.113.1 255.255.255.252
Router(config-if)# ip nat outside
Router(config-if)# exit
Router(config)# ip nat inside source static 10.0.0.10 203.0.113.10
Router(config)# end
This command tells the router: whenever host 10.0.0.10 sends traffic out, translate its source address to 203.0.113.10, and whenever traffic comes in addressed to 203.0.113.10, forward it to 10.0.0.10.
Verification
Router# show ip nat translations
Pro Inside global Inside local Outside local Outside global
--- 203.0.113.10 10.0.0.10 --- ---
Router# show ip nat statistics
Total active translations: 1 (1 static, 0 dynamic; 0 extended)
Outside interfaces:
GigabitEthernet0/1
Inside interfaces:
GigabitEthernet0/0
Hits: 24 Misses: 0
Dynamic NAT Configuration
Dynamic NAT maps a group of private addresses to a pool of public addresses on a first-come, first-served basis. This is useful when you have several public IPs but not enough for every host, and you want the router to assign them automatically as needed.
Router(config)# ip nat pool PUBLIC-POOL 203.0.113.20 203.0.113.30 netmask 255.255.255.224
Router(config)# access-list 1 permit 10.0.0.0 0.0.0.255
Router(config)# ip nat inside source list 1 pool PUBLIC-POOL
Here, the access list defines which internal addresses are eligible for translation, and the pool defines the range of public addresses that can be assigned.
Verification
Router# show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.20:1050 10.0.0.15:1050 198.51.100.5:80 198.51.100.5:80
Note that once all addresses in the pool are exhausted, additional hosts will not be able to reach the internet until a translation entry times out.
PAT (Port Address Translation) — NAT Overload
PAT is by far the most commonly deployed form of NAT in real networks, because it allows an entire organization to share a single public IP address. This is exactly what your home router does.
Router(config)# access-list 1 permit 10.0.0.0 0.0.0.255
Router(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload
This tells the router to use the IP address configured on G0/1 as the shared public address, and to differentiate sessions using source port numbers.
Verification
Router# show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.1:2001 10.0.0.10:2001 93.184.216.34:443 93.184.216.34:443
tcp 203.0.113.1:2002 10.0.0.11:2002 93.184.216.34:443 93.184.216.34:443
udp 203.0.113.1:5000 10.0.0.12:5000 8.8.8.8:53 8.8.8.8:53
You can see multiple internal hosts sharing the same outside global address but with different port numbers, which is the defining trait of PAT.
Real-World Enterprise Scenario
Consider a mid-sized company with a single ISP-provided public IP address and an internal network of 150 employees. In this case, PAT is the obvious choice — one public IP, hundreds of internal sessions, differentiated by port. However, the company also hosts an internal mail server that needs to be reachable from the internet. For that single server, static NAT is layered on top so it has a dedicated, permanent public IP mapping while everyone else uses PAT through the same or a different public address. This hybrid deployment — static NAT for servers, PAT for general users — is the most common real-world design pattern you will encounter.
Security Considerations
- NAT is not a substitute for a firewall. Even though it hides internal addressing, you should still deploy ACLs or a dedicated firewall (like a Cisco ASA) at the network edge.
- Be careful with static NAT entries for servers — only expose the specific ports required using static NAT with route-map or port-based static NAT rather than mapping the entire host.
- Port-based static NAT example, exposing only port 443:
Router(config)# ip nat inside source static tcp 10.0.0.20 443 203.0.113.15 443
- Regularly audit your NAT table with
show ip nat translationsto ensure no unexpected mappings exist. - Combine NAT with CBAC (Context-Based Access Control) or a zone-based firewall for stateful inspection of translated traffic.
Best Practices
- Always clearly mark inside and outside interfaces before troubleshooting NAT issues; this is the single most common misconfiguration.
- Use PAT for general internet access and static NAT only for servers that must be reachable inbound.
- Keep your NAT access lists as specific as possible; avoid using
anyin place of a defined subnet. - Document your NAT pool ranges so they do not overlap with statically assigned addresses.
- Set an appropriate NAT translation timeout using
ip nat translation timeoutto avoid table exhaustion from stale entries.
Optimization and Performance Tuning
- Adjust the default translation timeout (24 hours for TCP, 5 minutes for UDP by default) based on your traffic patterns:
Router(config)# ip nat translation tcp-timeout 3600
Router(config)# ip nat translation udp-timeout 120
- On high-traffic routers, monitor
show ip nat statisticsregularly to check for translation pool exhaustion. - Consider Cisco Express Forwarding (CEF), which is enabled by default on most platforms and significantly speeds up NAT translation lookups.
- For very large deployments, consider NAT64 or moving to IPv6 to eliminate the need for translation altogether on new infrastructure.
Troubleshooting and Common Configuration Mistakes
Mistake 1: Forgetting to mark inside/outside interfaces NAT will simply not work if ip nat inside and ip nat outside are not applied to the correct interfaces. This is the most frequent error I see, even among experienced engineers who are in a hurry.
Mistake 2: Overlapping access list and NAT pool ranges If your access list permits addresses that overlap with your NAT pool, you can end up with routing loops or failed translations.
Mistake 3: Not clearing stale translations during testing Use the following to clear the table while troubleshooting:
Router# clear ip nat translation *
Mistake 4: Asymmetric routing bypassing NAT If return traffic takes a different path than outbound traffic, NAT can fail because the translation table lookup won’t match.
Useful troubleshooting commands:
Router# debug ip nat
Router# show ip nat translations verbose
Router# show running-config | section nat
Frequently Asked Questions
Q: What is the difference between NAT and PAT? NAT (in its basic static or dynamic form) is typically a one-to-one address mapping, while PAT allows many-to-one mapping using port numbers, which is why PAT is also called NAT overload.
Q: Can I use NAT with IPv6? IPv6 was designed to eliminate the need for NAT because of its enormous address space, though NAT64 exists as a transition mechanism between IPv4 and IPv6 networks.
Q: Does NAT affect VPN traffic? Yes, NAT can interfere with certain VPN protocols like IPsec, which is why NAT-Traversal (NAT-T) exists to encapsulate IPsec traffic inside UDP so it survives translation.
Q: How many simultaneous sessions can PAT support? Theoretically, PAT can support over 64,000 simultaneous sessions per public IP address, since it uses the full range of TCP/UDP port numbers, though practical limits are often lower due to router memory and CPU.
Q: Do I need NAT if I have a public IP for every device? No. If every device has a routable public IP, NAT is not required, though many organizations still use it for the added security obscurity it provides.
Summary and Key Takeaways
NAT remains one of the most essential technologies in enterprise and home networking, even as IPv6 adoption grows. Static NAT gives you predictable, permanent mappings ideal for servers. Dynamic NAT distributes a pool of public addresses among internal hosts. PAT, the workhorse of most real-world deployments, allows an entire network to share a single public IP through port-based translation. Getting comfortable with all three — along with proper interface marking, access list scoping, and verification commands — will serve you well whether you are configuring a small office router or supporting enterprise-scale infrastructure.
References
- Cisco IOS NAT Configuration Guide: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-16/nat-xe-16-book.html
- Cisco NAT Overview and Command Reference: https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13772-12.html