How to Set Up NAT Overload (PAT) on Cisco Routers: Port Address Translation Configuration

If you’ve ever set up internet access for a home router, a small office, or an enterprise branch, you’ve used PAT — Port Address Translation, more commonly called NAT Overload — even if you didn’t realize it. It’s the technology that lets your entire office share a single public IP address for internet access, and it’s arguably the single most deployed feature in networking, given how few public IPv4 addresses exist relative to the billions of devices online. Let me walk you through exactly how it works and how to configure it properly on a Cisco router.

What Is NAT Overload (PAT)?

PAT allows many internal (private) IP addresses to share a single public IP address by distinguishing each session using a unique source port number, in addition to the address itself. Where Dynamic NAT maps one private address to one public address, PAT maps many private addresses to one public address, using the combination of (public IP + source port) as the unique identifier for each translated session.

Here’s the analogy I always come back to: imagine an apartment building with a single street address, but every resident’s mail gets a unique apartment/unit number appended. The building (public IP) is shared, but the unit number (source port) makes every piece of mail (session) uniquely deliverable. That’s exactly how PAT works — thousands of internal hosts can share one public IP because each session gets tagged with a distinct port number, and the router keeps a translation table mapping (private IP, private port) to (public IP, public port) pairs.

Why PAT Is So Widely Used

• Massive address conservation: a single public IP can support tens of thousands of simultaneous sessions (theoretically up to ~65,000 ports, practically fewer due to platform limits and reserved ranges).
• No pool management needed: unlike Dynamic NAT, there’s no pool to size or exhaust in the same way — you’re overloading a single address (or small set of addresses) rather than depleting a finite 1:1 pool.
• This is what your home router does: virtually every consumer router in the world uses PAT to share one ISP-assigned public IP across every device in the house.

Prerequisites

• A Cisco router with at least one interface facing your internal network and one facing the internet
• A single public IP address (or a small pool, if you want overload distributed across more than one)
• Internal LAN addressing already configured

Topology for This Guide

Internal LAN: 192.168.1.0/24 (Gi0/1 - inside interface)
Public IP: 203.0.113.1 (Gi0/0 - outside interface, ISP-assigned)

Method 1: Overload Using the Outside Interface’s IP Address

This is the most common real-world configuration — especially for branch offices and small sites with only a single public IP assigned by the ISP (often via DHCP from the provider).

Step 1: Mark Inside and Outside Interfaces

Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip nat inside
Router(config-if)# exit

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip nat outside
Router(config-if)# exit

Step 2: Define an ACL for Eligible Internal Traffic

Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255

Step 3: Configure PAT Using the Outside Interface’s Address

Router(config)# ip nat inside source list 10 interface GigabitEthernet0/0 overload

This is the whole thing. That single command tells the router: “translate any traffic matching ACL 10, coming from an inside interface, using the IP address currently assigned to GigabitEthernet0/0, and overload it — meaning distinguish sessions by port number.”

Method 2: Overload Using a Defined Pool

If you have more than one public IP address and want PAT to distribute load across them (still overloading each, but spreading sessions), use a pool instead of a single interface address:

Router(config)# ip nat pool PAT-POOL 203.0.113.1 203.0.113.3 netmask 255.255.255.0
Router(config)# ip nat inside source list 10 pool PAT-POOL overload

Full Configuration Recap (Interface-Based Method)

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.0
 ip nat outside

access-list 10 permit 192.168.1.0 0.0.0.255
ip nat inside source list 10 interface GigabitEthernet0/0 overload

ip route 0.0.0.0 0.0.0.0 203.0.113.254

Verifying PAT

Generate traffic from an internal host, then check the translation table — this is where you’ll see PAT’s defining characteristic, the port numbers, clearly:

Router# show ip nat translations
Pro Inside global         Inside local        Outside local      Outside global
tcp 203.0.113.1:63021     192.168.1.10:52344  93.184.216.34:443  93.184.216.34:443
tcp 203.0.113.1:63022     192.168.1.15:51203  142.250.72.14:443  142.250.72.14:443
udp 203.0.113.1:63023     192.168.1.10:60110  8.8.8.8:53         8.8.8.8:53

Notice both hosts (192.168.1.10 and 192.168.1.15) are sharing the exact same public IP (203.0.113.1), distinguished entirely by the port number. That’s PAT in action.

Router# show ip nat statistics
Total active translations: 3 (0 static, 3 dynamic; 3 extended)
Peak translations: 47, occurred 00:12:08 ago
Outside interfaces:
  GigabitEthernet0/0
Inside interfaces:
  GigabitEthernet0/1
Hits: 312  Misses: 0

How Many Sessions Can PAT Actually Support?

In theory, port numbers range from 0–65535, so a single public IP could support tens of thousands of simultaneous translated sessions. In practice, Cisco IOS reserves certain lower port ranges and platform memory/CPU constraints apply, but PAT still comfortably scales to support small-to-midsize offices, and even much larger deployments when combined with multiple overloaded addresses in a pool.

You can view and tune the port range behavior on some platforms with:

Router(config)# ip nat translation port-limit 100

This example caps each individual inside host to a maximum of 100 concurrent translated ports — useful for preventing a single misbehaving host or malware infection from exhausting the router’s translation table.

PAT for Multiple Public IPs (Load Distributed Overload)

If your organization has been assigned a small block of public IPs (say, a /29), and you want to overload across all of them rather than concentrating everything onto one address, the pool-based method shown above spreads new translations across the available addresses in round-robin fashion, each individually overloaded. This can help distribute load and, in edge cases, work around certain per-IP connection limits that specific destination services occasionally enforce.

Combining PAT with Static NAT for Inbound Services

PAT alone only supports outbound-initiated connections — an external host can’t reliably reach a specific internal server through pure PAT, because there’s no permanent, predictable mapping. If you need to expose an internal server (like a web server) for inbound connections while still using PAT for general outbound internet access, you combine PAT with a static NAT entry (covered in depth in the companion port forwarding guide):

Router(config)# ip nat inside source static tcp 192.168.1.100 80 203.0.113.1 80

This static entry coexists with the general PAT rule — general outbound traffic overloads dynamically, while port 80 on the public IP is permanently and predictably forwarded to the internal web server.

Real-World Enterprise Scenario

The most common scenario, by far: a branch office with a single ISP circuit and one public IP assigned via DHCP or statically by the provider. Every device in the office — laptops, phones, IP phones, printers with internet-facing update checks — shares that one address through PAT for all outbound internet access. Layer in a handful of static NAT/port-forwarding entries for anything that needs inbound reachability (like a VPN concentrator or an on-prem service), and that’s a complete, production-grade internet edge design for a huge percentage of small-to-midsize business sites.

At larger scale, enterprises sometimes deploy PAT with a small pool of public addresses at the internet edge specifically to increase overall translation capacity beyond what port limits on a single address comfortably support, particularly in environments with very high concurrent session counts (large call centers, big retail sites with many POS terminals, etc.).

Security Considerations

• PAT provides a side-effect of address hiding (internal addressing isn’t directly visible externally), but it is not a substitute for a stateful firewall — don’t treat it as your primary security boundary.
• Because PAT only permits externally-initiated connections that match an existing outbound-created state (or an explicit static mapping), it does provide a natural default-deny posture for unsolicited inbound traffic — which is a genuinely useful security property, just not a complete one.
• Monitor show ip nat statistics regularly for unusually high translation counts, which can indicate malware, a compromised host, or a misconfigured application generating excessive connections.

Common Configuration Mistakes

• Forgetting ip nat inside / ip nat outside interface designations.
• Forgetting the overload keyword — without it, the command behaves like Dynamic NAT (one-to-one) and will fail once your single IP is “used up” by a single active session.
• Using an ACL that’s too permissive (any) and inadvertently translating traffic you didn’t intend to (like traffic between VRFs or transit traffic that should be routed normally).
• Not accounting for asymmetric routing in multi-WAN designs, which can break PAT session state if return traffic comes back a different path than it left.
• Assuming PAT alone allows inbound access to internal servers — it doesn’t, without an accompanying static NAT/port-forward entry.

Troubleshooting Checklist

1. show ip nat statistics — confirm interfaces are correctly marked and check hit/miss counters.
2. show ip nat translations — confirm active sessions show the expected shared public IP with distinct ports.
3. debug ip nat (use cautiously in production, especially under high traffic load) — shows real-time translation creation and teardown.
4. Confirm the ACL used matches your intended internal source ranges with show access-list 10.
5. If specific applications fail (some older protocols like certain VoIP or FTP implementations have known NAT compatibility issues), check whether the platform’s NAT ALG (Application-Level Gateway) support for that protocol is enabled — ip nat service commands control some of these behaviors.
6. Verify default routing correctly sends traffic out the ip nat outside interface.

Performance Tuning Tips

• Use ip nat translation port-limit to prevent any single host from monopolizing translation resources.
• Adjust ip nat translation timeout, tcp-timeout, and udp-timeout values based on your actual traffic patterns — very short timeouts can prematurely drop long-lived legitimate sessions (like persistent SSH or streaming connections), while very long timeouts can leave stale entries consuming table space.
• On higher-throughput platforms, confirm CEF (Cisco Express Forwarding) is active, since NAT translation performance benefits significantly from hardware/CEF-accelerated forwarding paths versus process switching.
• For very high session count environments, consider spreading overload across a small pool of addresses rather than a single IP, to increase effective port capacity.

FAQs

Is NAT Overload the same thing as PAT? Yes — they’re the same feature. “NAT Overload” is the Cisco IOS command-line terminology; “PAT” (Port Address Translation) is the more general industry term. You’ll see both used interchangeably.

Can external hosts initiate connections to internal devices through PAT? Not through PAT alone. PAT only creates translation entries in response to outbound-initiated traffic. For inbound reachability, you need a static NAT entry (port forwarding) alongside PAT.

How many devices can realistically share one public IP with PAT? Practically, PAT comfortably supports hundreds to low thousands of simultaneous sessions per public IP on typical enterprise router platforms, which easily covers the concurrent session needs of small-to-midsize offices. Extremely high-density environments may need multiple overloaded addresses.

Does PAT work with UDP-based protocols like DNS and VoIP the same way as TCP? Yes, both TCP and UDP sessions are tracked using the (IP + port) combination, though some UDP-heavy protocols (particularly certain VoIP signaling protocols like SIP) have known NAT traversal complications that sometimes require additional handling (ALGs, STUN/TURN at the application layer, or SBCs in more complex deployments).

Summary

NAT Overload (PAT) is the workhorse behind almost every internet-connected network’s outbound connectivity, letting a single public IP address support a huge number of internal devices simultaneously by distinguishing sessions with unique port numbers. The essentials: mark your inside/outside interfaces, don’t forget the overload keyword, and remember that PAT alone doesn’t allow inbound connections — pair it with static NAT for any service that needs to be reachable from outside. Once you’ve configured this once, you’ll recognize it as the exact mechanism running quietly behind almost every internet connection you’ve ever used.

References

• Cisco: Configuring NAT for IP Address Conservation
• RFC 3022: Traditional IP Network Address Translator (Traditional NAT)
• Cisco IOS IP Addressing Services Command Reference