Inside Source NAT and PAT on Cisco Routers

Inside source NAT rewrites the source address of packets leaving your network and reverses the rewrite on the replies. Three flavors exist: static NAT maps one private address to one public address permanently, a dynamic pool hands out public addresses from a range as hosts need them, and PAT (Port Address Translation, configured with the overload keyword) squeezes an entire network behind a single public address by rewriting the source port as well. Every flavor also requires that each interface be marked ip nat inside or ip nat outside, and forgetting that step is the most common reason a correct-looking NAT configuration does nothing at all.

The four address terms

IOS names every address in a translation with two words. The first says which network the host belongs to; the second says which side of the router you are standing on when you look at the address.

• Inside local: an inside host’s address as inside devices see it. The private address configured on the workstation.
• Inside global: that same inside host’s address as the outside world sees it. The public address the router substitutes.
• Outside global: an outside host’s address as the outside world sees it. The server’s real public address.
• Outside local: that same outside host’s address as inside devices see it. Identical to outside global unless outside source translation is also configured, which is unusual.

Applied to a single row of a real table, with workstation 10.1.1.10 reaching a web server at 198.51.100.20 through a router owning 203.0.113.5:

Pro  Inside global      Inside local       Outside local      Outside global
tcp  203.0.113.5:1055   10.1.1.10:1055     198.51.100.20:80   198.51.100.20:80

Inside local is 10.1.1.10, inside global is 203.0.113.5, and both outside columns hold 198.51.100.20. The exam’s favorite trap is swapping inside local and inside global, so anchor on this: local is the address that only makes sense inside, global is the address that works on the public Internet.

Marking the interfaces

NAT is direction-aware. The router only translates when a packet crosses from an interface marked inside to one marked outside, or when a reply crosses back the other way.

R1(config)# interface gigabitethernet0/0/1
R1(config-if)# ip nat inside
R1(config-if)# exit
R1(config)# interface gigabitethernet0/0/0
R1(config-if)# ip nat outside

If the marking is missing, the router still routes. Packets leave the WAN interface carrying their original private source address, the far end either drops them or replies to an address that never returns, and nothing in the NAT configuration reports a problem. The failure is completely silent, which is why the interface marking is the first thing to check when translations are not being built.

Reversing the two produces the same result for a different reason: ip nat inside source acts on traffic flowing inside to outside, so with the labels backwards that flow never happens and the translation table stays empty. A default route pointing at the provider is also required, since NAT translates packets but does not route them. See static route configuration for that piece, and longest prefix match for why that all-zeros route catches only the traffic no more specific entry claimed.

Static NAT

A static entry is a permanent one-to-one mapping, appropriate for a server that must be reachable from the outside at a predictable address.

R1(config)# ip nat inside source static 10.1.1.100 203.0.113.10

Static entries appear in the translation table immediately, before any traffic flows, and persist across clear commands because they come from the configuration. Port-level static translation, or port forwarding, maps a single service instead of the whole host:

R1(config)# ip nat inside source static tcp 10.1.1.100 443 203.0.113.10 443

Dynamic pool

A pool holds a range of public addresses that the router assigns to inside hosts on demand, releasing each one when the entry times out.

R1(config)# ip nat pool BRANCH 203.0.113.10 203.0.113.20 netmask 255.255.255.0
R1(config)# access-list 1 permit 10.1.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 pool BRANCH

The pool command is strictly positional: a name, then the first address, then the last address, then either netmask with a dotted-decimal mask or prefix-length with a number. Four syntax errors regularly appear as distractors.

• mask is not a keyword the parser knows. The word is netmask.
• There is no range keyword. The starting and ending addresses are positional arguments with nothing between them.
• inside does not belong in the pool statement. It appears in ip nat inside source, which is the mapping that references the pool by name afterward.
• The mask describes the subnet the addresses live in, not the size of the range, so a /24 subnet takes netmask 255.255.255.0 even when the pool holds only eleven addresses.

The access list is a selector, not a filter. It identifies which source addresses are eligible for translation, and it is never applied to an interface with ip access-group.

PAT (overload)

Adding overload tells the router to reuse one global address for many inside hosts by also rewriting the source port, so each conversation stays uniquely identifiable. Two forms exist. Overloading a pool suits a site with a few public addresses and thousands of hosts:

R1(config)# ip nat inside source list 1 pool BRANCH overload

Overloading the outside interface address is what a branch or home router does:

R1(config)# ip nat inside source list 1 interface gigabitethernet0/0/0 overload

The interface form needs no pool and automatically follows whatever address the interface holds, which matters when the provider assigns it by DHCP with ip address dhcp on the outside interface.

	Static NAT	Dynamic pool	PAT / overload
Mapping	One inside address to one global address, fixed	One inside address to one global address, temporary	Many inside addresses to one global address
Global addresses needed	One per inside host	One per concurrent inside host	One
Created by	Configuration	First outbound packet from a permitted source	First outbound packet from a permitted source
Ports rewritten	No (unless the port form is used)	No	Yes
Inbound sessions	Reachable from outside	Not reachable	Not reachable without a static port mapping
Pool exhaustion	Not applicable	Yes, later hosts are dropped	Effectively no
Typical use	Published servers	Legacy, rare today	Almost every Internet edge

Verification

The translation table shows what actually got built:

R1# show ip nat translations
Pro  Inside global       Inside local        Outside local       Outside global
tcp  203.0.113.5:1055    10.1.1.10:1055      198.51.100.20:80    198.51.100.20:80
tcp  203.0.113.5:1056    10.1.1.11:1055      198.51.100.20:80    198.51.100.20:80
udp  203.0.113.5:53114   10.1.1.12:53114     203.0.113.53:53     203.0.113.53:53
---  203.0.113.10        10.1.1.100          ---                 ---

The first two rows show two inside hosts that both chose source port 1055 while sharing one inside global address; the router moved the second to port 1056 to keep the rows distinct, and that port rewriting is what overload means. The last row is a static entry: no protocol and no outside addresses, because it exists independently of any conversation.

The statistics view answers the questions the table cannot:

R1# show ip nat statistics
Total active translations: 4 (1 static, 3 dynamic; 3 extended)
Peak translations: 61, occurred 00:22:14 ago
Outside interfaces:
  GigabitEthernet0/0/0
Inside interfaces:
  GigabitEthernet0/0/1
Hits: 18422  Misses: 0
Expired translations: 340
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 1 pool BRANCH refcount 3
 pool BRANCH: netmask 255.255.255.0
        start 203.0.113.10 end 203.0.113.20
        type generic, total addresses 11, allocated 1 (9%), misses 0

Three fields carry most of the diagnostic value. The Inside interfaces and Outside interfaces lists confirm the marking is present; an empty list is the silent failure described earlier. Hits counts packets matched to an existing translation, so a hit counter frozen at zero while users complain means traffic is not reaching the NAT process. Misses counts packets that needed a new translation and could not get one, so a climbing misses counter with a dynamic pool means the pool is exhausted, and the fix is more addresses or the overload keyword. Extended entries are those carrying port numbers, which is another way of saying PAT created them.

Clearing translations

After correcting a mapping, the entries built under the old configuration are still in the table and still steering traffic. Flush them from privileged EXEC mode, one level above the configuration prompt where the mapping was fixed and one of several places where the prompt tells you whether a command will be accepted:

R1# clear ip nat translation *

The asterisk is the wildcard for every dynamic entry. Hosts rebuild their translations against the corrected configuration on their next packet, at the cost of breaking sessions currently open, so this belongs in a change window. A single entry can be cleared instead with clear ip nat translation inside 203.0.113.5 10.1.1.10.

Three near-miss commands are worth recognizing as wrong. clear ip nat statistics resets the hit and miss counters and leaves every stale entry in place. There is no clear ip nat table all form in IOS. And no ip nat translations is not a command at all: configuration negation removes configuration lines, while translations are runtime table entries rather than commands.

How the 200-301 exam tests this

• Terminology on a table row. You are shown one line of show ip nat translations and asked to name a specific column’s value. Work from the two-word rule instead of memorizing column order, and expect inside local and inside global to be swapped in the distractors.
• Syntax discrimination. Four nearly identical ip nat pool lines differ by one token. Reject mask for netmask, reject an inserted range, and reject inside appearing inside the pool definition.
• Silent failure. A configuration is shown with a correct pool, a correct access list, and a correct mapping, but no interface is marked, or the inside and outside labels are reversed. The symptom is an empty translation table and no error message.
• Reading the counters. A dynamic pool with a rising misses counter is exhausted; the fix is overload or a larger pool. A static entry appearing in the table before any traffic is expected behavior, not a fault.
• Table maintenance. After a mapping change, the command to flush stale dynamic entries is clear ip nat translation *, and clearing statistics is offered as the trap.

Every one of those items assumes you can already read an access list and a routing table, which is the phase of a study plan where NAT belongs rather than something to take on early. Once that foundation is in, timed practice exams are where the two-word rule proves it has become reflex.

Quick reference

• Inside local is the private address; inside global is what the outside sees; outside global is the far host’s real address; outside local usually matches it.
• Every participating interface needs ip nat inside or ip nat outside, or nothing is translated and nothing is logged.
• Static: ip nat inside source static 10.1.1.100 203.0.113.10.
• Pool: ip nat pool NAME <first> <last> netmask <mask>, positional, no range, no inside.
• Dynamic mapping: ip nat inside source list 1 pool NAME; add overload for PAT.
• Interface PAT: ip nat inside source list 1 interface gigabitethernet0/0/0 overload.
• The ACL selects eligible sources and is never applied with ip access-group.
• show ip nat translations for the table, show ip nat statistics for interface marking, hits, misses, and pool utilization.
• clear ip nat translation * flushes dynamic entries from privileged EXEC; clear ip nat statistics only resets counters.