CCNA 200-301 v1.1 reference — IP Services

NAT: inside source translation

Static NAT and dynamic pools for inside source translation, PAT overload behavior, and how to verify translations.

Objective 4.1v1.1 exam target

NAT terminology

Inside/outside describe location; local/global describe viewpoint.
Term	Meaning	Example
Inside local	Private address of the inside host	192.168.10.5
Inside global	Public address representing that host	203.0.113.10
Outside local	Outside host's address as seen inside	Usually same as outside global
Outside global	The outside host's real address	198.51.100.25

Inside/outside describe location; local/global describe viewpoint.

PAT multiplexes many inside locals over one inside global by rewriting the source port as well — the router tracks each flow in the translation table. This is why thousands of hosts share one public IP, and why inbound connections to 'the public IP' fail without a static mapping or port forwarding.

Static, dynamic and PAT

Inside source NAT forms

Type	Mapping	Use
Static NAT	One inside local ↔ one inside global, permanent	A server that must be reachable from outside
Dynamic NAT	Pool of inside globals, assigned on demand	Multiple hosts, limited public IPs
PAT (overload)	Many locals → one global, distinguished by port	The everyday case — one public IP for the LAN

Read a translation entry

Output: tcp 203.0.113.10:1025 192.168.10.5:1025 198.51.100.7:443 198.51.100.7:443

Inside global 203.0.113.10:1025 is what the outside sees.
Inside local 192.168.10.5:1025 is the real host socket.
The outside pair is the web server's endpoint — unchanged.

The left pair is the rewritten source; the right pair is the untouched destination.

Configure and verify

Static inside source NAT

Map web server 192.168.10.10 to public 203.0.113.10 — Privileged EXEC → Global + interface configuration

Cisco IOS / IOS XE

configure terminal
interface gigabitethernet0/0
 ip nat inside
 exit
interface gigabitethernet0/1
 ip nat outside
 exit
ip nat inside source static 192.168.10.10 203.0.113.10
 end

Verify

show ip nat translations
show ip nat statistics

A permanent static entry maps the two addresses.
Translation counters increment when the server is reached.

Changes device configuration.

NAT pool without overload

Dynamic NAT using a public pool without PAT — Privileged EXEC → Global configuration

Cisco IOS / IOS XE

Inside/outside interface roles already configured; pool addresses reserved and routed for the lab; ACL 1 reviewed intentionally.

configure terminal
ip nat pool BRANCH 203.0.113.16 203.0.113.31 netmask 255.255.255.0
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 pool BRANCH
 end

Verify

show ip nat translations
show ip nat statistics

Translations map inside locals to pool addresses one-to-one — generate test traffic first.
An empty translation table has several possible causes — check ACL match (show access-lists counters), inside/outside roles, whether traffic actually crossed, and pool availability.

Without overload, the pool supports 16 simultaneous inside-address mappings; entries are freed for reuse after translation timeout. PAT (... pool BRANCH overload) is the common variant.

Changes device configuration.

Dynamic NAT with overload (PAT)

Translate the LAN to the outside interface address — Privileged EXEC → Global configuration

Cisco IOS / IOS XE

configure terminal
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface gigabitethernet0/1 overload
 end

Verify

show ip nat translations
show ip nat statistics

Entries show inside local addresses sharing one inside global with different ports.
Hits increment per new translated flow.

A named pool needs its own definition: ip nat pool BRANCH-PAT 203.0.113.10 203.0.113.10 netmask 255.255.255.0 before ip nat inside source list 1 pool BRANCH-PAT overload. Non-overload pool NAT (... pool BRANCH without overload) maps hosts one-to-one from the pool.

Changes device configuration.

$ show ip nat translations (interpreted)

Pro Inside global Inside local Outside local Outside globalFour-column view per flow.

tcp 203.0.113.10:1025 192.168.10.5:1025 198.51.100.7:443 198.51.100.7:443PAT flow — ports preserved here but tracked.

--- 203.0.113.10 192.168.10.10 --- ---Static mapping — no ports, always present.

Common mistakes

Forgetting ip nat inside/outside on interfaces — the translation rule alone does nothing.
Expecting static NAT entries to expire — they're permanent; dynamic/PAT entries are per-flow.
Applying the ACL to the interface instead of inside ip nat inside source list — the ACL selects *which* traffic translates.
Believing PAT enables inbound access — unsolicited inbound packets have no translation entry and are dropped.

Hosts can't reach the internet after NAT config

Observation: Inside hosts lose outbound connectivity; show ip nat translations is empty.

Hypotheses

Inside/outside interface labels missing or swapped
ACL denies the LAN addresses
Overload keyword missing and pool exhausted

Check	Indicates
`show ip nat statistics`	Interfaces tagged inside/outside and hit counters.
The ACL matching the LAN range	A denied source never generates translations.
`debug ip nat` (lab only)	Shows each packet the NAT process sees or skips.

Correction: Fix interface roles or the ACL, then retest.

Translation entries appear for inside clients and outbound traffic works.

On this page

NAT terminology
Static, dynamic and PAT
Configure and verify

Related resources

Practise this topic Source topic 44: NAT (Part 1 - Static NAT)Practise topic 44 deck Source topic 45: NAT (Part 2 - Dynamic NAT & PAT)Practise topic 45 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
RFC 2663 — IP Network Address Translator (NAT) Terminology and Considerations — reviewed 2026-11-02
Cisco — IP Addressing Services Command Reference — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.